Ad Tech Compliance
US State Privacy Laws Tracker 2027: Comprehensive Laws, Effective Dates and Ad Tech Rules
Published · Last updated
Next scheduled review:
Twenty-four US states have comprehensive privacy laws on 9 November 2026, and 20 are in force. Oklahoma and Louisiana start on 1 January 2027, Alabama on 1 May 2027 and Vermont on 1 January 2028. This state privacy law tracker compares every law on thresholds, ad opt-outs, Global Privacy Control, sensitive data, minors and enforcement.
Contents
Key facts
- Eight laws took effect in 2025 and three in 2026. Delaware, Iowa, Nebraska and New Hampshire started on 1 January 2025, New Jersey on 15 January, Tennessee on 1 July, Minnesota on 31 July and Maryland on 1 October. Indiana, Kentucky and Rhode Island followed on 1 January 2026 (Minnesota Laws 2024, ch. 121, art. 5, s. 14; Indiana SEA 5).
- Four laws were enacted in 2026. Oklahoma (SB 546) and Louisiana (Act 502) take effect on 1 January 2027, Alabama (HB 351) on 1 May 2027 and Vermont (Act 145) on 1 January 2028 (Louisiana SB 386; Alabama HB 351, s. 12).
- Twelve laws in force require a universal opt-out signal. California, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, Nebraska, New Hampshire, New Jersey, Minnesota and Maryland do. Colorado's statute dates its duty from 1 July 2024 (C.R.S. 6-1-1306(1)(a)(IV)(B)).
- Only California gives consumers a private lawsuit, and only for data breaches. Every other law in this tracker leaves enforcement to the attorney general or a state agency (Cal. Civ. Code 1798.150, CPPA text).
- The largest CCPA penalty so far is $12.75 million. California's Attorney General and four district attorneys settled with General Motors on 8 May 2026 over the sale of driving and location data (CalPrivacy, 8 May 2026).
- GPP has sections for 20 states and none for the four new laws. IAB Tech Lab merged version 3 of the US National section on 4 November 2026; it is not announced as final (GPP Section Information; commit of 4 November 2026).
Scope, inclusion rules and how to read the tracker
What counts. A law is in this tracker when it gives consumers in one state general rights over personal data across industries, including a right to opt out of targeted advertising or sale. Health-only laws, such as Washington's My Health My Data Act, sit in the state health privacy laws tracker. We include Florida's Digital Bill of Rights, whose $1 billion revenue test reaches few companies (Fla. Stat. 501.702). Trackers that leave Florida out count 23 laws. Other regimes that touch advertising, from GLBA to the EU rules, are collected in our ad tech compliance hub.
Where each row comes from. We read every statute or enrolled act on the state's own legislature site, or on the regulator's site, on 9 November 2026. The second column of Table 1 links that text. A cell that relies on another source names it. The IAPP state tracker, last updated 8 September 2026, served only as a pointer, because its detail is for members (IAPP).
Columns. The interactive table shows six columns by default: state, law, effective date, who it applies to, universal opt-out signal, and cure period. A column menu adds the citation, opt-out rights, sensitive data, minors, data protection assessments, enforcer, private right of action, GPP section, recent changes, source and last-verified date. Below, the same data sits in three tables so it reads on a phone.
Cadence. We review the tracker monthly and after each 1 January and 1 July start date. Every change goes into the changelog with its date.
Which state privacy laws took effect in 2025 and 2026, and which start in 2027
Most of the 2025 wave copied the Virginia model, with Connecticut's additions on opt-out signals. The 2027 laws split. Oklahoma follows Virginia closely, while Louisiana and Alabama mix in Texas and Connecticut features (Oklahoma SB 546, enrolled).
24 of 24 rows
1 January 2020 | California | California Consumer Privacy Act (amended by the CPRA) | |
1 January 2023 | Virginia | Consumer Data Protection Act | |
1 July 2023 | Colorado | Colorado Privacy Act | |
1 July 2023 | Connecticut | Connecticut Data Privacy Act | |
31 December 2023 | Utah | Consumer Privacy Act | |
1 July 2024 | Texas | Data Privacy and Security Act | |
1 July 2024 | Oregon | Consumer Privacy Act | |
1 July 2024 | Florida | Digital Bill of Rights | |
1 October 2024 | Montana | Consumer Data Privacy Act | |
1 January 2025 | Iowa | Iowa Code ch. 715D | |
1 January 2025 | Delaware | Personal Data Privacy Act | |
1 January 2025 | Nebraska | Data Privacy Act | |
1 January 2025 | New Hampshire | RSA 507-H | |
15 January 2025 | New Jersey | Data Privacy Act | P.L.2023, c.266, s. 17 (365th day after approval on 16 January 2024) |
1 July 2025 | Tennessee | Information Protection Act | |
31 July 2025 | Minnesota | Consumer Data Privacy Act | |
1 October 2025 | Maryland | Online Data Privacy Act | |
1 January 2026 | Indiana | IC 24-15 | |
1 January 2026 | Kentucky | Consumer Data Protection Act | |
1 January 2026 | Rhode Island | Data Transparency and Privacy Protection Act | |
1 January 2027 | Oklahoma | Consumer Data Privacy Act | |
1 January 2027 | Louisiana | Louisiana Data Privacy Act | |
1 May 2027 | Alabama | Personal Data Protection Act | |
1 January 2028 | Vermont | Data Privacy and Online Surveillance Act |
1 January 2020
- State
California
- Law
California Consumer Privacy Act (amended by the CPRA)
- Source
1 January 2023
- State
Virginia
- Law
Consumer Data Protection Act
1 July 2023
- State
Colorado
- Law
Colorado Privacy Act
1 July 2023
- State
Connecticut
- Law
Connecticut Data Privacy Act
- Source
31 December 2023
- State
Utah
- Law
Consumer Privacy Act
- Source
1 July 2024
- State
Texas
- Law
Data Privacy and Security Act
- Source
1 July 2024
- State
Oregon
- Law
Consumer Privacy Act
- Source
1 July 2024
- State
Florida
- Law
Digital Bill of Rights
1 October 2024
- State
Montana
- Law
Consumer Data Privacy Act
- Source
1 January 2025
- State
Iowa
- Law
Iowa Code ch. 715D
1 January 2025
- State
Delaware
- Law
Personal Data Privacy Act
- Source
1 January 2025
- State
Nebraska
- Law
Data Privacy Act
1 January 2025
- State
New Hampshire
- Law
RSA 507-H
- Source
15 January 2025
- State
New Jersey
- Law
Data Privacy Act
- Source
P.L.2023, c.266, s. 17 (365th day after approval on 16 January 2024)
1 July 2025
- State
Tennessee
- Law
Information Protection Act
- Source
31 July 2025
- State
Minnesota
- Law
Consumer Data Privacy Act
1 October 2025
- State
Maryland
- Law
Online Data Privacy Act
1 January 2026
- State
Indiana
- Law
IC 24-15
- Source
1 January 2026
- State
Kentucky
- Law
Consumer Data Protection Act
- Source
1 January 2026
- State
Rhode Island
- Law
Data Transparency and Privacy Protection Act
- Source
1 January 2027
- State
Oklahoma
- Law
Consumer Data Privacy Act
- Source
1 January 2027
- State
Louisiana
- Law
Louisiana Data Privacy Act
- Source
1 May 2027
- State
Alabama
- Law
Personal Data Protection Act
- Source
1 January 2028
- State
Vermont
- Law
Data Privacy and Online Surveillance Act
- Source
Table by AdSovereign, CC BY 4.0.
The other 2027 deadlines that touch advertising, from Delaware's lower thresholds to California's browser signal rule, sit in our ad tech regulation calendar.
Table 1: who each law covers and who enforces it
"Consumers" means state residents acting in a personal or household capacity. "Payment-only data excluded" means the count leaves out data processed only to complete a payment. All rows read on 9 November 2026 from the text linked in the second column; the definitions follow the model of Va. Code 59.1-575.
24 of 24 rows
California | Revenue above $26,625,000 (2025 adjustment, CPPA, 17 December 2024); or buys, sells or shares data of 100,000 consumers or households; or 50% of revenue from selling or sharing | CalPrivacy (administrative) and Attorney General; district attorneys joined the GM case | Discretionary: the agency may allow time to cure (1798.199.45) | Data breaches only (1798.150) | |
Virginia | 100,000 consumers; or 25,000 and over 50% of revenue from sale | Attorney General | 30 days, no sunset | None | |
Colorado | 100,000 consumers; or 25,000 and any revenue or discount from sale | Attorney General and district attorneys | General cure repealed 1 January 2025; 60 days remains for the minors and biometric sections | None | |
Connecticut | From 1 July 2026: 35,000 consumers, or any processing of sensitive data, or any sale (CT AG 2025 report) | Attorney General | Mandatory cure ended 31 December 2024; discretionary since | None | |
Utah | UCPA, Utah Code 13-61 | Revenue of $25 million and 100,000 consumers, or 25,000 and over 50% of revenue from sale | Attorney General, on referral from the Division of Consumer Protection | 30 days, no sunset | None |
Texas | TDPSA, Bus. & Com. Code ch. 541 | Any business that processes or sells personal data and is not an SBA small business; small businesses need consent to sell sensitive data | Attorney General | 30 days, no sunset | None |
Oregon | OCPA, ORS 646A.570 to 646A.589 | 100,000 consumers, payment-only data excluded; or 25,000 and 25% of revenue from selling | Attorney General (Oregon DOJ) | 30 days ended 1 January 2026, except some noncommercial broadcasters | None |
Montana | MCDPA, MCA 30-14-2801 et seq. | 25,000 consumers, payment-only data excluded; or 15,000 and over 25% of revenue from sale (Ch. 567, L. 2025) | Attorney General | None in the 2025 text of MCA 30-14-2817 | None |
Florida | Over $1 billion global revenue and one of: 50% of revenue from online ads, a smart speaker service, or an app store | Department of Legal Affairs | Discretionary 45 days | None | |
Iowa | 100,000 consumers; or 25,000 and over 50% of revenue from sale | Attorney General | 90 days, no sunset | None | |
Delaware | DPDPA, 6 Del. C. 12D-101 et seq. | 35,000 consumers or 10,000 and over 20% of revenue from sale; from 1 January 2027, 10,000 or 5,000 and over 20% | Department of Justice | 60 days mandatory in 2025; discretionary from 2026 | None |
Nebraska | Any business that processes or sells personal data and is not an SBA small business | Attorney General | 30 days, no sunset (87-1122) | None (87-1125) | |
New Hampshire | 35,000 unique consumers, payment-only data excluded; or 10,000 and over 25% of revenue from sale | Attorney General | 60 days mandatory in 2025; discretionary from 2026 | None | |
New Jersey | NJDPA, N.J.S.A. 56:8-166.4 et seq. | 100,000 consumers; or 25,000 and any revenue or discount from sale | Division of Consumer Affairs (Attorney General) | 30 days until the first day of the 18th month after the effective date, which we calculate as 1 July 2026 | None |
Tennessee | Revenue over $25 million and 175,000 consumers, or 25,000 and over 50% of revenue from sale | Attorney General | 60 days, no sunset | None | |
Minnesota | 100,000 consumers, payment-only data excluded; or 25,000 and over 25% of revenue from sale | Attorney General | 30-day warning letter expired 31 January 2026 | None | |
Maryland | 35,000 consumers, payment-only data excluded; or 10,000 and over 20% of revenue from sale | Attorney General, Consumer Protection Division | Discretionary, at least 60 days, for violations on or before 1 April 2027 (14-4714) | Not under MODPA: the private action in 13-408 is excluded | |
Indiana | ICDPA, IC 24-15 | 100,000 Indiana consumers; or 25,000 and over 50% of revenue from sale | Attorney General | 30 days, no sunset | None |
Kentucky | KCDPA, KRS 367.3611 et seq. | 100,000 consumers; or 25,000 and over 50% of revenue from sale | Attorney General | 30 days, no sunset | None |
Rhode Island | RIDTPPA, R.I. Gen. Laws 6-48.1 | 35,000 customers, payment-only data excluded; or 10,000 and over 20% of revenue from sale | Attorney General | None in the text | None |
Oklahoma | 100,000 consumers; or 25,000 and over 50% of revenue from sale | Attorney General (exclusive) | 30 days, no sunset | None | |
Louisiana | Revenue over $25 million, or 75,000 consumers, households or devices, or 50% of revenue from sale (résumé digest) | Attorney General | 30 days, from 1 January to 31 July 2027 | None | |
Alabama | APDPA, HB 351 (2026) | Over 25,000 consumers, payment-only data excluded; or over 25% of revenue from sale | Attorney General | 45 days, no sunset | No express provision found |
Vermont | VDPOSA, 9 V.S.A. ch. 61A (Act 145) | 35,000 consumers; or sensitive data of 3,000; or sale of data of 3,000 (Act summary) | Attorney General | 60 days, 1 January 2028 to 30 June 2029 | None |
California
- Law and citation
- Applies to
Revenue above $26,625,000 (2025 adjustment, CPPA, 17 December 2024); or buys, sells or shares data of 100,000 consumers or households; or 50% of revenue from selling or sharing
- Enforcer
CalPrivacy (administrative) and Attorney General; district attorneys joined the GM case
- Cure period
Discretionary: the agency may allow time to cure (1798.199.45)
Virginia
- Law and citation
- Applies to
100,000 consumers; or 25,000 and over 50% of revenue from sale
- Enforcer
Attorney General
- Cure period
30 days, no sunset
Colorado
- Law and citation
- Applies to
100,000 consumers; or 25,000 and any revenue or discount from sale
- Enforcer
Attorney General and district attorneys
- Cure period
General cure repealed 1 January 2025; 60 days remains for the minors and biometric sections
Connecticut
- Law and citation
- Applies to
From 1 July 2026: 35,000 consumers, or any processing of sensitive data, or any sale (CT AG 2025 report)
- Enforcer
Attorney General
- Cure period
Mandatory cure ended 31 December 2024; discretionary since
Utah
- Law and citation
UCPA, Utah Code 13-61
- Applies to
Revenue of $25 million and 100,000 consumers, or 25,000 and over 50% of revenue from sale
- Enforcer
Attorney General, on referral from the Division of Consumer Protection
- Cure period
30 days, no sunset
Texas
- Law and citation
TDPSA, Bus. & Com. Code ch. 541
- Applies to
Any business that processes or sells personal data and is not an SBA small business; small businesses need consent to sell sensitive data
- Enforcer
Attorney General
- Cure period
30 days, no sunset
Oregon
- Law and citation
OCPA, ORS 646A.570 to 646A.589
- Applies to
100,000 consumers, payment-only data excluded; or 25,000 and 25% of revenue from selling
- Enforcer
Attorney General (Oregon DOJ)
- Cure period
30 days ended 1 January 2026, except some noncommercial broadcasters
Montana
- Law and citation
MCDPA, MCA 30-14-2801 et seq.
- Applies to
25,000 consumers, payment-only data excluded; or 15,000 and over 25% of revenue from sale (Ch. 567, L. 2025)
- Enforcer
Attorney General
- Cure period
None in the 2025 text of MCA 30-14-2817
Florida
- Law and citation
- Applies to
Over $1 billion global revenue and one of: 50% of revenue from online ads, a smart speaker service, or an app store
- Enforcer
Department of Legal Affairs
- Cure period
Discretionary 45 days
Iowa
- Law and citation
- Applies to
100,000 consumers; or 25,000 and over 50% of revenue from sale
- Enforcer
Attorney General
- Cure period
90 days, no sunset
Delaware
- Law and citation
DPDPA, 6 Del. C. 12D-101 et seq.
- Applies to
35,000 consumers or 10,000 and over 20% of revenue from sale; from 1 January 2027, 10,000 or 5,000 and over 20%
- Enforcer
Department of Justice
- Cure period
60 days mandatory in 2025; discretionary from 2026
Nebraska
- Law and citation
- Applies to
Any business that processes or sells personal data and is not an SBA small business
- Enforcer
Attorney General
- Cure period
30 days, no sunset (87-1122)
New Hampshire
- Law and citation
- Applies to
35,000 unique consumers, payment-only data excluded; or 10,000 and over 25% of revenue from sale
- Enforcer
Attorney General
- Cure period
60 days mandatory in 2025; discretionary from 2026
New Jersey
- Law and citation
NJDPA, N.J.S.A. 56:8-166.4 et seq.
- Applies to
100,000 consumers; or 25,000 and any revenue or discount from sale
- Enforcer
Division of Consumer Affairs (Attorney General)
- Cure period
30 days until the first day of the 18th month after the effective date, which we calculate as 1 July 2026
Tennessee
- Law and citation
- Applies to
Revenue over $25 million and 175,000 consumers, or 25,000 and over 50% of revenue from sale
- Enforcer
Attorney General
- Cure period
60 days, no sunset
Minnesota
- Law and citation
- Applies to
100,000 consumers, payment-only data excluded; or 25,000 and over 25% of revenue from sale
- Enforcer
Attorney General
- Cure period
30-day warning letter expired 31 January 2026
Maryland
- Law and citation
- Applies to
35,000 consumers, payment-only data excluded; or 10,000 and over 20% of revenue from sale
- Enforcer
Attorney General, Consumer Protection Division
- Cure period
Discretionary, at least 60 days, for violations on or before 1 April 2027 (14-4714)
Indiana
- Law and citation
ICDPA, IC 24-15
- Applies to
100,000 Indiana consumers; or 25,000 and over 50% of revenue from sale
- Enforcer
Attorney General
- Cure period
30 days, no sunset
Kentucky
- Law and citation
KCDPA, KRS 367.3611 et seq.
- Applies to
100,000 consumers; or 25,000 and over 50% of revenue from sale
- Enforcer
Attorney General
- Cure period
30 days, no sunset
Rhode Island
- Law and citation
RIDTPPA, R.I. Gen. Laws 6-48.1
- Applies to
35,000 customers, payment-only data excluded; or 10,000 and over 20% of revenue from sale
- Enforcer
Attorney General
- Cure period
None in the text
Oklahoma
- Law and citation
- Applies to
100,000 consumers; or 25,000 and over 50% of revenue from sale
- Enforcer
Attorney General (exclusive)
- Cure period
30 days, no sunset
Louisiana
- Law and citation
- Applies to
Revenue over $25 million, or 75,000 consumers, households or devices, or 50% of revenue from sale (résumé digest)
- Enforcer
Attorney General
- Cure period
30 days, from 1 January to 31 July 2027
Alabama
- Law and citation
APDPA, HB 351 (2026)
- Applies to
Over 25,000 consumers, payment-only data excluded; or over 25% of revenue from sale
- Enforcer
Attorney General
- Cure period
45 days, no sunset
Vermont
- Law and citation
VDPOSA, 9 V.S.A. ch. 61A (Act 145)
- Applies to
35,000 consumers; or sensitive data of 3,000; or sale of data of 3,000 (Act summary)
- Enforcer
Attorney General
- Cure period
60 days, 1 January 2028 to 30 June 2029
Table by AdSovereign, CC BY 4.0.
Thresholds decide whether a law applies at all. A regional publisher with 40,000 Delaware readers is outside Delaware's law today and inside it from 1 January 2027, when the bar drops to 10,000 (6 Del. C. 12D-103). In Connecticut, one sensitive-data segment brings a company into scope regardless of volume.
Table 2: the ad tech rules in each law
"Opt-in" means the controller needs the consumer's consent first. "Known child" means under 13, with COPPA parental consent (R.I. Gen. Laws 6-48.1-2 is a typical definition). Sources are the statutes in Table 1 unless a cell names another.
24 of 24 rows
California | Sale and "sharing" for cross-context behavioral advertising | Required (opt-out preference signal); browsers must offer one from January 2027 (AB 566) | Right to limit use and disclosure | Under 16: opt-in to sale or sharing (13 to 15 themselves, under 13 a parent) | Risk assessments under the 2026 regulations (CPPA, 23 September 2025) |
Virginia | Yes | Not required | Opt-in | Known child: no targeted ads or sale without COPPA consent (2024 cc. 840, 844) | Yes |
Colorado | Yes | Required from 1 July 2024; GPC is the recognized mechanism (Colorado Department of Law) | Opt-in | Under 18: no targeted ads, sale or significant profiling without consent, from 1 October 2025 | Yes |
Connecticut | Yes | Required from 1 January 2025 | Opt-in; any processing triggers the law from 1 July 2026; sale of precise geolocation banned from 1 October 2026 (PA 26-64, s. 14) | Under 18: targeted ads and sale prohibited from 1 July 2026 | Yes; impact assessments for profiling |
Utah | Yes | Not required | Notice and opportunity to opt out | Known child: COPPA | Not required |
Texas | Yes | Required from 1 January 2025, through an authorized agent such as a browser or device setting (541.055(e)) | Opt-in | Known child: COPPA | Yes |
Oregon | Yes | Required from 1 January 2026 (Oregon DOJ) | Opt-in; sale of precise geolocation within 1,750 feet banned | Under 16: no targeted ads or sale (statute text) | Yes |
Montana | Yes | Required from 1 January 2025 (MCA 30-14-2809) | Opt-in | Under 18: no targeted ads or sale without consent (Ch. 567, L. 2025) | Yes, plus a minors assessment |
Florida | Yes | Not required | Opt-in; sale needs consent | "Child" means under 18; platform duties sit in a separate section not reviewed here | Yes |
Iowa | Sale opt-out; targeted ads must be disclosed with an opt-out method (715D.4(6)) | Not required | Notice and opportunity to opt out | Known child: COPPA | Not required |
Delaware | Yes | Required from 1 January 2026 | Opt-in | 13 to 17: no targeted ads or sale without consent | Yes |
Nebraska | Yes | Required, through an authorized agent (87-1109) | Opt-in | Known child: COPPA | Yes |
New Hampshire | Yes | Required from 1 January 2025 | Opt-in | 13 to 15: no targeted ads or sale without consent; sale of a child's data banned from 1 January 2027 (HB 1460, ch. 168) | Yes |
New Jersey | Yes, plus profiling | Required six months after the effective date | Opt-in | 13 to 16: no targeted ads, sale or profiling without consent | Yes |
Tennessee | Yes | Not required | Opt-in | Known child: COPPA | Yes |
Minnesota | Yes, plus profiling | Required from 31 July 2025 | Opt-in | 13 to 15: no targeted ads or sale without consent | Yes |
Maryland | Yes | Required by 1 October 2025 | Only where strictly necessary for a requested product or service; sale banned; definition widened from 1 July 2026 (Table 3) | Under 18 (knew or should have known): no targeted ads, no sale | Yes, prospective from 1 April 2026 |
Indiana | Yes | Not required | Opt-in; health means a provider's diagnosis | Known child: COPPA | Yes |
Kentucky | Yes | Not required | Opt-in | Known child: COPPA | Yes |
Rhode Island | Yes | Not required | Opt-in | Known child: consent and COPPA | Yes |
Oklahoma | Yes | Not required | Opt-in | Known child: COPPA | Yes, prospective |
Louisiana | Yes, plus profiling | Required from 1 January 2027, through an authorized agent | Opt-in; sale needs consent | Known child: COPPA | Yes |
Alabama | Yes, through a website link | Not expressly required; the text addresses conflicts with a signal | Opt-in | Known child: COPPA | Not required |
Vermont | Yes | Required from 1 January 2028 | Opt-in to process or sell | 13 to 17: no targeted ads, no sale | Yes, plus profiling assessments |
California
- Opt-out of targeted ads and sale
Sale and "sharing" for cross-context behavioral advertising
- Universal opt-out signal (GPC)
Required (opt-out preference signal); browsers must offer one from January 2027 (AB 566)
- Sensitive data
Right to limit use and disclosure
- Minors
Under 16: opt-in to sale or sharing (13 to 15 themselves, under 13 a parent)
Virginia
- Opt-out of targeted ads and sale
Yes
- Universal opt-out signal (GPC)
Not required
- Sensitive data
Opt-in
- Minors
Known child: no targeted ads or sale without COPPA consent (2024 cc. 840, 844)
Colorado
- Opt-out of targeted ads and sale
Yes
- Universal opt-out signal (GPC)
Required from 1 July 2024; GPC is the recognized mechanism (Colorado Department of Law)
- Sensitive data
Opt-in
- Minors
Under 18: no targeted ads, sale or significant profiling without consent, from 1 October 2025
Connecticut
- Opt-out of targeted ads and sale
Yes
- Universal opt-out signal (GPC)
Required from 1 January 2025
- Sensitive data
Opt-in; any processing triggers the law from 1 July 2026; sale of precise geolocation banned from 1 October 2026 (PA 26-64, s. 14)
- Minors
Under 18: targeted ads and sale prohibited from 1 July 2026
Utah
- Opt-out of targeted ads and sale
Yes
- Universal opt-out signal (GPC)
Not required
- Sensitive data
Notice and opportunity to opt out
- Minors
Known child: COPPA
Texas
- Opt-out of targeted ads and sale
Yes
- Universal opt-out signal (GPC)
Required from 1 January 2025, through an authorized agent such as a browser or device setting (541.055(e))
- Sensitive data
Opt-in
- Minors
Known child: COPPA
Oregon
- Opt-out of targeted ads and sale
Yes
- Universal opt-out signal (GPC)
Required from 1 January 2026 (Oregon DOJ)
- Sensitive data
Opt-in; sale of precise geolocation within 1,750 feet banned
- Minors
Under 16: no targeted ads or sale (statute text)
Montana
- Opt-out of targeted ads and sale
Yes
- Universal opt-out signal (GPC)
Required from 1 January 2025 (MCA 30-14-2809)
- Sensitive data
Opt-in
- Minors
Under 18: no targeted ads or sale without consent (Ch. 567, L. 2025)
Florida
- Opt-out of targeted ads and sale
Yes
- Universal opt-out signal (GPC)
Not required
- Sensitive data
Opt-in; sale needs consent
- Minors
"Child" means under 18; platform duties sit in a separate section not reviewed here
Iowa
- Opt-out of targeted ads and sale
Sale opt-out; targeted ads must be disclosed with an opt-out method (715D.4(6))
- Universal opt-out signal (GPC)
Not required
- Sensitive data
Notice and opportunity to opt out
- Minors
Known child: COPPA
Delaware
- Opt-out of targeted ads and sale
Yes
- Universal opt-out signal (GPC)
Required from 1 January 2026
- Sensitive data
Opt-in
- Minors
13 to 17: no targeted ads or sale without consent
Nebraska
- Opt-out of targeted ads and sale
Yes
- Universal opt-out signal (GPC)
Required, through an authorized agent (87-1109)
- Sensitive data
Opt-in
- Minors
Known child: COPPA
New Hampshire
- Opt-out of targeted ads and sale
Yes
- Universal opt-out signal (GPC)
Required from 1 January 2025
- Sensitive data
Opt-in
- Minors
13 to 15: no targeted ads or sale without consent; sale of a child's data banned from 1 January 2027 (HB 1460, ch. 168)
New Jersey
- Opt-out of targeted ads and sale
Yes, plus profiling
- Universal opt-out signal (GPC)
Required six months after the effective date
- Sensitive data
Opt-in
- Minors
13 to 16: no targeted ads, sale or profiling without consent
Tennessee
- Opt-out of targeted ads and sale
Yes
- Universal opt-out signal (GPC)
Not required
- Sensitive data
Opt-in
- Minors
Known child: COPPA
Minnesota
- Opt-out of targeted ads and sale
Yes, plus profiling
- Universal opt-out signal (GPC)
Required from 31 July 2025
- Sensitive data
Opt-in
- Minors
13 to 15: no targeted ads or sale without consent
Maryland
- Opt-out of targeted ads and sale
Yes
- Universal opt-out signal (GPC)
Required by 1 October 2025
- Sensitive data
Only where strictly necessary for a requested product or service; sale banned; definition widened from 1 July 2026 (Table 3)
- Minors
Under 18 (knew or should have known): no targeted ads, no sale
Indiana
- Opt-out of targeted ads and sale
Yes
- Universal opt-out signal (GPC)
Not required
- Sensitive data
Opt-in; health means a provider's diagnosis
- Minors
Known child: COPPA
Kentucky
- Opt-out of targeted ads and sale
Yes
- Universal opt-out signal (GPC)
Not required
- Sensitive data
Opt-in
- Minors
Known child: COPPA
Rhode Island
- Opt-out of targeted ads and sale
Yes
- Universal opt-out signal (GPC)
Not required
- Sensitive data
Opt-in
- Minors
Known child: consent and COPPA
Oklahoma
- Opt-out of targeted ads and sale
Yes
- Universal opt-out signal (GPC)
Not required
- Sensitive data
Opt-in
- Minors
Known child: COPPA
Louisiana
- Opt-out of targeted ads and sale
Yes, plus profiling
- Universal opt-out signal (GPC)
Required from 1 January 2027, through an authorized agent
- Sensitive data
Opt-in; sale needs consent
- Minors
Known child: COPPA
Alabama
- Opt-out of targeted ads and sale
Yes, through a website link
- Universal opt-out signal (GPC)
Not expressly required; the text addresses conflicts with a signal
- Sensitive data
Opt-in
- Minors
Known child: COPPA
Vermont
- Opt-out of targeted ads and sale
Yes
- Universal opt-out signal (GPC)
Required from 1 January 2028
- Sensitive data
Opt-in to process or sell
- Minors
13 to 17: no targeted ads, no sale
Table by AdSovereign, CC BY 4.0.
GPP section IDs come from IAB Tech Lab's list, read on 9 November 2026 (GPP Section Information). The US National section is ID 7.
Table 3: recent amendments and enforcement by state
13 of 13 rows
California | Regulations on risk assessments, cybersecurity audits and automated decisionmaking approved; in force 1 January 2026 | 23 September 2025 | |
California | California Opt Me Out Act (AB 566): browsers must offer an opt-out preference signal from January 2027 | Signed 8 October 2025 | |
California | Expanding Privacy Rights Act (SB 923): deletion reaches data bought from third parties, from 1 January 2027 | Signed 27 September 2026 | |
Connecticut | SB 1295 (2025) amendments in force: 35,000 threshold, sensitive-data trigger, minors' ad ban, profiling impact assessments | 1 July 2026 | |
Connecticut | Public Act 26-64: precise geolocation sale ban (1 October 2026); data broker registration before selling from 1 January 2027 | Approved 27 May 2026 | |
Delaware | 85 Del. Laws c. 463 lowers thresholds from 1 January 2027 | In the code on 9 November 2026 | |
Maryland | Chapter 874 of 2026 (HB 711): bars knowingly selling personal data to government units engaged in civil immigration enforcement; widens "sensitive data" to inferred data and device and vehicle location | Effective 1 July 2026 | |
Montana | Chapter 567, Laws of 2025: lower thresholds, duties toward minors, no cure provision | 2025 session | |
Oregon | Chapter 417, Oregon Laws 2025: cure period ends 1 January 2026 for most controllers | Effective 24 June 2025 | |
New Hampshire | HB 1460: sale of a child's personal data prohibited from 1 January 2027 | Chapter 168 of 2026 | |
Utah | Chapters 95 and 193 of 2026 add motor vehicle data rules from 1 January 2027 | 2026 session | |
Virginia | 2025 c. 703: social media users under 16 limited to one hour a day; 2026 c. 820 amends the children's section | 2025 and 2026 sessions | |
Texas | First lawsuit under a state comprehensive privacy law, against Allstate and Arity | 13 January 2025 | WilmerHale, 21 January 2025 (secondary) |
California
- Change or action
Regulations on risk assessments, cybersecurity audits and automated decisionmaking approved; in force 1 January 2026
- Date
23 September 2025
- Source
California
- Change or action
California Opt Me Out Act (AB 566): browsers must offer an opt-out preference signal from January 2027
- Date
Signed 8 October 2025
- Source
California
- Change or action
Expanding Privacy Rights Act (SB 923): deletion reaches data bought from third parties, from 1 January 2027
- Date
Signed 27 September 2026
- Source
Connecticut
- Change or action
SB 1295 (2025) amendments in force: 35,000 threshold, sensitive-data trigger, minors' ad ban, profiling impact assessments
- Date
1 July 2026
- Source
Connecticut
- Change or action
Public Act 26-64: precise geolocation sale ban (1 October 2026); data broker registration before selling from 1 January 2027
- Date
Approved 27 May 2026
- Source
Delaware
- Change or action
85 Del. Laws c. 463 lowers thresholds from 1 January 2027
- Date
In the code on 9 November 2026
- Source
Maryland
- Change or action
Chapter 874 of 2026 (HB 711): bars knowingly selling personal data to government units engaged in civil immigration enforcement; widens "sensitive data" to inferred data and device and vehicle location
- Date
Effective 1 July 2026
Montana
- Change or action
Chapter 567, Laws of 2025: lower thresholds, duties toward minors, no cure provision
- Date
2025 session
- Source
Oregon
- Change or action
Chapter 417, Oregon Laws 2025: cure period ends 1 January 2026 for most controllers
- Date
Effective 24 June 2025
- Source
New Hampshire
- Change or action
HB 1460: sale of a child's personal data prohibited from 1 January 2027
- Date
Chapter 168 of 2026
- Source
Utah
- Change or action
Chapters 95 and 193 of 2026 add motor vehicle data rules from 1 January 2027
- Date
2026 session
- Source
Virginia
- Change or action
2025 c. 703: social media users under 16 limited to one hour a day; 2026 c. 820 amends the children's section
- Date
2025 and 2026 sessions
Texas
- Change or action
First lawsuit under a state comprehensive privacy law, against Allstate and Arity
- Date
13 January 2025
- Source
WilmerHale, 21 January 2025 (secondary)
Table by AdSovereign, CC BY 4.0.
What ad tech must change
The laws converge on three duties for anyone who targets or measures ads: read the opt-out, keep sensitive segments behind consent, and treat teenagers as a protected group. The details differ by state, which is why each duty needs a state-aware design.
GPP section support
The Global Privacy Platform carries state signals in the bid request. IAB Tech Lab lists sections 8 to 27 for 20 states, plus the national section 7 (GPP Section Information). Oklahoma, Louisiana, Alabama and Vermont have no section on 9 November 2026, so a publisher there can only use the national section or none.
The national section itself is changing. A commit of 10 August 2026 opened all US sections for public comment to support the Fifth Amended and Restated MSPA. Commits on 4 November 2026 prepared version 3 "to finalize" (commit 66142ea, 10 August 2026; commit ab767c1, 4 November 2026). Version 3 drops the per-category sensitive data fields and states that the GPC subsection "must always be present" (US National specification).
In practice, a parser has to read the version field and handle versions 1, 2 and 3 side by side. Our GPP and TCF implementation guide shows the field-by-field differences, and the GPP consent string decoder reads all three. The older four-character US Privacy String is deprecated as section 6.
Global Privacy Control handling
Twelve laws in force require a controller to honour an opt-out preference signal for targeted advertising and sale. Texas, Nebraska and, from 2027, Louisiana frame it as an authorized agent acting through "a browser setting or extension" (Tex. Bus. & Com. Code 541.055, HB 4). The others name an "opt-out preference signal" or a "universal opt-out mechanism".
Regulators have told businesses what they check. The Connecticut Attorney General wrote that a GPC signal should opt the consumer out "across all personal data", not only cookie data, and on every device where the consumer logs in (CT AG 2025 report). CalPrivacy fined Tractor Supply $1.35 million in a decision that cited failure to process GPC signals (CPPA, 30 September 2025).
Here is what that means for a typical stack. A publisher's consent management platform reads Sec-GPC: 1 from a Colorado visitor. It should write the opt-out into the consent string it passes downstream, and the account system should copy it to the logged-in app. A demand-side platform that receives the request should suppress retargeting and segment sales for that user.
Sensitive-data segments and minors
Most laws need opt-in consent before processing sensitive data, which usually covers health diagnoses, precise geolocation, sexual orientation, biometrics and children's data. Utah and Iowa ask only for notice and a chance to opt out (Utah Code 13-61-302; Iowa Code 715D.4). Maryland goes further than any other state: it bans the sale of sensitive data, and consent does not change that (Md. Code, Com. Law 14-4707).
Location audiences carry the most risk. Oregon bans the sale of data that places a person within 1,750 feet (ORS 646A.578), and Connecticut has banned the sale of precise geolocation since 1 October 2026. Health inferences have their own rules, which our state health privacy laws tracker maps state by state. The state pages on Washington's My Health My Data Act, Maryland's sensitive data rules and Connecticut's consumer health data rules go deeper. Nevada's health-data law, New York's pending bill and California's medical privacy act have their own pages too: Nevada, New York and California.
Teen rules now reach well past COPPA's age of 13. Colorado, Connecticut, Maryland, Montana and Vermont protect under-18s, and Oregon protects under-16s (C.R.S. 6-1-1308.5; MCA 30-14-2811). In Connecticut and Maryland, consent does not lift the ban on targeted ads for teens. A bidder that cannot tell a teenager's request apart has to rely on the publisher's age signals and on contextual buying.
Enforcement timeline: regulators and attorneys general
The pattern so far is clear: regulators test opt-out mechanics first. Most actions below concern broken opt-out links, extra verification steps, ignored GPC signals and missing contracts with ad tech vendors.
15 of 15 rows
13 January 2025 | Texas Attorney General | Allstate and Arity | First suit under a state comprehensive privacy law, over driving and location data collected through an app SDK | WilmerHale (secondary); status n/d |
12 March 2025 | CPPA | American Honda Motor Co. | $632,500; excessive verification for opt-outs, asymmetric choices, ad tech contracts | |
16 April 2025 | Eight regulators | Consortium of Privacy Regulators formed | Bipartisan coordination on enforcement | |
6 May 2025 | CPPA | Todd Snyder, Inc. | $345,178; opt-out portal failed for 40 days; identity checks before opt-out | |
1 July 2025 | California Attorney General | Healthline Media | $1.55 million; targeted advertising opt-out and purpose limitation | |
9 September 2025 | CPPA with California, Colorado and Connecticut AGs | Businesses ignoring GPC | Joint investigative sweep | |
30 September 2025 | CPPA | Tractor Supply Company | $1.35 million; opt-out mechanism including GPC, notices, contracts | |
30 October 2025 | California Attorney General | Sling TV | $530,000; opt-out of sale in connection with targeted advertising | |
21 November 2025 | California Attorney General | Jam City | $1.4 million; no opt-out of sale in mobile games | |
3 December 2025 | CalPrivacy | ROR Partners LLC | $56,600; sold custom audiences without registering as a data broker | |
2025 (reported early 2026) | Connecticut Attorney General | TicketNetwork, Inc. | $85,000; first CTDPA settlement, after a missed cure deadline | |
11 February 2026 | California Attorney General | The Walt Disney Company | $2.75 million; opt-outs not applied across Disney+, Hulu and ESPN+ | |
3 March 2026 | CalPrivacy | PlayOn Sports | $1.10 million; tracking and targeted ads on school ticketing without a sufficient opt-out | |
5 March 2026 | CalPrivacy | Ford Motor Company | $375,703; email verification before opt-out | |
8 May 2026 | California Attorney General and four district attorneys | General Motors | $12.75 million; sale of driving and location data to data brokers; first data minimisation case |
13 January 2025
- Enforcer
Texas Attorney General
- Target
Allstate and Arity
- What happened
First suit under a state comprehensive privacy law, over driving and location data collected through an app SDK
- Source
WilmerHale (secondary); status n/d
12 March 2025
- Enforcer
CPPA
- Target
American Honda Motor Co.
- What happened
$632,500; excessive verification for opt-outs, asymmetric choices, ad tech contracts
- Source
16 April 2025
- Enforcer
Eight regulators
- Target
Consortium of Privacy Regulators formed
- What happened
Bipartisan coordination on enforcement
- Source
6 May 2025
- Enforcer
CPPA
- Target
Todd Snyder, Inc.
- What happened
$345,178; opt-out portal failed for 40 days; identity checks before opt-out
- Source
1 July 2025
- Enforcer
California Attorney General
- Target
Healthline Media
- What happened
$1.55 million; targeted advertising opt-out and purpose limitation
- Source
9 September 2025
- Enforcer
CPPA with California, Colorado and Connecticut AGs
- Target
Businesses ignoring GPC
- What happened
Joint investigative sweep
- Source
30 September 2025
- Enforcer
CPPA
- Target
Tractor Supply Company
- What happened
$1.35 million; opt-out mechanism including GPC, notices, contracts
- Source
30 October 2025
- Enforcer
California Attorney General
- Target
Sling TV
- What happened
$530,000; opt-out of sale in connection with targeted advertising
- Source
21 November 2025
- Enforcer
California Attorney General
- Target
Jam City
- What happened
$1.4 million; no opt-out of sale in mobile games
- Source
3 December 2025
- Enforcer
CalPrivacy
- Target
ROR Partners LLC
- What happened
$56,600; sold custom audiences without registering as a data broker
- Source
2025 (reported early 2026)
- Enforcer
Connecticut Attorney General
- Target
TicketNetwork, Inc.
- What happened
$85,000; first CTDPA settlement, after a missed cure deadline
- Source
11 February 2026
- Enforcer
California Attorney General
- Target
The Walt Disney Company
- What happened
$2.75 million; opt-outs not applied across Disney+, Hulu and ESPN+
- Source
3 March 2026
- Enforcer
CalPrivacy
- Target
PlayOn Sports
- What happened
$1.10 million; tracking and targeted ads on school ticketing without a sufficient opt-out
- Source
5 March 2026
- Enforcer
CalPrivacy
- Target
Ford Motor Company
- What happened
$375,703; email verification before opt-out
- Source
8 May 2026
- Enforcer
California Attorney General and four district attorneys
- Target
General Motors
- What happened
$12.75 million; sale of driving and location data to data brokers; first data minimisation case
- Source
Table by AdSovereign, CC BY 4.0.
Two lessons stand out for media sellers. First, the Disney settlement treats an opt-out as a promise that follows the person across linked services and devices. Second, the ROR Partners decision shows that a marketing firm selling custom audiences can be a data broker under California law.
What we could not verify
- Status of the Texas Allstate case. We found no dated report of a ruling or settlement.
- New Jersey rules. We did not find adopted Division of Consumer Affairs regulations on 9 November 2026; the proposal stage is n/d.
- Virginia 2026 c. 820. The code shows the amendment to the children's section, but we did not read the bill to confirm what changed.
- Litigation over Virginia's one-hour social media rule. Status n/d.
- Nebraska's start date. We confirmed the statute text but not the operative-date section of LB 1074; 1 January 2025 rests on the statute's cure and agent provisions and on secondary trackers.
FAQ
How many states have comprehensive privacy laws in 2027?
Which state privacy laws take effect in 2027?
Which states require businesses to honour Global Privacy Control?
Can consumers sue under state privacy laws?
What counts as targeted advertising under state privacy laws?
Which states still give a cure period?
How this works on owned infrastructure
This tracker turns on one engineering question: can the stack apply 24 sets of opt-out, teen and sensitive-data rules to every impression, using the state it already knows? AdSovereign is an enterprise RTB stack (DSP, SSP, exchange, DMP and clean room) designed to run inside the operator's own environment. The opt-out register, the GPC and GPP parsing, and the per-state rules that gate segments can then live in one place the privacy team controls and can audit, instead of in each vendor's settings. It does not decide which law applies; counsel does. The architecture page shows where the rules engine sits, and integrations lists the CMP and consent-signal connectors.
Sources
- California Privacy Protection Agency, California Consumer Privacy Act text, AB 3286 update (effective 15 July 2024, posted August 2024). https://cppa.ca.gov/regulations/pdf/cppa_act.pdf
- CPPA, "2025 Increases for CCPA Fines and Penalties" (17 December 2024). https://cppa.ca.gov/announcements/2024/20241217.html
- CPPA, "California Finalizes Regulations to Strengthen Consumers' Privacy" (23 September 2025). https://cppa.ca.gov/announcements/2025/20250923.html
- CPPA, "Governor Signs Groundbreaking Privacy Bill" (AB 566) (8 October 2025). https://cppa.ca.gov/announcements/2025/20251008_2.html
- CalPrivacy, "California Expands Privacy Protections by Strengthening Deletion Rights" (SB 923) (27 September 2026). https://privacy.ca.gov/2026/09/california-expands-privacy-protections-by-strengthening-deletion-rights/
- CPPA, "Honda Settles with CPPA Over Privacy Violations" (12 March 2025). https://cppa.ca.gov/announcements/2025/20250312.html
- CPPA, "State Regulators Form Bipartisan Consortium" (16 April 2025). https://cppa.ca.gov/announcements/2025/20250416.html
- CPPA, Todd Snyder decision (6 May 2025). https://cppa.ca.gov/announcements/2025/20250506.html
- CPPA, "Joint Investigative Privacy Sweep" on GPC (9 September 2025). https://cppa.ca.gov/announcements/2025/20250909.html
- CPPA, Tractor Supply decision (30 September 2025). https://cppa.ca.gov/announcements/2025/20250930.html
More sources (38)
- CalPrivacy, ROR Partners decision (3 December 2025). https://privacy.ca.gov/2025/12/calprivacy-fines-marketing-firm-for-selling-custom-audiences-without-data-broker-registration/
- CalPrivacy, PlayOn Sports decision (3 March 2026). https://privacy.ca.gov/2026/03/youth-sports-media-company-to-pay-1-1-million-fine-change-practices-over-privacy-violations/
- CalPrivacy, Ford decision (5 March 2026). https://privacy.ca.gov/2026/03/ford-to-change-practices-pay-fine-for-adding-unnecessary-friction-to-opt-out-process/
- CalPrivacy, General Motors settlement with the Attorney General (8 May 2026). https://privacy.ca.gov/2026/05/when-it-comes-to-data-privacy-consumers-must-be-in-the-drivers-seat-attorney-general-bonta-partners-secure-12-75-million-general-motors-privacy-settlement/
- California Department of Justice, Privacy Enforcement Actions (Healthline, Sling TV, Jam City, Disney, GM) (read 9 November 2026). https://oag.ca.gov/privacy/privacy-enforcement-actions
- Code of Virginia, Title 59.1, Chapter 53, Consumer Data Protection Act (read 9 November 2026). https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/
- Colorado Revised Statutes 2024, Title 6, Part 13, Colorado Privacy Act (uncertified printout). https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf
- Colorado Department of Law, Universal Opt-Out Mechanism page (read 9 November 2026). https://coag.gov/uoom/
- Connecticut General Statutes, Chapter 743jj (2025 revision, with note on the 2026 Supplement). https://www.cga.ct.gov/current/pub/chap_743jj.htm
- Connecticut Attorney General, CTDPA page (read 9 November 2026). https://portal.ct.gov/ag/sections/privacy/the-connecticut-data-privacy-act
- Connecticut Attorney General, CTDPA Enforcement Report 2025. https://portal.ct.gov/-/media/ag/reports/ctdpaenforcementreportcy2025.pdf
- Connecticut General Assembly, Public Act 26-64 (SB 4), approved 27 May 2026. https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00064-R00SB-00004-PA.PDF
- Utah Code, Title 13, Chapter 61, Utah Consumer Privacy Act (read 9 November 2026). https://le.utah.gov/xcode/Title13/Chapter61/C13-61_2022050420231231.pdf
- Texas Legislature, HB 4 (88th Legislature), enrolled, Texas Data Privacy and Security Act. https://capitol.texas.gov/tlodocs/88R/billtext/html/HB00004F.htm
- WilmerHale, "Texas AG Brings First Ever Lawsuit Under a State Comprehensive Privacy Law" (21 January 2025). https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20250121-texas-ag-brings-first-ever-lawsuit-under-a-state-comprehensive-privacy-law
- Oregon Revised Statutes, Chapter 646A (2025 edition), ORS 646A.570 to 646A.589. https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html
- Oregon Department of Justice, Privacy page and enforcement reports (read 9 November 2026). https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/privacy/
- Montana Code Annotated 2025, Title 30, Chapter 14, Part 28. https://leg.mt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html
- Florida Statutes 2026, Chapter 501, Part V (501.701 to 501.722). http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501PartVContentsIndex.html
- Iowa Code, Chapter 715D, and Iowa Acts 2023, Chapter 17. https://www.legis.iowa.gov/docs/code/715D.pdf ; https://www.legis.iowa.gov/docs/publications/iactc/90.1/CH0017.pdf
- Delaware Code, Title 6, Chapter 12D (with versions effective 1 January 2027). https://delcode.delaware.gov/title6/c012d/index.html
- Nebraska Revised Statutes 87-1101 to 87-1130, Data Privacy Act. https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101
- New Hampshire RSA 507-H. https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm
- New Hampshire General Court, HB 1460-FN (2026), Chapter 168. https://gc.nh.gov/bill_Status/billinfo.aspx?id=2443
- New Jersey Legislature, P.L.2023, Chapter 266 (approved 16 January 2024). https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.PDF
- Tennessee Secretary of State, Public Chapter 408 (HB 1181, 2023). https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf
- Minnesota Statutes 325M.10 to 325M.21 and Laws 2024, Chapter 121. https://www.revisor.mn.gov/statutes/cite/325M ; https://www.revisor.mn.gov/laws/2024/0/121/
- Maryland General Assembly, Chapter 455 of 2024 (SB 541); codified text, Commercial Law 14-4701 to 14-4714 (read 9 November 2026); HB 711 (2026), Chapter 874. https://mgaleg.maryland.gov/2024RS/Chapters_noln/CH_455_sb0541e.pdf ; https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false ; https://mgaleg.maryland.gov/mgawebsite/Legislation/Details/hb0711?ys=2026RS
- Indiana General Assembly, Senate Enrolled Act 5 (2023). https://iga.in.gov/pdf-documents/123/2023/senate/bills/SB0005/SB0005.05.ENRH.pdf
- Kentucky General Assembly, HB 15 (2024 Regular Session). https://apps.legislature.ky.gov/recorddocuments/bill/24RS/hb15/bill.pdf
- Rhode Island General Laws, Chapter 6-48.1. http://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm
- Oklahoma Legislature, SB 546 (2026), enrolled. http://webserver1.lsb.state.ok.us/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.PDF
- Louisiana Legislature, SB 386 (2026 Regular Session), Act 502 and résumé digest. https://www.legis.la.gov/Legis/BillInfo.aspx?s=26RS&b=SB386
- Alabama Legislature, HB 351 (2026 Regular Session), enrolled. https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf
- Vermont Legislature, S.71, Act 145 of 2026, as enacted and act summary. https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf
- IAB Tech Lab, GPP Section Information (read 9 November 2026). https://github.com/InteractiveAdvertisingBureau/Global-Privacy-Platform/blob/main/Sections/Section%20Information.md
- IAB Tech Lab, MSPA US National Technical Specification (version history dated November 2026) and commits 66142ea (10 August 2026, public comment) and ab767c1 (4 November 2026, "Prepare to finalize"). https://github.com/InteractiveAdvertisingBureau/Global-Privacy-Platform/blob/main/Sections/US-National/IAB%20Privacy%E2%80%99s%20Multi-State%20Privacy%20Agreement%20%28MSPA%29%20US%20National%20Technical%20Specification.md ; https://github.com/InteractiveAdvertisingBureau/Global-Privacy-Platform/commit/ab767c179195da2c33c89832ef7123d76fc3008a
- IAPP, US State Privacy Legislation Tracker (last updated 8 September 2026; pointer only). https://iapp.org/resources/article/us-state-privacy-legislation-tracker
Dataset: /datasets/REG-USST-us-state-privacy-laws.csv, 24 rows, one per law, UTF-8, licence CC BY 4.0 with attribution to adsovereign.com. Columns: state, law_name, citation, statute_url, enacted (date signed where known), effective_date (ISO), status (in force, enacted), threshold_summary, opt_out_targeted_ads, opt_out_sale, universal_opt_out (required, not required, unclear) and universal_opt_out_from (ISO date), sensitive_data_rule (opt-in, opt-out, strictly necessary, limit), minors_rule, data_protection_assessment (yes, no), cure_period, cure_ends (ISO date or none), enforcer, private_right_of_action, gpp_section_id, recent_change, source_url, source_date, last_verified (9 November 2026).
Changelog
- 9 November 2026. Tracker created: 24 laws (20 in force; Oklahoma, Louisiana and Alabama in 2027; Vermont in 2028), each read on the state's own site. Enforcement timeline to 8 May 2026. Next review 9 December 2026.