US state privacy laws
Published 11 min read
Each state counts only its own residents, so the same customer list can leave you outside Virginia’s law and inside Maryland’s.
Quick reference
- Laws in the table
- 15, plus California's CCPA
- Lowest count test
- 25,000 residents (Montana)
- No count test
- Texas, Nebraska
- Usual response clock
- 45 days + 45
- Cure notice still owed
- Virginia, Texas, Iowa, Tennessee, Indiana
- Opt-out signal duty
- 9 of 15, plus California
- Sources read
- 22 Oct 2026
Every state law, side by side
One row per comprehensive state privacy law we could read from the statute, the state’s own attorney general or its session laws. A law reaches you only if you do business in the state or target its residents and you meet its test; the counts are that state’s residents, not your whole customer base. Use the filters to narrow the table to the question you have today.
15 of 15: Every law in the table.
| State and law | In force | Who it reaches | Cure period | Opt-out signal | Enforcer | Response clock |
|---|---|---|---|---|---|---|
| VirginiaVCDPA, Va. Code 59.1-575 ff. | 1 Jan 2023 | ≥100,000 consumers in a calendar year; or ≥25,000 consumers + over 50% of gross revenue from selling personal data | 30 days, ongoing | None in the chapter | Attorney General (exclusive) | 45 days + 45 once |
| ColoradoCPA, C.R.S. 6-1-1301 ff. | 1 Jul 2023 | ≥100,000 Colorado consumers in a calendar year; or revenue/discount from selling personal data + ≥25,000 consumers. From 1 Oct 2025 the minors' duties (§§ 6-1-1305.5, 6-1-1308.5, 6-1-1309.5) apply to any controller doing business in or targeting Colorado, with no volume test (SB 24-041) | 60 days, ended 1 Jan 2025 | Yes, 1 Jul 2024 (GPC is the only recognised UOOM) | Attorney General and district attorneys | 45 days + 45 |
| ConnecticutCTDPA, Conn. Gen. Stat. 42-515 ff. | 1 Jul 2023 | From 1 Jul 2026: ≥35,000 consumers (excl. payment-only); or controls/processes sensitive data; or offers personal data for sale. (Before 1 Jul 2026: 100,000; or 25,000 + over 25% revenue from sales) | 60 days, ended 31 Dec 2024; AG discretion from 1 Jan 2025 | Yes, 1 Jan 2025 | Attorney General (exclusive) | 45 days + 45 |
| TexasTDPSA, Bus. & Com. Code ch. 541 | 1 Jul 2024 | No volume test: processes or sells personal data and is NOT an SBA small business (small businesses still bound by § 541.107 on selling sensitive data) | 30 days, ongoing | Yes (authorized-agent technology incl. browser setting), 1 Jan 2025 | Attorney General (exclusive) | 45 days + 45 once |
| OregonOCPA, ORS 646A.570–646A.589 | 1 Jul 2024; nonprofits 1 Jul 2025 | ≥100,000 consumers; or ≥25,000 consumers + over 25% of annual gross revenue from selling personal data (same for nonprofits). From Sep 2025 every motor vehicle manufacturer, and affiliates processing data from a consumer's use of a vehicle, whatever the volume | Ended 1 Jan 2026 (no notice required) | Yes, 1 Jan 2026 (GPC named as an example) | Attorney General (sole) | 45 days + 45 |
| MontanaMCDPA, MCA 30-14-2801 ff. | not verified here — read the statute | ≥25,000 consumers (excl. payment-only); or ≥15,000 consumers + over 25% of gross revenue from selling personal data (as amended, Ch. 567, L. 2025; MCA 2025) | None in current 30-14-2817 | Yes, 1 Jan 2025 (30-14-2809) | Attorney General (exclusive) | 45 days + 45 |
| IowaICDPA, Iowa Code ch. 715D | 1 Jan 2025 | ≥100,000 consumers in a calendar year; or ≥25,000 consumers + over 50% of gross revenue from selling personal data | 90 days, ongoing | None in the chapter | Attorney General (exclusive) | 90 days + 45 once |
| DelawareDPDPA, 6 Del. C. ch. 12D | 1 Jan 2025 (DOJ enforcement start) | ≥35,000 consumers (excl. payment-only); or ≥10,000 consumers + over 20% of gross revenue from sales. From 1 Jan 2027: ≥10,000; or ≥5,000 + over 20%; or third parties acquiring personal data from a controller | 60 days, ended 31 Dec 2025; DOJ discretion from 1 Jan 2026 | Yes, 1 Jan 2026 | Department of Justice | 45 days + 45 |
| TennesseeTIPA, Tenn. Code 47-18-3201 ff. | 1 Jul 2025 | Revenue over $25,000,000 and either ≥175,000 consumers in a calendar year or ≥25,000 consumers + over 50% of gross revenue from selling personal information | 60 days, ongoing | None in the act as enacted | Attorney General and Reporter (exclusive) | 45 days + 45 once |
| MinnesotaMCDPA, Minn. Stat. 325M.10–325M.21 | 31 Jul 2025 | ≥100,000 consumers in a calendar year (excl. payment-only); or over 25% of gross revenue from selling personal data + ≥25,000 consumers | 30-day warning letter; expired 31 Jan 2026 | Yes, 31 Jul 2025 | Attorney General | 45 days + 45 once |
| MarylandMODPA, Md. Com. Law 14-4701 ff. | 1 Oct 2025 (the 1 Apr 2026 date in Ch. 455 § 2 covers only § 14-4612 as enacted, an exemptions section) | ≥35,000 consumers (excl. payment-only); or ≥10,000 consumers + over 20% of gross revenue from sales | Discretionary, at least 60 days, for violations on or before 1 Apr 2027 | Optional method, not a stand-alone duty: a controller “may utilize” an opt-out link or a signal (“on or before 1 Oct 2025”), § 14-4707(f)(3) | Consumer Protection Division, Office of the AG | 45 days + 45 |
| IndianaICDPA, IC 24-15 | 1 Jan 2026 | ≥100,000 Indiana consumers; or ≥25,000 + over 50% of gross revenue from selling personal data | 30 days, ongoing | None in the act as enacted | Attorney General (exclusive) | 45 days + 45 once |
| NebraskaNDPA, Neb. Rev. Stat. 87-1101 to 87-1130 | 1 Jan 2025 (AG role "as of") | No volume test: processes or sells personal data and is not a small business under the federal Small Business Act as of 1 Jan 2024 (small businesses still liable for selling sensitive data without consent) | not verified here — read the statute | not verified here — read the statute | Attorney General | 45 days + 45 |
| New HampshireNHDPA, RSA 507-H | 1 Jan 2025 | ≥35,000 unique consumers in a one-year period (excl. payment-only); or ≥10,000 unique consumers + over 25% of gross revenue from selling personal data | 60 days for 1 Jan–31 Dec 2025; AG discretion from 1 Jan 2026 | Yes (RSA 507-H:6, V(b)); the AG gives no separate start date | Attorney General (exclusive), Data Privacy Unit | 45 days + 45 |
| New JerseyNJDPL, P.L.2023, c.266 | 15 Jan 2025 | ≥100,000 consumers in a calendar year; or ≥25,000 consumers + makes money from selling personal data (no percentage) | 30 days, until 1 Jul 2026 (ended) | Yes, 15 Jul 2025 (GPC named) | Office of the Attorney General (Division of Consumer Affairs) | not verified here — read the statute |
Statutes, state attorney general pages and session laws, read 22 Oct 2026. The grey line under each state links to the text we read. | ||||||
California is not a row: its test runs on revenue as well as volume, and it has its own agency. It follows next. Several states are missing because we could not read their statutes from a primary source; they are named below, with where to read them.
California sits apart
The CCPA is the only state law here with a revenue test that stands on its own: a firm over the revenue line is covered whatever its customer count. It is also the only one with a dedicated privacy agency, and its dollar figures move with inflation every odd year, so the revenue line changes again on 1 January 2027.
- In force
- 1 Jan 2020 (CPRA amendments operative 1 Jan 2023)
- Who it reaches
- Annual gross revenue over $26,625,000 (CPI-adjusted, effective 1 Jan 2025); or buys, sells or shares the personal information of 100,000 or more consumers or households a year; or derives 50 percent or more of annual revenue from selling or sharing personal information
- Cure period
- At the Agency's discretion (§ 1798.199.45(a))
- Opt-out signal
- Yes (regs § 7025); the Attorney General names GPC
- Enforcer
- California Privacy Protection Agency (CalPrivacy) and the Attorney General
- Response clock
- 45 days + 45 once
To see which of the three prongs your firm meets, run your numbers through the CCPA threshold calculator.
The count that brings you in
Most of the early laws share one shape: 100,000 residents on their own, or a smaller count plus a share of revenue from selling personal data. The newer laws dropped the bar. Connecticut, Montana, Delaware, Maryland and New Hampshire start at 35,000 or fewer residents, and Texas and Nebraska have no count test at all: they reach any firm that processes or sells personal data and is not a small business under the federal small-business rules. Tennessee goes the other way and adds a revenue floor on top of a higher count.
Lowest stand-alone count in each state’s test, read 22 Oct 2026. Lower prongs that need sales revenue are in the table.
- Montana25,000
- Connecticut35,000or any sensitive data, or any sale
- Delaware35,00010,000 from 1 Jan 2027
- Maryland35,000
- New Hampshire35,000
- Virginia100,000
- Colorado100,000minors' duties: no count test from 1 Oct 2025
- Oregon100,000carmakers: no count test from Sep 2025
- Iowa100,000
- Minnesota100,000
- Indiana100,000
- New Jersey100,000
- Tennessee175,000and revenue over $25,000,000
- Texasno count test: not an SBA small business
- Nebraskano count test: not a small business (federal Small Business Act)
Count each state’s residents separately, never your national total. A firm with 120,000 customers, 40,000 of them in Maryland, sits under every 100,000 line and still crosses Maryland’s 35,000. Several states also leave out data you hold only to complete a payment; the table marks them “excl. payment-only”.
Pull a resident count per state from your CRM or order system, then test each state you sell into with the which privacy laws apply checker. It runs the same thresholds and names the prong that caught you.
Cure periods are closing
A cure period is the warning letter: the enforcer names the violation and gives you a set number of days to fix it before it sues. Most early laws wrote one in for good; the newer ones made it temporary, and those windows have now started to shut.
Still owed: the enforcer must warn you first
- Virginia: 30 days, ongoing
- Texas: 30 days, ongoing
- Iowa: 90 days, ongoing
- Tennessee: 60 days, ongoing
- Indiana: 30 days, ongoing
At the enforcer's choice
- Connecticut: 60 days, ended 31 Dec 2024; AG discretion from 1 Jan 2025
- Delaware: 60 days, ended 31 Dec 2025; DOJ discretion from 1 Jan 2026
- Maryland: Discretionary, at least 60 days, for violations on or before 1 Apr 2027
- New Hampshire: 60 days for 1 Jan–31 Dec 2025; AG discretion from 1 Jan 2026
Ended, or none in the current text
- Colorado: 60 days, ended 1 Jan 2025
- Oregon: Ended 1 Jan 2026 (no notice required)
- Montana: None in current 30-14-2817
- Minnesota: 30-day warning letter; expired 31 Jan 2026
- New Jersey: 30 days, until 1 Jul 2026 (ended)
Not verified here
- Nebraska: not verified here — read the statute
Plan as if no warning letter is coming. Where a cure still exists, it buys time to fix a gap, not a pass on it.
Opt-out signals: the duty that touches your website
9 of the 15 laws in the table, plus California, make you treat a browser’s opt-out signal as a request to opt out of sales or targeted advertising. In practice that means your site has to read the signal and switch off selling or sharing for that visitor without a click on your banner. Virginia, Iowa, Tennessee, Maryland and Indiana have no such duty in the text we read. Maryland lists a signal only as one optional method beside an opt-out link (§ 14-4707(f)(3)), and a controller that recognises signals other states approve counts as compliant (§ 14-4707(g)(2)).
Only some states name Global Privacy Control. Colorado treats it as the only valid mechanism; Oregon and New Jersey name it as an example, and the California Attorney General says it must be honoured. The other statutes ask for “an opt-out preference signal” without naming one, so GPC is the signal to test first, not the only one that can count.
Open your site with GPC switched on and see what it does. The Global Privacy Control checker shows whether your browser is sending the signal before you test.
Response clocks: one rule with one exception
Almost every law gives you 45 days to answer a consumer’s request, with one 45-day extension when you need it, the same as California. Iowa is the outlier at 90 days + 45 once. New Jersey’s deadline is not in the Division’s guidance we read, so the table leaves it open. Working to 45 days everywhere keeps you inside every deadline in the table that we could verify.
Date each request the day it arrives and work to 45 days. The DSAR deadline calculator gives the due date and the latest extended date for a request.
Dates that move the table
State privacy law changes on fixed dates written into the statutes. These are the ones in or near this table, marked against the day we read the sources (22 Oct 2026).
- Oregon's cure period ends and its signal duty starts; Indiana's law takes effect; Delaware's signal duty starts and its cure becomes optional; New Hampshire's cure becomes optional. sourcein effect
- Minnesota's 30-day warning letter expires. sourcein effect
- Connecticut's threshold drops from 100,000 to 35,000 consumers and adds sensitive data and sales; New Jersey's cure period ends. sourcein effect
- Delaware's thresholds drop to 10,000 consumers (or 5,000 + over 20% of revenue from sales). California's dollar figures are CPI-adjusted again, and a business that makes a browser must build in an opt-out signal setting. sourcecoming
- Maryland's discretionary cure applies only to violations on or before this date. sourcecoming
Laws we could not read
These 3 state laws are missing from the table on purpose. Each state’s own sites blocked or timed out on every read we tried, and we do not fill a privacy table from memory. If you have customers in these states, read the statute before you rely on any summary, ours included.
- Utah Utah Consumer Privacy Act (UCPA)The legislature's site timed out and the state's own pages sat behind a bot check. Not verified here: read the statute on the legislature’s site.
- Kentucky KRS 367.3611 ff.The legislature's and the Attorney General's sites refused automated reads. Not verified here: read the statute on the legislature’s site.
- Rhode Island RIGL 6-48.1The legislature's site timed out and the Attorney General's site sat behind a bot check. Not verified here: read the statute on the legislature’s site.
Three rows in the table carry a cell we could not confirm: Montana’s effective date, Nebraska’s cure period and opt-out signal duty, and New Jersey’s response deadline. Those cells say so and link to where the text lives.
Questions
Do these laws apply if we have no office in the state?
They can. Each test asks whether you do business in the state or target its residents, and then counts that state’s residents. An office is not part of the test.
Can a consumer sue us under a state privacy law?
Mostly not. The texts we read for Virginia, Connecticut, Texas, Iowa, Montana, Delaware and Minnesota, and for Colorado, Tennessee and Indiana as enacted, say outright that they create no private right of action; the regulators’ own pages say the same for Oregon, New Hampshire and New Jersey. Maryland is the exception to watch: its enforcement section says it does not stop a consumer from pursuing any other remedy the law provides (§ 14-4713(b)). The Nebraska pages we read do not say. California’s law lets consumers sue over certain data breaches only (Civ. Code § 1798.150(c)).
How often does this table change?
On the dates the statutes set, listed above under “Dates that move the table”, and whenever a state passes an amendment. Every row links to the text we read on 22 Oct 2026; check it before you act on a row.
Is this legal advice?
No. It is a summary of public texts read on 22 Oct 2026. A lawyer licensed in the state can tell you how a law applies to your firm.