U.S. State Privacy Laws: 2026 Tracker and Compliance Guide

As of August 2026, 20 U.S. states have comprehensive consumer privacy laws in effect. Indiana, Kentucky, and Rhode Island joined on January 1, 2026, and Oklahoma and Alabama arrive in 2027. There is still no U.S federal data privacy law.

Each state law sets its own rules for who's covered, which rights consumers get, and when you need consent. Twelve U.S. states now require sites to honor Global Privacy Control (GPC) opt-out signals.

This tracker covers every U.S. state law, who it applies to, and what it means for your website.

First, the bad news: if you sell to customers in multiple states, you're subject to a messy patchwork of regulations that grows every year. No single law covers you entirely; you inherit whichever state laws your customers live under, each with its own thresholds and quirks.

The good news: these laws share most of their DNA. Get the common baseline right, handle the handful of stricter outliers, and multi-state compliance stops being a quarterly project.

Below you'll find every law with its key facts, then the practical part most legal trackers skip: what these laws require from your website.

At a glance: every state privacy law in 2026

According to MultiState's legislative tracking, 20 comprehensive U.S. state privacy laws are in effect as of August 2026, with two more signed and set to take effect in 2027.

Three more states regulate privacy without a comprehensive law, and two of them carry more litigation risk than the rest:

Is there a federal U.S. privacy law?

No. The American Data Privacy and Protection Act (ADPPA) and its successor, the American Privacy Rights Act, both stalled in Congress, and newer proposals like the SECURE Data Act haven't moved past committee either, with preemption of stronger state laws still the sticking point. What exists federally is sectoral: HIPAA for health data held by covered entities, GLBA for financial institutions, COPPA for children's data, and FTC enforcement against unfair or deceptive data practices.

According to the FTC's business guidance, the agency treats broken privacy promises as deceptive practices, which means your own privacy policy is enforceable against you even in states with no privacy law at all.

Until Congress acts, your obligations come from the state laws below.

California Consumer Privacy Act (CCPA / CPRA)

The California Consumer Privacy Act (CCPA) is California's comprehensive privacy law, in effect since 2020. A comprehensive law covers personal data across industries, where a sector law such as BIPA covers one kind of data. The California Privacy Rights Act (CPRA) amended the CCPA rather than creating a second law. Its changes took effect in 2023, so both names refer to one statute.

California's law covers employee and business-to-business data, which Virginia's excludes. It also has a dedicated regulator, the California Privacy Protection Agency, which writes detailed regulations and enforces the law alongside the attorney general.

If you sell or share personal information, your site needs a Do Not Sell or Share link. California's regulations also allow a single alternative opt-out link instead. Sharing includes third-party ad cookies and pixels used for cross-site advertising, even when no money changes hands.

California requires you to treat a Global Privacy Control (GPC) signal as a valid opt-out request. GPC is an opt-out a visitor's browser sends on their behalf. Since January 2026, you have to show visitors whether you honored their signal. A cookie banner on its own doesn't count as an opt-out method.

California gives consumers a right to limit how you use their sensitive data instead of requiring opt-in consent up front. Virginia, Colorado, and Connecticut require opt-in, so a California-only consent setup won't cover them. California does require opt-in before you sell or share personal information of a consumer you know is under 16. A parent gives it for under-13s.

California's largest CCPA penalty so far is the $12.75 million General Motors agreed to pay in May 2026 for selling drivers' location and driving data. Other recent fines, including Todd Snyder's and Ford's, targeted opt-out processes that demanded verification or extra personal details before honoring a request.

California's required notices and enforcement record get fuller treatment in the CCPA guide.

Virginia Consumer Data Protection Act (VCDPA)

Virginia's comprehensive privacy law, the Virginia Consumer Data Protection Act (VCDPA), took effect on January 1, 2023. It gives residents opt-out rights for ordinary personal data, requires opt-in consent for sensitive data, and leaves enforcement to the attorney general alone. Many later state privacy laws copy Virginia's structure, so it's the usual baseline for comparing them.

Virginia still gives you a chance to fix a violation after the attorney general's notice (a cure period), and that right never expires. The mandatory cure periods in Colorado and Connecticut have ended. Virginia also doesn't require you to honor Global Privacy Control signals. Its definition of a sale covers only exchanges for money, where Colorado and Connecticut also count trades for anything of value.

Give Virginia residents a way to opt out of targeted advertising and sales. Get opt-in consent before you process sensitive data such as a health diagnosis, precise location, or a known child's data. Since July 1, 2026, Virginia has banned selling precise geolocation data, even with consent.

Since January 1, 2025, Virginia has required parental consent before you sell a known child's data. The same goes for using it for targeted ads or for profiling that shapes significant decisions about them. Parents give that consent through COPPA, the federal children's privacy law.

A federal court preliminarily blocked Virginia's one-hour daily limit for under-16s on each social media service in NetChoice v. Jones in February 2026. The limit, which applied unless a parent agreed otherwise, took effect that January, and Virginia has appealed.

Read our VCDPA guide for the exemptions and a side-by-side with California.

Colorado Privacy Act (CPA)

The Colorado Privacy Act (CPA), in effect since July 1, 2023, is a comprehensive privacy law built on Virginia's structure but with a wider reach. Colorado covers nonprofits, which Virginia exempts. Its 25,000-consumer threshold applies when a business gets any revenue or discount from selling data, where Virginia's requires more than half of gross revenue. Colorado also requires businesses to honor Global Privacy Control signals.

If you sell data or run targeted ads, treat a GPC signal from a Colorado visitor as an opt-out of both. Once someone opts out, the attorney general's CPA rules bar you from using screen-dominating banners, repeated prompts, or cookie walls (overlays that block the site until the visitor accepts) to win them back. Accept and reject choices have to be equally easy to find.

Get opt-in consent before you process or sell sensitive data in Colorado. Inferred traits count too, such as browsing data that suggests someone's sexual orientation. If a person hasn't interacted with you in 24 months, ask for that consent again.

Colorado's biometric and minors' rules apply at any business size, even below the CPA's thresholds. If you process biometric data, you need a public retention policy, plus notice and consent before collection, and you can't sell biometric identifiers.

If you know, or willfully ignore, that a user is under 18, get consent before targeted ads or selling their data. The same applies to design features that keep them online longer.

Colorado joined California and Connecticut in a joint sweep, announced in September 2025, that sent letters to businesses whose sites didn't appear to honor GPC. Colorado hasn't announced a CPA penalty.

Colorado's attorney general also issues opinion letters on request: written answers a business can rely on in good faith. The Colorado guide explains how they work.

Connecticut Data Privacy Act (CTDPA)

Since July 1, 2023, the Connecticut Data Privacy Act (CTDPA) has been Connecticut's comprehensive privacy law. Amendments in Public Act 25-113 took effect July 1, 2026. They extended it to any business that sells personal data or processes sensitive data, whatever its size, and lowered the consumer count for everyone else. Virginia, by contrast, doesn't cover a business below its consumer thresholds, however much it earns from selling data.

Connecticut requires a clear opt-out link on your site and support for opt-out preference signals such as Global Privacy Control. You need the person's opt-in consent before processing their sensitive data. For known minors aged 13 to 17, Connecticut bans targeted ads and data sales, even with consent.

Connecticut's attorney general expects any banner with an accept-all button to give reject all the same prominence (2025 enforcement report). In the attorney general's view, a GPC signal should opt someone out across all their personal data, not only cookie data. Connecticut's first CTDPA settlement, $85,000 from TicketNetwork in July 2025, followed findings that its privacy notice was largely unreadable and its rights tools didn't work.

The CTDPA guide breaks down the 2026 amendments and the attorney general's enforcement priorities.

Utah Consumer Privacy Act (UCPA)

Utah's comprehensive privacy law is the Utah Consumer Privacy Act (UCPA), in effect since December 31, 2023. Utah uses Virginia's consumer thresholds and adds a $25 million annual revenue test on top. A business has to meet both to be covered.

Utah skips several duties Virginia imposes: opt-in consent for sensitive data, data protection assessments, a profiling opt-out, and an appeal process for refused requests. The deletion right covers only data the consumer gave you, a limit Utah's attorney general says no other state's law has (2025 report).

If Utah's law covers you, offer opt-outs for targeted advertising and sales, and explain in your privacy notice how to use them. Before you process sensitive data, give clear notice and a chance to opt out; opt-in consent isn't required.

Utah's attorney general flags privacy policies that give rights to California residents but not to Utahns as apparent violations. If your notices and rights process were built for California, extend them to Utah residents.

In June 2025, Utah sued Snap under the UCPA and other laws. The state claims Snapchat didn't disclose that it shared My AI chat data with OpenAI and didn't offer an opt-out before collecting sensitive data.

If you're near the revenue line, the Utah guide shows how the two thresholds work together.

Texas Data Privacy and Security Act (TDPSA)

Texas skipped the consumer-count threshold entirely: if you do business in Texas and you're not an SBA-defined small business, you're covered, with no revenue floor.

Even exempt small businesses need consent before selling sensitive data. Texas's AG has run dedicated privacy sweeps since 2024, enforcement most states haven't attempted.

Oregon Consumer Privacy Act (OCPA)

Oregon follows the standard model with one right no other state started with: consumers can request the specific third parties that received their data, not just the categories. Its GPC requirement kicked in January 2026, the same month its cure period expired. A 2026 amendment also banned the sale of data from users known to be under 16, and the law uniquely covers motor vehicle manufacturers that process vehicle data, regardless of thresholds.

Florida Digital Bill of Rights (FDBR)

Florida is the asterisk in every state count. The FDBR's full controller obligations only apply to for-profit companies with over $1 billion in global revenue that also meet one of three tech-platform criteria: 50%+ of revenue from online ads, an app store with 250,000+ apps, or a consumer smart-speaker service. That's why most trackers count '19 plus Florida. '

Two parts do reach smaller companies: rules on selling sensitive data and children's data protections. 

Montana Consumer Data Privacy Act (MCDPA)

Montana fit the standard model to a small population, and 2025 amendments cut the thresholds deeper: 25,000 residents, down from 50,000, or just 15,000 if a quarter of your revenue comes from data sales. Its cure period sunset in April 2026.

Duty-of-care rules for minors reach every business serving Montanans, regardless of size.

Delaware Personal Data Privacy Act (DPDPA)

Delaware runs the standard model at one of the lowest thresholds in the country: 35,000 consumers, or just 10,000 if a fifth of your revenue comes from data sales. Its GPC requirement and cure-period sunset both landed January 2026.

Enforcement discretion rests with the state Department of Justice, and, as in Oregon, consumers can demand the specific third parties that obtained their data.

Iowa Consumer Data Protection Act (ICDPA)

Iowa sits with Utah at the lenient end: sensitive data requires only notice and an opt-out, there's no GPC duty, no impact assessments, no correction right, and the 90-day cure period is the longest anywhere.

Treat it as covered by your Virginia-model baseline.

Nebraska Data Privacy Act (NDPA)

Nebraska copied the Texas playbook: no consumer-count or revenue threshold, an SBA small-business carve-out, and GPC recognition from day one. If you do business in Nebraska at any real scale, assume you're covered.

The 30-day cure period doesn't sunset.

New Hampshire Data Privacy Act (NHDPA)

New Hampshire pairs low thresholds (35,000 consumers) with the same enforcement route Connecticut and New Jersey use: privacy violations count as deceptive trade practices, with penalties up to $10,000 per violation. The cure period sunset in January 2026.

New Jersey Data Privacy Act (NJDPA)

New Jersey extends the standard model in two ways that trip up companies compliant elsewhere.

Financial information counts as sensitive data; a broader trigger than any other state's (Connecticut's stops at account and card numbers with access credentials). And penalties escalate: violations route through the Consumer Fraud Act at up to $10,000 for a first offense and $20,000 after that.

Its cure period sunset on July 15, 2026, so as of writing there's no grace window.

Tennessee Information Protection Act (TIPA)

Tennessee is the only state with a built-in affirmative defense: a written privacy program that reasonably conforms to the NIST Privacy Framework (or a comparable standard) shields you from liability.

Two conditions: the program stays updated within two years of framework revisions, and consumers still get every right the law grants them.

Minnesota Consumer Data Privacy Act (MCDPA)

Minnesota adds a right no other state has: consumers can question the result of profiling and get an explanation of why an automated decision came out the way it did. It also requires a documented privacy program the AG can inspect, plus a third-party disclosure list on request. The cure period sunset January 31, 2026.

Maryland Online Data Privacy Act (MODPA)

The Maryland Online Data Privacy Act (MODPA) is Maryland's comprehensive privacy law, in effect since October 1, 2025. Unlike Virginia and Connecticut, which limit data collection to the purposes you've disclosed to consumers, Maryland limits it to what's reasonably necessary for the specific product or service the consumer asked for.

Maryland lets you collect or process sensitive data only when it's strictly necessary for something the consumer requested. It bans selling sensitive data, even with consent. Connecticut lets you process and sell most sensitive data with the person's opt-in consent. If you know or should know a consumer is under 18, you can't target them with ads or sell their data.

Maryland consumers must be able to opt out of targeted advertising, sales, and significant decisions about them made by automated profiling alone. You don't have to verify identity before honoring an opt-out, and you can't require an account to use one.

Don't draw a geofence, a virtual boundary around a location, within 1,750 feet of a mental, reproductive, or sexual health facility. Maryland's ban covers using one to track people, collect their data, or message them about their health.

Since July 1, 2026, Maryland's HB 711 amendment counts anything you infer about someone's sensitive traits as sensitive data. The strictly-necessary rule and the sale ban now cover those inferences too.

Before you set up opt-outs for Maryland, check how the collection limit applies to your data in the Maryland guide.

Indiana Consumer Data Protection Act (INCDPA)

Indiana went live January 1, 2026 as a faithful copy of the Virginia model: same thresholds, same opt-in rule for sensitive data, same AG-only enforcement, same permanent 30-day cure period. That makes it one of the gentler laws in the 2026 wave.

Kentucky Consumer Data Protection Act (KCDPA)

Kentucky also launched January 1, 2026 on the Virginia template, with pre-effective-date amendments (HB 473, March 2025) that widened healthcare exemptions: data held by HIPAA-covered providers and HIPAA limited data sets sit outside the law entirely. The same amendments narrowed the impact-assessment trigger for profiling to risks of unlawful disparate impact.

Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)

Rhode Island is small-state, sharp-edges: a 35,000-consumer threshold, no cure period at all, penalties to $10,000 per violation, plus $100 to $500 per intentional disclosure of personal information. It launched January 1, 2026 with the least forgiving enforcement posture of the new wave.

Illinois Biometric Information Privacy Act (BIPA)

Illinois's Biometric Information Privacy Act (BIPA) is a 2008 law that protects biometric data. It requires any private company to get a signed release (written consent) before collecting someone's biometric identifiers, such as a fingerprint or face scan. Unlike comprehensive state privacy laws, which state officials mainly enforce, BIPA is enforced by the people it protects: anyone whose biometric data is mishandled can sue.

BIPA reaches your website or app when a feature scans faces or voices, such as photo tagging, filters, virtual try-on, selfie ID checks, or voice login. Cookies and tracking pixels fall outside BIPA. Before that feature runs on someone, tell them in writing what you collect, why, and how long you'll keep it, then get their signed release. An electronic signature has counted since August 2024.

Even with consent, you need a public retention policy. The policy has to commit you to destroying the data once its purpose is met. The outside limit is three years after the person's last interaction. You also can't sell or otherwise profit from biometric data at all.

BIPA's largest settlements have come from face scanning: Facebook paid $650 million in 2021 to settle claims over its photo tag suggestions.

Public Act 103-0769, a 2024 amendment, treats repeated collection of the same identifier from the same person by the same method as one violation. Before, each scan could count separately. In April 2026 the federal appeals court covering Illinois (the Seventh Circuit) applied that limit to cases already pending in Clay v. Union Pacific, though the Illinois Supreme Court hasn't ruled on the question.

Every major BIPA settlement, with amounts and dates, is in our full BIPA guide.

New York SHIELD Act

New York also lacks a comprehensive consumer privacy law, but the SHIELD Act (2020) reaches almost everyone anyway. Any business holding the private information of New York residents must maintain reasonable data security safeguards and report breaches, regardless of where the business sits.

It grants no consumer rights and needs no consent banner; it's a security-and-breach law, enforced by the Attorney General with no private right of action.

Treat it as the floor for your security program, and watch this space: New York's comprehensive privacy bills keep advancing each session without passing.

Washington My Health My Data Act (MHMDA)

Washington's My Health My Data Act (MHMDA), passed in 2023, protects consumer health data that HIPAA, the federal health privacy law, doesn't cover. It reaches health inferences drawn from data such as purchases or location. People injured by an MHMDA violation can sue, because the act makes each violation a violation of Washington's Consumer Protection Act. Most state privacy laws leave enforcement to state officials.

MHMDA applies to businesses and nonprofits of any size, and it counts cookie IDs and IP addresses as personal information.

If your site or app handles anything that could count as health data, publish a separate consumer health data privacy policy. Link it from every page that collects personal information.

Get consent before you collect that data, and a second, separate consent before you share it. Neither is needed when the use is necessary for something the person asked for. Selling it takes a signed authorization with nine required elements. Accepting general terms of use, closing a pop-up, or clicking through a misleading design doesn't count as consent under MHMDA.

Early private MHMDA lawsuits have targeted tracking technology. The first was an SDK case against Amazon over location data its ad software collected inside third-party apps. Another was a pixel case against a Seattle cannabis retailer. No court has yet ruled on whether a pixel collects consumer health data.

Our MHMDA guide walks through the consent rules, the sale authorization, and how website tracking gets pulled in.

Signed and arriving in 2027: Oklahoma and Alabama

Two more comprehensive laws are already signed. Oklahoma's OCDPA takes effect January 1, 2027 on the Virginia model.

Alabama's Personal Data Protection Act (APDPA) follows May 1, 2027, with a $15,000-per-violation penalty, double the $7,500 most Virginia-model states carry. It also has an unusual second threshold: anyone earning more than 25% of revenue from data sales is covered, no matter how few consumers are involved.

Unlike Oklahoma, Alabama requires controllers to honor opt-out preference signals, so plan on GPC support there from day one.

What do U.S. state privacy laws require from your website?

This is where the actual work starts. Across all of these laws, the obligations that touch your website come down to four things.

Consent management

Every comprehensive law requires you to let consumers opt out of the sale or sharing of personal data, and most require opt-in consent before processing sensitive data. In practice, that means a consent banner or preference center that actually blocks trackers until the right consent state is in place, not one that just decorates the page.

This is the core job of Enzuzo's consent management platform: detect where a visitor is, apply that state's rules, and keep a record of what they chose.

Geo-aware behavior

Opt-in and opt-out obligations differ by state, so one-size-fits-all banner behavior either over-asks (hurting your opt-in rates in states that don't require it) or under-asks (creating exposure in states that do).

The teams we talk to increasingly run region-specific consent rules: stricter defaults for California, lighter treatment where the law allows it. 

Consent records

Several laws require you to be able to demonstrate consent. If a regulator or a plaintiff's firm asks when a visitor consented and to what, "our banner was live that month" is not an answer. Timestamped consent logs are.

Data subject rights requests

Access, correction, deletion, and portability requests, generally with a 45-day response deadline. If you're fielding these by email and spreadsheet today, that works at low volume and breaks the first time a deletion request touches six systems. Our guide to data subject access requests covers how to set this up properly.

What is Global Privacy Control, and which states enforce it?

Global Privacy Control (GPC) is a browser signal that broadcasts a consumer's opt-out preference automatically. Instead of clicking "do not sell my data" on every site, the browser says it for them, and the law treats that signal as a valid opt-out you must honor.

Twelve states now require it: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas. That list more than doubled in two years, and every serious draft bill now includes a universal opt-out clause. Treat GPC support as the direction of travel, not an edge case.

One question we hear consistently from teams that already honor GPC: are we allowed to skip a cookie banner? The answer is that it depends: we don't recommend skipping it entirely, since it depends on the states you operate in and whether you process sensitive data that requires opt-in consent.

It's a genuinely good question to put to your counsel, because the answer changes your banner strategy, not just your legal posture.

What happens if you're not compliant?

Enforcement runs mainly through state attorneys general, and civil penalties are set per violation: up to $7,500 in Virginia, $10,000 in Maryland, and $20,000 in Colorado, for example. California adds a dedicated regulator, the California Privacy Protection Agency, and a private right of action for data breaches, at $107 to $799 per consumer per incident. Illinois BIPA and Washington MHMDA go further, allowing consumers to sue directly for violations, which is why those statutes generate more lawsuits than others.

The AG letter is not the risk most mid-market companies actually meet first, though. The demand letter is. Plaintiff firms now run automated scans for tracking technologies that fire before consent is obtained, then mail settlement demands under wiretapping laws such as CIPA. 

Our California Invasion of Privacy Act explainer covers that exposure in detail.

The practical takeaway: enforcement risk scales with how visibly your site mishandles consent, not with how big you are.

How to operationalize U.S. state compliance (without a team)

If you're selling across the continental U.S, you don't need a 50-state legal memo. You need a defensible baseline:

1.  Know your states. Check your analytics against the "applies to you if" rows above. You're probably covered in more states than you think, and that's fine; the point is knowing which rules are yours.
2.  Run one consent standard, geo-adjusted. Meet the strictest rules that apply to you (usually California plus the GPC states), relax where the law genuinely allows it, and let your CMP handle the geography.
3.  Honor GPC. Twelve states require it and the list only grows.
4.  Keep consent records. Logs, timestamps, versions. This is what turns 'we have a banner' into 'we can show what each visitor chose, and when.
5.  Have a DSAR intake that isn't an inbox. A form, a deadline tracker, and a deletion checklist cover most of it at mid-market scale.

Enzuzo's consent management platform handles the first four out of the box, and teams typically go live in one to three days.

If you'd rather see it against your own site than read about it, book a call with a U.S. privacy law expert.

FAQs

What are some United States data protection laws I should know about?  

Twenty states have comprehensive consumer privacy laws as of 2026, led by California's CCPA/CPRA. Federally, sectoral laws apply: HIPAA (health), GLBA (financial), COPPA (children). If you sell nationally, the practical short list is California, Texas, Colorado, Connecticut, Illinois BIPA if you touch biometrics, and whichever states hold most of your customers.

Is there a federal data privacy law in the U.S.?

No. Proposed federal bills (ADPPA, APRA) have not passed. The FTC enforces against deceptive data practices, but consumer privacy rights currently exist only at the state level.

Which states have data privacy laws in 2026?  

California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island. Indiana, Kentucky, and Rhode Island took effect January 1, 2026. Oklahoma and Alabama have signed laws arriving in 2027, and Illinois, New York, and Washington regulate privacy through targeted statutes.

Can you get sued for a data breach?  

Yes. California's CCPA gives consumers a private right of action for breaches ($107 to $799 per consumer per incident), Illinois BIPA and Washington MHMDA allow direct consumer suits for violations, and breach class actions are common nationwide under other theories. See our data privacy lawsuits roundup for real settlement figures.

If our site honours Global Privacy Control, do we still need a cookie banner?  

Usually yes. GPC covers the opt-out signal, but opt-in requirements for sensitive data, consent records, and non-GPC visitors still need a consent mechanism. The exact answer depends on your states and data types; it's worth a specific conversation with counsel.

We don't sell to EU customers. Do U.S. state laws still require consent management?  

Yes, if you meet any state's threshold. GDPR is irrelevant to this question; 20 U.S. states impose their own consent and opt-out duties, and 12 require honoring GPC signals regardless of where your company is based.

Which states require opt-in consent instead of opt-out?  

For ordinary personal data, none; the U.S. model is opt-out. For sensitive data (health, biometrics, precise location, children's data), nearly every state requires opt-in consent. Utah and Iowa are the main exceptions (notice plus opt-out), and California uses a right-to-limit model instead. Illinois and Washington require opt-in consent for biometric and health data specifically.

Do small businesses face the same privacy-law risk as national brands?  

Increasingly, yes. Thresholds have dropped to 35,000 consumers in several states, Texas and Nebraska have no threshold at all, and demand-letter firms scan small-business sites the same way they scan enterprise ones. What matters is whether your site fires trackers before consent is obtained; scanners check small sites as readily as large ones.