US State Data Privacy Laws: The 2026 Guide to Every Comprehensive Law

There is still no federal consumer privacy law in the US, so if you collect customer data online, the rules you follow depend on where your customers live. A business in Ohio that sells to customers in Texas, Oregon and New Jersey can be subject to 3 state laws without having an office in any of them.

The good news: most state laws follow a similar model, so one well-built program can cover most of them. This guide lists every comprehensive state privacy law in effect or enacted as of October 2026, with effective dates, thresholds, key rights and official sources.

This is not legal advice. Confirm details with the official source and your own counsel.

The quick picture: 23 states and counting

As of October 2026, 23 states have enacted comprehensive consumer privacy laws:

• 19 in effect: California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island.
• 4 enacted in 2026 and not yet in effect: Oklahoma and Louisiana (January 1, 2027), Alabama (May 1, 2027) and Vermont (January 1, 2028).

Florida’s Digital Bill of Rights is often left off these lists because it applies only to companies with more than $1 billion in global revenue. Bills in Massachusetts and Pennsylvania advanced in 2026 but had not been signed in the latest records we checked.

Most of these laws also require “reasonable” data security; our zero trust security guide covers one common approach.

Rights and thresholds most laws share

Consumer rights

Outside California, nearly every law follows the Virginia model of controllers (businesses that decide how data is used) and processors (vendors acting for them). Consumers typically get the right to:

• Confirm and access the personal data a business holds about them.
• Correct inaccurate data (Iowa is a notable exception).
• Delete their personal data.
• Port a copy of their data in a usable format.
• Opt out of targeted advertising, the sale of personal data and profiling used for significant decisions.
• Appeal a denied request, then complain to the attorney general.

Businesses typically must answer requests within 45 days, publish a privacy notice, get opt-in consent for sensitive data (health, precise location, biometrics, children’s data), run data protection assessments for high-risk processing and sign processor contracts. The state attorney general enforces, usually with no private right of action.

A growing group of states, including California, Colorado, Connecticut and Oregon, also requires businesses to honor universal opt-out signals such as Global Privacy Control. Colorado has required it since July 1, 2024.

Key takeaway: Build your program to the strictest common denominator: honor opt-out signals, get opt-in consent for sensitive data, answer requests within 45 days and document risk assessments. That covers most state laws at once.

Who has to comply

Most laws apply only once you cross a threshold, counted in residents of that state, usually over the prior calendar year:

• 100,000 / 25,000 model: You process data of at least 100,000 state residents, or at least 25,000 and earn a set share of revenue from selling personal data. Virginia, Indiana, Kentucky, Iowa and Oklahoma use 50% as the share, Oregon and Minnesota 25%, and Colorado and New Jersey cover any revenue or discount from sales.
• Lower 35,000 model: Delaware, New Hampshire, Rhode Island, Maryland and Vermont start at 35,000 consumers, with a 10,000 tier for data sellers (Vermont uses 3,000 for sensitive data or data sales). Montana now starts at 25,000 and Alabama at more than 25,000.
• Revenue tests: Utah and Tennessee require more than $25 million in revenue plus a consumer-count test. Louisiana covers more than $25 million in revenue, 75,000 consumers, or 50% of revenue from data sales.
• No volume test: Texas and Nebraska apply to businesses that are not small businesses as defined by the US Small Business Administration, and even small businesses there need consent before selling sensitive data.
• Connecticut’s broad reach: Since July 1, 2026, Connecticut applies at 35,000 consumers and to anyone who processes sensitive data or sells personal data, regardless of volume.

Almost all exempt HIPAA- and Gramm-Leach-Bliley-covered data in some form. Many exempt nonprofits, though Oregon, Colorado, Delaware and Minnesota cover them.

California CCPA/CPRA: the outlier

The California Consumer Privacy Act took effect January 1, 2020, and the California Privacy Rights Act amendments January 1, 2023. Key differences:

• Thresholds: It applies to for-profit businesses doing business in California with annual gross revenue above $26,625,000 (adjusted January 1, 2025), or that buy, sell or share personal information of 100,000 or more consumers or households, or that earn at least 50% of revenue from selling or sharing it.
• Broader coverage: It covers employee and business-to-business data, not just consumers.
• Rights: Know and access, delete, correct, opt out of sale and “sharing” for cross-context behavioral advertising, limit use of sensitive personal information, and non-retaliation.
• Enforcement: The California Privacy Protection Agency (CalPrivacy) and the Attorney General. Consumers have a private right of action only for certain data breaches.
• New regulations: Rules effective January 1, 2026 add risk assessments, cybersecurity audits phased in from 2028 by revenue, and automated decisionmaking technology (ADMT) rules from January 1, 2027.
• Data brokers: Under the Delete Act, registered data brokers had to start processing deletion requests from the state’s DROP platform on August 1, 2026.

The early adopters: Virginia, Colorado, Connecticut, Utah and Texas

• Virginia Consumer Data Protection Act (VCDPA): Effective January 1, 2023. The template for most other states. 100,000 consumers, or 25,000 with more than 50% of revenue from data sales. A 30-day cure period still applies.
• Colorado Privacy Act (CPA): Effective July 1, 2023. Detailed Attorney General rules, required universal opt-out recognition, and enforcement by the AG and district attorneys. Colorado also has the ADMT law covered in our state AI laws guide.
• Connecticut Data Privacy Act (CTDPA): Effective July 1, 2023, with major amendments effective July 1, 2026 that lowered thresholds, broadened sensitive data and expanded protections for minors under 18.
• Utah Consumer Privacy Act (UCPA): Effective December 31, 2023. The most business-friendly law, with a $25 million revenue requirement. A right to correct was added effective July 1, 2026.
• Texas Data Privacy and Security Act (TDPSA): Effective July 1, 2024. No volume threshold, exclusive AG enforcement, a 30-day cure period and penalties up to $7,500 per violation.

The 2024 to 2026 wave

• Oregon: Effective July 1, 2024, and for nonprofits July 1, 2025. Gives consumers the right to get a list of specific third parties that received their data.
• Montana: Effective October 1, 2024. 2025 amendments effective October 1, 2025 lowered thresholds to 25,000 consumers (15,000 with over 25% of revenue from sales) and removed the cure period.
• Iowa: Effective January 1, 2025. No correction or profiling opt-out rights, and a 90-day cure period.
• Delaware, Nebraska and New Hampshire: All effective January 1, 2025. Delaware covers most nonprofits; Nebraska uses the Texas-style SBA test.
• New Jersey: Effective January 15, 2025. Covers nonprofits, with rules from the Division of Consumer Affairs.
• Tennessee Information Protection Act: Effective July 1, 2025. More than $25 million in revenue plus 175,000 consumers (or 25,000 with over 50% of revenue from sales). Offers an affirmative defense for following the NIST Privacy Framework.
• Minnesota: Effective July 31, 2025. Adds a right to question the result of profiling and requires a data inventory.
• Maryland Online Data Privacy Act: Effective October 1, 2025. The strictest data minimization rule outside California: collection must be reasonably necessary for the requested service, and sensitive data may be collected only when strictly necessary and never sold.
• Indiana, Kentucky and Rhode Island: All effective January 1, 2026. Indiana and Kentucky follow the Virginia model; Rhode Island uses the 35,000 threshold and requires notice of the third parties data is sold to.

New laws arriving in 2027 and 2028

• Oklahoma Consumer Data Privacy Act (SB 546): Approved March 20, 2026, effective January 1, 2027. Virginia-style: 100,000 consumers or 25,000 with over 50% of revenue from sales, a 30-day cure period and penalties up to $7,500 per violation.
• Louisiana Data Privacy Act (SB 386, Act 502): Signed May 29, 2026, effective January 1, 2027. AG enforcement under the state’s unfair trade practices law, with a temporary cure period through July 31, 2027.
• Alabama Personal Data Protection Act (HB 351): Signed April 2026, effective May 1, 2027. More than 25,000 consumers or over 25% of revenue from data sales, a 45-day cure period and penalties up to $15,000 per violation.
• Vermont Data Privacy and Online Surveillance Act (S.71): Signed June 16, 2026, effective January 1, 2028. Low thresholds, data minimization, extra health data protections and a 60-day cure period through June 30, 2029.

Summary table of state privacy laws

Where to start: 6 steps to compliance

1. Map your data and your customers. List what personal data you collect, where it lives, who you share it with and how many residents of each state are in your records. That tells you which thresholds you cross.
2. Find your sales and targeted ads. Third-party ad pixels and data sharing often count as a “sale” or “sharing.” These trigger opt-out duties in every state.
3. Fix the front door. Update your privacy notice, add a “Do Not Sell or Share” or opt-out link, honor Global Privacy Control signals and set up at least 2 ways to submit requests.
4. Get consent for sensitive data. Audit forms, apps and analytics for health, location, biometric and children’s data, and add opt-in consent where required. Maryland bans selling sensitive data outright.
5. Run assessments and sign processor contracts. Document data protection assessments for targeted advertising, sales, sensitive data and profiling, and make sure every vendor contract has the required privacy terms.
6. Pair privacy with security evidence. Most laws require reasonable security. An independent report such as SOC 2 helps prove it to customers; our SOC 2 compliance guide explains how. Need definitions for terms like “controller” or “processor”? Try our tech glossary.

The bottom line

State privacy law is no longer a California-only problem. With 19 laws in effect and 4 more coming by 2028, most businesses selling online across state lines will cross at least one threshold. A single program built on data mapping, opt-outs, sensitive data consent, assessments and vendor contracts covers most of them. Mark January 1, 2027, when Oklahoma and Louisiana take effect and California’s ADMT rules begin. This is not legal advice.

Sources

• California Privacy Protection Agency: Updated monetary thresholds in CCPA — CCPA revenue threshold of $26,625,000 from January 1, 2025
• Connecticut Attorney General: The Connecticut Data Privacy Act — CTDPA amendments and new thresholds effective July 1, 2026
• Texas Attorney General: Texas Data Privacy and Security Act — TDPSA rights, enforcement, cure period and penalties
• Tennessee Attorney General: Tennessee Information Protection Act guidance — TIPA thresholds, July 1, 2025 effective date and NIST defense
• Montana Department of Justice: Montana Consumer Data Privacy — SB 297 amendments effective October 1, 2025
• Oklahoma Legislature: SB 546 bill information — Oklahoma law approved March 20, 2026, effective January 1, 2027