US state consumer privacy laws

Which US states have comprehensive consumer privacy laws, who do they apply to, and what happens if a business breaks them?

Enacted US state laws that broadly cover consumer personal data, including laws passed but not yet in effect. Excludes laws limited to one sector or data type, such as health or biometric data, and bills still pending. Florida's Digital Bill of Rights is included even though it reaches only very large companies.

Last read 2026-11-01. "Not found" means no source we could use said so, which never means no. "None stated" means the source was read and gives no such value. Each row's page gives the source and exact quote for its values.

NameLawTakes effectWho it applies toConsumers threshold (consumers)Cure period (days)Cure period endsEnforced byMaximum penalty (USD per violation)Private right of actionOpt-out signal required
AlabamaAlabama Personal Data Protection ActMay 1, 2027Control or process the personal data of more than25000 consumers45 daysNone statedAttorney General15000 USD per violationNone statedYes
CaliforniaCalifornia Consumer Privacy Act of 2018Not looked at yetHave a gross annual revenue of over $25 million100000 consumersNot looked at yetNot looked at yetNot looked at yetNot looked at yetYesYes
ColoradoCOLORADO PRIVACY ACTJuly 1, 2023PROCESSES THE PERSONAL DATA OF ONE HUNDRED THOUSAND CONSUMERS OR MORE DURING A CALENDAR YEAR100000 consumers60 daysJANUARY 1, 2025ATTORNEY GENERAL AND DISTRICT ATTORNEYSNot looked at yetNoYes
ConnecticutNot looked at yetJuly 1, 2023Not looked at yet35000 consumers60 daysDecember 31, 2024Attorney General5000 USD per violationNoYes
DelawareDelaware Personal Data Privacy ActNot looked at yetNot looked at yet35000 consumers60 daysDecember 31, 2025Department of Justice10000 USD per violationNoYes
FloridaFlorida Digital Bill of RightsNot looked at yetMakes in excess of $1 billion in global gross annual revenuesNot looked at yet45 daysNot looked at yetDepartment of Legal Affairs50000 USD per violationNoNot looked at yet
IndianaNot looked at yetNot looked at yetNot looked at yetNot looked at yetNot looked at yetNot looked at yetNot looked at yetNot looked at yetNot looked at yetNot looked at yet
IowaNot looked at yetJanuary 1, 2025Controls or processes personal data of at least one hundred thousand consumers.100000 consumers90 daysNone statedattorney general7500 USD per violationNoNone stated
KentuckyKentucky Consumer Data Protection ActJanuary 1, 2026One hundred thousand (100,000) consumers100000 consumers30 daysNone statedAttorney General7500 USD per violationNoNone stated
LouisianaLouisiana Data Privacy ActJanuary 1, 2027Has annual gross revenues in excess of twenty-five million dollars.Not looked at yetNot looked at yetJuly 31, 2027attorney generalNot looked at yetNot looked at yetNot looked at yet
MarylandMaryland Online Data Privacy Act of 2024Not looked at yetNot looked at yet35000 consumersNot looked at yetNot looked at yetNot looked at yet25000 USD per violationNot looked at yetYes
MinnesotaMinnesota Consumer Data Privacy ActNot looked at yetcontrols or processes personal data of 100,000 consumers or more, excluding personal data controlled or processed solely for the purpose of completing a payment transaction100000 consumers30 daysJanuary 31, 2026attorney general7500 USD per violationNoYes
MontanaNot looked at yetNot looked at yetNot looked at yetNot looked at yetNot looked at yetNot looked at yetNot looked at yetNot looked at yetNot looked at yetNot looked at yet
NebraskaData Privacy ActNot looked at yetIs not a small business as determined under the federal Small Business ActNone statedNot looked at yetNot looked at yetAttorney General7500 USD per violationNoNot looked at yet
New HampshireNot looked at yetJan. 1, 2025Controlled or processed the personal data of not less than 35,000 unique consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction35000 consumers60 daysDecember 31, 2025attorney generalNot looked at yetNoYes
New JerseyNot looked at yetNot looked at yetNot looked at yet100000 consumers30 daysNot looked at yetOffice of the Attorney GeneralNot looked at yetNot looked at yetYes
OklahomaNot looked at yetJanuary 1, 2027controls or processes personal data of at least one hundred thousand (100,000) consumers100000 consumers30 daysNone statedAttorney General7500 USD per violationNoNone stated
OregonNot looked at yetNot looked at yetNot looked at yet100000 consumers30 daysNot looked at yetAttorney General7500 USD per violationNoYes
Rhode IslandRhode Island Data Transparency and Privacy Protection ActJanuary 1, 2026Controlled or processed the personal data of not less than thirty-five thousand (35,000) customers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction.35000 consumersNot looked at yetNot looked at yetattorney general500 USD per violationNoNot looked at yet
TennesseeNot looked at yetNot looked at yetNot looked at yetNot looked at yetNot looked at yetNot looked at yetNot looked at yetNot looked at yetNot looked at yetNot looked at yet
TexasTexas Data Privacy and Security ActJuly 1, 2024is not a small business as defined by the UnitedNone stated30 daysNone statedattorney general7500 USD per violationNoYes
UtahUtah Consumer Privacy ActDecember 31, 2023has annual revenue of $25,000,000 or more100000 consumers30 daysNone statedattorney general7500 USD per violationNoNone stated
VermontVermont Data Privacy and Online Surveillance ActJanuary 1, 2028Not looked at yet35000 consumers60 daysJune 30, 2029Attorney General10000 USD per violationNoYes
VirginiaConsumer Data Protection ActNot looked at yetcontrol or process personal data of at least 100,000 consumers or (ii) control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data100000 consumers30 daysNone statedAttorney General7500 USD per violationNoNone stated

Data: CSV, JSON. Licence: CC BY 4.0.