U.S. State Privacy Laws: 2026 Tracker and Compliance Guide

As of August 2026, 20 U.S. states have comprehensive consumer privacy laws in effect. Indiana, Kentucky, and Rhode Island joined on January 1, 2026, and Oklahoma and Alabama arrive in 2027. There is still no U.S federal data privacy law.

Each state law sets its own rules for who's covered, which rights consumers get, and when you need consent. Twelve U.S. states now require sites to honor Global Privacy Control (GPC) opt-out signals.

This tracker covers every U.S. state law, who it applies to, and what it means for your website.

First, the bad news: if you sell to customers in multiple states, you're subject to a messy patchwork of regulations that grows every year. No single law covers you entirely; you inherit whichever state laws your customers live under, each with its own thresholds and quirks.

The good news: these laws share most of their DNA. Get the common baseline right, handle the handful of stricter outliers, and multi-state compliance stops being a quarterly project.

Below you'll find every law with its key facts, then the practical part most legal trackers skip: what these laws require from your website.

At a glance: every state privacy law in 2026

According to MultiState's legislative tracking, 20 comprehensive U.S. state privacy laws are in effect as of August 2026, with two more signed and set to take effect in 2027.

Three more states regulate privacy without a comprehensive law, and two of them carry more litigation risk than the rest:

Is there a federal U.S. privacy law?

No. The American Data Privacy and Protection Act (ADPPA) and its successor, the American Privacy Rights Act, both stalled in Congress, and newer proposals like the SECURE Data Act haven't moved past committee either, with preemption of stronger state laws still the sticking point. What exists federally is sectoral: HIPAA for health data held by covered entities, GLBA for financial institutions, COPPA for children's data, and FTC enforcement against unfair or deceptive data practices.

According to the FTC's business guidance, the agency treats broken privacy promises as deceptive practices, which means your own privacy policy is enforceable against you even in states with no privacy law at all.

Until Congress acts, your obligations come from the state laws below.

California Consumer Privacy Act (CCPA / CPRA)

California started the wave of strict U.S. privacy legislation and remains the most demanding of the lot. 

The CCPA (2020), amended by the CPRA (2023), created the country's only dedicated privacy regulator (the CPPA) and the only private right of action in a comprehensive law for data breaches, with damages ranging from $100 to $750 per consumer per incident.

It also runs a rulemaking machine that keeps adding requirements: data broker registration, AI and automated decision-making rules, and risk assessments through 2026. 

If you comply with California and nothing else, you're most of the way to the national baseline.

Virginia Consumer Data Protection Act (VCDPA)

Virginia wrote the template that most states copied: opt-out rights for ordinary data, opt-in consent for sensitive data, a 100,000-consumer threshold, and attorney general-only enforcement. It's also one of the more forgiving laws to operate under: its 30-day cure period never expires.

Colorado Privacy Act (CPA)

Colorado follows the Virginia model but with sharper teeth: fines run to $20,000 per violation (capped at $500,000), while most state laws cap fines at $7,500. Its cure period sunset in January 2025, and GPC enforcement has been live since July 2024. Colorado's AG also keeps updating guidance, so requirements move more than in most standard-model states.

Connecticut Data Privacy Act (CTDPA)

Connecticut runs the standard model with the broadest sensitive-data definition outside Maryland, and 2026 made it stricter. Amendments effective July 1 dropped the threshold from 100,000 to 35,000 consumers and added two triggers with no threshold at all: if you sell personal data or process sensitive data, you're covered at any volume.

Utah Consumer Privacy Act (UCPA)

Utah is the most business-friendly law on this list. It only applies if you clear $25 million in revenue AND a consumer-count threshold, sensitive data needs only notice and an opt-out (not opt-in consent), there's no GPC requirement, no impact assessments, and the 30-day cure period never expires.

If you're already handling California, consider yourself covered on the Utah front.

Texas Data Privacy and Security Act (TDPSA)

Texas skipped the consumer-count threshold entirely: if you do business in Texas and you're not an SBA-defined small business, you're covered, with no revenue floor.

Even exempt small businesses need consent before selling sensitive data. Texas's AG has run dedicated privacy sweeps since 2024, enforcement most states haven't attempted.

Oregon Consumer Privacy Act (OCPA)

Oregon follows the standard model with one right no other state started with: consumers can request the specific third parties that received their data, not just the categories. Its GPC requirement kicked in January 2026, the same month its cure period expired. A 2026 amendment also banned the sale of data from users known to be under 16, and the law uniquely covers motor vehicle manufacturers that process vehicle data, regardless of thresholds.

Florida Digital Bill of Rights (FDBR)

Florida is the asterisk in every state count. The FDBR's full controller obligations only apply to for-profit companies with over $1 billion in global revenue that also meet one of three tech-platform criteria: 50%+ of revenue from online ads, an app store with 250,000+ apps, or a consumer smart-speaker service. That's why most trackers count '19 plus Florida. '

Two parts do reach smaller companies: rules on selling sensitive data and children's data protections. 

Montana Consumer Data Privacy Act (MCDPA)

Montana fit the standard model to a small population, and 2025 amendments cut the thresholds deeper: 25,000 residents, down from 50,000, or just 15,000 if a quarter of your revenue comes from data sales. Its cure period sunset in April 2026.

Duty-of-care rules for minors reach every business serving Montanans, regardless of size.

Delaware Personal Data Privacy Act (DPDPA)

Delaware runs the standard model at one of the lowest thresholds in the country: 35,000 consumers, or just 10,000 if a fifth of your revenue comes from data sales. Its GPC requirement and cure-period sunset both landed January 2026.

Enforcement discretion rests with the state Department of Justice, and, as in Oregon, consumers can demand the specific third parties that obtained their data.

Iowa Consumer Data Protection Act (ICDPA)

Iowa sits with Utah at the lenient end: sensitive data requires only notice and an opt-out, there's no GPC duty, no impact assessments, no correction right, and the 90-day cure period is the longest anywhere.

Treat it as covered by your Virginia-model baseline.

Nebraska Data Privacy Act (NDPA)

Nebraska copied the Texas playbook: no consumer-count or revenue threshold, an SBA small-business carve-out, and GPC recognition from day one. If you do business in Nebraska at any real scale, assume you're covered.

The 30-day cure period doesn't sunset.

New Hampshire Data Privacy Act (NHDPA)

New Hampshire pairs low thresholds (35,000 consumers) with the same enforcement route Connecticut and New Jersey use: privacy violations count as deceptive trade practices, with penalties up to $10,000 per violation. The cure period sunset in January 2026.

New Jersey Data Privacy Act (NJDPA)

New Jersey extends the standard model in two ways that trip up companies compliant elsewhere.

Financial information counts as sensitive data; a broader trigger than any other state's (Connecticut's stops at account and card numbers with access credentials). And penalties escalate: violations route through the Consumer Fraud Act at up to $10,000 for a first offense and $20,000 after that.

Its cure period sunset on July 15, 2026, so as of writing there's no grace window.

Tennessee Information Protection Act (TIPA)

Tennessee is the only state with a built-in affirmative defense: a written privacy program that reasonably conforms to the NIST Privacy Framework (or a comparable standard) shields you from liability.

Two conditions: the program stays updated within two years of framework revisions, and consumers still get every right the law grants them.

Minnesota Consumer Data Privacy Act (MCDPA)

Minnesota adds a right no other state has: consumers can question the result of profiling and get an explanation of why an automated decision came out the way it did. It also requires a documented privacy program the AG can inspect, plus a third-party disclosure list on request. The cure period sunset January 31, 2026.

Maryland Online Data Privacy Act (MODPA)

Maryland is the strictest law since California, and stricter in one way: it bans the sale of sensitive data outright, consent or not, and imposes the country's toughest data-minimization standard (collect only what's reasonably necessary for the specific product the consumer asked for). Impact assessments must be run per algorithm.

Maryland imposes a data-minimization standard none of the Virginia-model laws attempt: collect only what's reasonably necessary for the specific product the consumer asked for.

Indiana Consumer Data Protection Act (INCDPA)

Indiana went live January 1, 2026 as a faithful copy of the Virginia model: same thresholds, same opt-in rule for sensitive data, same AG-only enforcement, same permanent 30-day cure period. That makes it one of the gentler laws in the 2026 wave.

Kentucky Consumer Data Protection Act (KCDPA)

Kentucky also launched January 1, 2026 on the Virginia template, with pre-effective-date amendments (HB 473, March 2025) that widened healthcare exemptions: data held by HIPAA-covered providers and HIPAA limited data sets sit outside the law entirely. The same amendments narrowed the impact-assessment trigger for profiling to risks of unlawful disparate impact.

Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)

Rhode Island is small-state, sharp-edges: a 35,000-consumer threshold, no cure period at all, penalties to $10,000 per violation, plus $100 to $500 per intentional disclosure of personal information. It launched January 1, 2026 with the least forgiving enforcement posture of the new wave.

Illinois Biometric Information Privacy Act (BIPA)

Illinois has no comprehensive privacy law, yet it still produces more privacy litigation than any state in the table above. BIPA (2008) requires written consent before collecting biometric identifiers, and it hands consumers a private right of action with statutory damages. That combination built an entire class-action industry: fingerprint time clocks, face-tagging features, and voiceprint tools have all produced eight- and nine-figure settlements.

An August 2024 amendment (SB 2979) reined in the worst of it: repeated scans of the same data by the same method now count as one violation, not thousands. But BIPA remains the highest-severity privacy statute in the country for any company touching biometrics.

New York SHIELD Act

New York also lacks a comprehensive consumer privacy law, but the SHIELD Act (2020) reaches almost everyone anyway. Any business holding the private information of New York residents must maintain reasonable data security safeguards and report breaches, regardless of where the business sits.

It grants no consumer rights and needs no consent banner; it's a security-and-breach law, enforced by the Attorney General with no private right of action.

Treat it as the floor for your security program, and watch this space: New York's comprehensive privacy bills keep advancing each session without passing.

Washington My Health My Data Act (MHMDA)

Washington regulates one category, consumer health data, and does it more aggressively than any comprehensive law.

MHMDA (2024) requires opt-in consent to collect or share health data, a separate signed authorization to sell it, and a ban on geofencing around health facilities. The teeth: a broad private right of action through Washington's Consumer Protection Act, covering any violation, not just breaches.

'Health data' is defined loosely enough to reach period trackers, fitness apps, wellness e-commerce, and ad pixels on symptom pages.

Signed and arriving in 2027: Oklahoma and Alabama

Two more comprehensive laws are already signed. Oklahoma's OCDPA takes effect January 1, 2027 on the Virginia model.

Alabama's Personal Data Protection Act (APDPA) follows May 1, 2027, with a $15,000-per-violation penalty, double the $7,500 most Virginia-model states carry. It also has an unusual second threshold: anyone earning more than 25% of revenue from data sales is covered, no matter how few consumers are involved.

Unlike Oklahoma, Alabama requires controllers to honor opt-out preference signals, so plan on GPC support there from day one.

What do U.S. state privacy laws require from your website?

This is where the actual work starts. Across all of these laws, the obligations that touch your website come down to four things.

Consent management

Every comprehensive law requires you to let consumers opt out of the sale or sharing of personal data, and most require opt-in consent before processing sensitive data. In practice, that means a consent banner or preference center that actually blocks trackers until the right consent state is in place, not one that just decorates the page.

This is the core job of Enzuzo's consent management platform: detect where a visitor is, apply that state's rules, and keep a record of what they chose.

Geo-aware behavior

Opt-in and opt-out obligations differ by state, so one-size-fits-all banner behavior either over-asks (hurting your opt-in rates in states that don't require it) or under-asks (creating exposure in states that do).

The teams we talk to increasingly run region-specific consent rules: stricter defaults for California, lighter treatment where the law allows it. 

Consent records

Several laws require you to be able to demonstrate consent. If a regulator or a plaintiff's firm asks when a visitor consented and to what, "our banner was live that month" is not an answer. Timestamped consent logs are.

Data subject rights requests

Access, correction, deletion, and portability requests, generally with a 45-day response deadline. If you're fielding these by email and spreadsheet today, that works at low volume and breaks the first time a deletion request touches six systems. Our guide to data subject access requests covers how to set this up properly.

What is Global Privacy Control, and which states enforce it?

Global Privacy Control (GPC) is a browser signal that broadcasts a consumer's opt-out preference automatically. Instead of clicking "do not sell my data" on every site, the browser says it for them, and the law treats that signal as a valid opt-out you must honor.

Twelve states now require it: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas. [verify: Virginia may make it 13; sources conflict on whether VCDPA amendments added a universal opt-out duty.] That list more than doubled in two years, and every serious draft bill now includes a universal opt-out clause. Treat GPC support as the direction of travel, not an edge case.

One question we hear consistently from teams that already honor GPC: are we allowed to skip a cookie banner? The answer is that it depends: we don't recommend skipping it entirely, since it depends on the states you operate in and whether you process sensitive data that requires opt-in consent.

It's a genuinely good question to put to your counsel, because the answer changes your banner strategy, not just your legal posture.

What happens if you're not compliant?

Enforcement runs through state attorneys general, with civil penalties typically between $2,500 and $20,000 per violation depending on the state. California adds two things nobody else has among the comprehensive laws: a dedicated regulator (the CPPA) and a private right of action for data breaches, at $100 to $750 per consumer per incident. Illinois BIPA and Washington MHMDA go further, allowing consumers to sue directly for violations, which is why those statutes generate more lawsuits than others.

The AG letter is not the risk most mid-market companies actually meet first, though. The demand letter is. Plaintiff firms now run automated scans for tracking technologies that fire before consent is obtained, then mail settlement demands under wiretapping laws such as CIPA. 

Our California Invasion of Privacy Act explainer covers that exposure in detail.

The practical takeaway: enforcement risk scales with how visibly your site mishandles consent, not with how big you are.

How to operationalize U.S. state compliance (without a team)

If you're selling across the continental U.S, you don't need a 50-state legal memo. You need a defensible baseline:

1.  Know your states. Check your analytics against the "applies to you if" rows above. You're probably covered in more states than you think, and that's fine; the point is knowing which rules are yours.
2.  Run one consent standard, geo-adjusted. Meet the strictest rules that apply to you (usually California plus the GPC states), relax where the law genuinely allows it, and let your CMP handle the geography.
3.  Honor GPC. Twelve states require it and the list only grows.
4.  Keep consent records. Logs, timestamps, versions. This is what turns 'we have a banner' into 'we can show what each visitor chose, and when.
5.  Have a DSAR intake that isn't an inbox. A form, a deadline tracker, and a deletion checklist cover most of it at mid-market scale.

Enzuzo's consent management platform handles the first four out of the box, and teams typically go live in one to three days.

If you'd rather see it against your own site than read about it, book a call with a U.S. privacy law expert.

FAQs

What are some United States data protection laws I should know about?  

Twenty states have comprehensive consumer privacy laws as of 2026, led by California's CCPA/CPRA. Federally, sectoral laws apply: HIPAA (health), GLBA (financial), COPPA (children). If you sell nationally, the practical short list is California, Texas, Colorado, Connecticut, Illinois BIPA if you touch biometrics, and whichever states hold most of your customers.

Is there a federal data privacy law in the U.S.?

No. Proposed federal bills (ADPPA, APRA) have not passed. The FTC enforces against deceptive data practices, but consumer privacy rights currently exist only at the state level.

Which states have data privacy laws in 2026?  

California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island. Indiana, Kentucky, and Rhode Island took effect January 1, 2026. Oklahoma and Alabama have signed laws arriving in 2027, and Illinois, New York, and Washington regulate privacy through targeted statutes.

Can you get sued for a data breach?  

Yes. California's CCPA gives consumers a private right of action for breaches ($100 to $750 per consumer per incident), Illinois BIPA and Washington MHMDA allow direct consumer suits for violations, and breach class actions are common nationwide under other theories. See our [data privacy lawsuits roundup](/blog/data-privacy-lawsuits) for real settlement figures.

If our site honours Global Privacy Control, do we still need a cookie banner?  

Usually yes. GPC covers the opt-out signal, but opt-in requirements for sensitive data, consent records, and non-GPC visitors still need a consent mechanism. The exact answer depends on your states and data types; it's worth a specific conversation with counsel.

We don't sell to EU customers. Do U.S. state laws still require consent management?  

Yes, if you meet any state's threshold. GDPR is irrelevant to this question; 20 U.S. states impose their own consent and opt-out duties, and 12 require honoring GPC signals regardless of where your company is based.

Which states require opt-in consent instead of opt-out?  

For ordinary personal data, none; the U.S. model is opt-out. For sensitive data (health, biometrics, precise location, children's data), nearly every state requires opt-in consent. Utah and Iowa are the main exceptions (notice plus opt-out), and California uses a right-to-limit model instead. Illinois and Washington require opt-in consent for biometric and health data specifically.

Do small businesses face the same privacy-law risk as national brands?  

Increasingly, yes. Thresholds have dropped to 35,000 consumers in several states, Texas and Nebraska have no threshold at all, and demand-letter firms scan small-business sites the same way they scan enterprise ones. What matters is whether your site fires trackers before consent is obtained; scanners check small sites as readily as large ones.