{"page":"/blog/us-state-privacy-laws-tracker","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["State","Law and citation","Applies to","Enforcer","Cure period","Private right of action"],"rows":[["California","CCPA, Cal. Civ. Code 1798.100 et seq.","Revenue above $26,625,000 (2025 adjustment, CPPA, 17 December 2024); or buys, sells or shares data of 100,000 consumers or households; or 50% of revenue from selling or sharing","CalPrivacy (administrative) and Attorney General; district attorneys joined the GM case","Discretionary: the agency may allow time to cure (1798.199.45)","Data breaches only (1798.150)"],["Virginia","CDPA, Va. Code 59.1-575 to 59.1-584","100,000 consumers; or 25,000 and over 50% of revenue from sale","Attorney General","30 days, no sunset","None"],["Colorado","CPA, C.R.S. 6-1-1301 et seq.","100,000 consumers; or 25,000 and any revenue or discount from sale","Attorney General and district attorneys","General cure repealed 1 January 2025; 60 days remains for the minors and biometric sections","None"],["Connecticut","CTDPA, Conn. Gen. Stat. 42-515 et seq.","From 1 July 2026: 35,000 consumers, or any processing of sensitive data, or any sale (CT AG 2025 report)","Attorney General","Mandatory cure ended 31 December 2024; discretionary since","None"],["Utah","UCPA, Utah Code 13-61","Revenue of $25 million and 100,000 consumers, or 25,000 and over 50% of revenue from sale","Attorney General, on referral from the Division of Consumer Protection","30 days, no sunset","None"],["Texas","TDPSA, Bus. & Com. Code ch. 541","Any business that processes or sells personal data and is not an SBA small business; small businesses need consent to sell sensitive data","Attorney General","30 days, no sunset","None"],["Oregon","OCPA, ORS 646A.570 to 646A.589","100,000 consumers, payment-only data excluded; or 25,000 and 25% of revenue from selling","Attorney General (Oregon DOJ)","30 days ended 1 January 2026, except some noncommercial broadcasters","None"],["Montana","MCDPA, MCA 30-14-2801 et seq.","25,000 consumers, payment-only data excluded; or 15,000 and over 25% of revenue from sale (Ch. 567, L. 2025)","Attorney General","None in the 2025 text of MCA 30-14-2817","None"],["Florida","FDBR, Fla. Stat. 501.701 to 501.722","Over $1 billion global revenue and one of: 50% of revenue from online ads, a smart speaker service, or an app store","Department of Legal Affairs","Discretionary 45 days","None"],["Iowa","Iowa Code ch. 715D","100,000 consumers; or 25,000 and over 50% of revenue from sale","Attorney General","90 days, no sunset","None"],["Delaware","DPDPA, 6 Del. C. 12D-101 et seq.","35,000 consumers or 10,000 and over 20% of revenue from sale; from 1 January 2027, 10,000 or 5,000 and over 20%","Department of Justice","60 days mandatory in 2025; discretionary from 2026","None"],["Nebraska","NDPA, Neb. Rev. Stat. 87-1101 to 87-1130","Any business that processes or sells personal data and is not an SBA small business","Attorney General","30 days, no sunset (87-1122)","None (87-1125)"],["New Hampshire","RSA 507-H","35,000 unique consumers, payment-only data excluded; or 10,000 and over 25% of revenue from sale","Attorney General","60 days mandatory in 2025; discretionary from 2026","None"],["New Jersey","NJDPA, N.J.S.A. 56:8-166.4 et seq.","100,000 consumers; or 25,000 and any revenue or discount from sale","Division of Consumer Affairs (Attorney General)","30 days until the first day of the 18th month after the effective date, which we calculate as 1 July 2026","None"],["Tennessee","TIPA, Tenn. Code 47-18-3201 et seq.","Revenue over $25 million and 175,000 consumers, or 25,000 and over 50% of revenue from sale","Attorney General","60 days, no sunset","None"],["Minnesota","MCDPA, Minn. Stat. 325M.10 to 325M.21","100,000 consumers, payment-only data excluded; or 25,000 and over 25% of revenue from sale","Attorney General","30-day warning letter expired 31 January 2026","None"],["Maryland","MODPA, Md. Code, Com. Law 14-4701 to 14-4714","35,000 consumers, payment-only data excluded; or 10,000 and over 20% of revenue from sale","Attorney General, Consumer Protection Division","Discretionary, at least 60 days, for violations on or before 1 April 2027 (14-4714)","Not under MODPA: the private action in 13-408 is excluded"],["Indiana","ICDPA, IC 24-15","100,000 Indiana consumers; or 25,000 and over 50% of revenue from sale","Attorney General","30 days, no sunset","None"],["Kentucky","KCDPA, KRS 367.3611 et seq.","100,000 consumers; or 25,000 and over 50% of revenue from sale","Attorney General","30 days, no sunset","None"],["Rhode Island","RIDTPPA, R.I. Gen. Laws 6-48.1","35,000 customers, payment-only data excluded; or 10,000 and over 20% of revenue from sale","Attorney General","None in the text","None"],["Oklahoma","OCDPA, 75A O.S. 300 et seq. (SB 546)","100,000 consumers; or 25,000 and over 50% of revenue from sale","Attorney General (exclusive)","30 days, no sunset","None"],["Louisiana","LDPA, La. R.S. 51:1780.1 to 1780.5 (Act 502)","Revenue over $25 million, or 75,000 consumers, households or devices, or 50% of revenue from sale (résumé digest)","Attorney General","30 days, from 1 January to 31 July 2027","None"],["Alabama","APDPA, HB 351 (2026)","Over 25,000 consumers, payment-only data excluded; or over 25% of revenue from sale","Attorney General","45 days, no sunset","No express provision found"],["Vermont","VDPOSA, 9 V.S.A. ch. 61A (Act 145)","35,000 consumers; or sensitive data of 3,000; or sale of data of 3,000 (Act summary)","Attorney General","60 days, 1 January 2028 to 30 June 2029","None"]],"sourceUrls":[["https://cppa.ca.gov/regulations/pdf/cppa_act.pdf","https://cppa.ca.gov/announcements/2024/20241217.html"],["https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/"],["https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf"],["https://www.cga.ct.gov/current/pub/chap_743jj.htm","https://portal.ct.gov/-/media/ag/reports/ctdpaenforcementreportcy2025.pdf"],["https://le.utah.gov/xcode/Title13/Chapter61/C13-61_2022050420231231.pdf"],["https://capitol.texas.gov/tlodocs/88R/billtext/html/HB00004F.htm"],["https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html"],["https://leg.mt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0030/0300-0140-0280-0030.html"],["http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501PartVContentsIndex.html"],["https://www.legis.iowa.gov/docs/code/715D.pdf"],["https://delcode.delaware.gov/title6/c012d/index.html"],["https://nebraskalegislature.gov/laws/statutes.php?statute=87-1103"],["https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm"],["https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.PDF"],["https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf"],["https://www.revisor.mn.gov/statutes/cite/325M"],["https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4701&enactments=false","https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4714&enactments=false"],["https://iga.in.gov/pdf-documents/123/2023/senate/bills/SB0005/SB0005.05.ENRH.pdf"],["https://apps.legislature.ky.gov/recorddocuments/bill/24RS/hb15/bill.pdf"],["http://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm"],["http://webserver1.lsb.state.ok.us/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.PDF"],["https://www.legis.la.gov/Legis/ViewDocument.aspx?d=1480202","https://www.legis.la.gov/Legis/ViewDocument.aspx?d=1483793"],["https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf"],["https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf","https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20Act%20Summary.pdf"]]}