State Consumer Privacy Laws

Lesson 01 defined the vocabulary these laws use: personal data, sensitive data, controller, processor, sale, targeted advertising, de-identified and pseudonymous data (The Terms and the Map). This lesson does not repeat those definitions. It covers who is bound, what the laws require, and who has enforced them. Course 73's State Privacy and Breach Laws covers the compliance program side for a small or mid-sized business. Breach notice laws, which every state has, are lesson 09.

California first: the CCPA and the CPRA

The California Consumer Privacy Act passed in 2018 and took effect January 1, 2020. Voters amended it with Proposition 24, the California Privacy Rights Act, in November 2020; the amendments took effect January 1, 2023 and the agency's regulations on March 29, 2023, according to the Attorney General's CCPA page. The law sits at Civil Code 1798.100 and following sections.

Who it binds. A for-profit business that does business in California and meets any one test: annual gross revenue above a dollar figure that started at $25 million and has been adjusted for inflation to $26,625,000 since January 1, 2025 (CPPA); buying, selling or sharing the personal information of 100,000 or more California residents or households; or deriving 50 percent or more of annual revenue from selling California residents' personal information. Nonprofits and government agencies generally are not covered. California also covers employee and job applicant data, which the Virginia-model laws generally exclude; the Tractor Supply case below turned partly on notices to job applicants.

Rights. To know what a business has collected, used, shared or sold; to delete; to correct (since 2023); to opt out of sale and of sharing for cross-context behavioral advertising; to limit use and disclosure of sensitive personal information (since 2023); and not to be discriminated against for using these rights. The Attorney General says the Global Privacy Control, a browser signal, "must be honored by covered businesses as a valid consumer request" to opt out of sale and sharing.

Enforcement. Both the California Privacy Protection Agency (now branded CalPrivacy at privacy.ca.gov) and the Attorney General enforce the law. Penalties as adjusted January 1, 2025 are up to $2,663 per violation and $7,988 per intentional violation or violation involving consumers under 16. The law has no mandatory cure period for regulators. The single private right of action is in Civil Code 1798.150: a consumer whose unencrypted and unredacted personal information is stolen in a breach caused by a business's failure to maintain reasonable security can recover $107 to $799 per consumer per incident (adjusted), or actual damages if greater, after giving the business 30 days' written notice and a chance to cure.

The 2025 regulations

On September 23, 2025 the CPPA announced that state regulators had approved its regulations on cybersecurity audits, risk assessments and automated decisionmaking technology (CPPA). They took effect January 1, 2026. Risk assessments are required from that date, with the first attestation and summary due April 1, 2028. Cybersecurity audit certifications are due April 1, 2028 for businesses with more than $100 million in revenue, April 1, 2029 for $50 million to $100 million, and April 1, 2030 for less. Businesses that use automated decisionmaking technology for significant decisions must comply starting January 1, 2027.

California enforcement so far

Company	Enforcer	Date	Amount	Main allegations
Sephora	Attorney General	Aug. 24, 2022	$1,200,000	CCPA violations
DoorDash	Attorney General	Feb. 21, 2024	$375,000	CCPA and CalOPPA violations
Tilting Point Media	Attorney General	June 19, 2024	$500,000	CCPA and COPPA violations
American Honda Motor Co.	CPPA	Mar. 12, 2025	$632,500	Excess verification for opt-outs, uneven consent choices, agent barriers, ad tech sharing without required contracts
Todd Snyder	CPPA	May 6, 2025	$345,178	Opt-out requests unprocessed for 40 days, excess information demands, identity checks before opt-out
Healthline Media	Attorney General	July 1, 2025	$1,550,000	CCPA violations
Tractor Supply	CPPA	Sept. 30, 2025	$1,350,000	Deficient privacy policy, no notice to job applicants, opt-out tools that ignored the GPC, sharing without contracts; the largest CPPA fine at the time
Sling TV and Dish Media Sales	Attorney General	Oct. 30, 2025	$530,000	CCPA violations
Jam City	Attorney General	Nov. 21, 2025	$1,400,000	CCPA violations
Walt Disney Company	Attorney General	Feb. 11, 2026	$2,750,000	CCPA violations
General Motors	Attorney General	May 8, 2026	$12,750,000	CCPA and unfair competition law violations

Amounts and dates are from the Attorney General's enforcement list and the CPPA announcements. Where this table says only "CCPA violations," the list gives no further summary and the complaint should be read for details. The CPPA has also brought a series of actions against data brokers that failed to register under the Delete Act, starting in November 2024.

Every state with a broad consumer privacy law, October 2026

The count of 23 matches the IAPP chart updated June 29, 2026. Some trackers say 24 because they count Florida's Digital Bill of Rights, which applies only to a company with more than $1 billion in global revenue that also earns half its revenue from online ads, runs a smart speaker service, or runs an app store with at least 250,000 apps (Fla. Stat. 501.702). This course follows the IAPP and lists Florida separately. No new state law was enacted between the IAPP update and late October 2026 in the sources checked; Massachusetts and Pennsylvania had bills pending. For 19 states, each figure below was read on the statute or an official state page. For Oklahoma, the thresholds and effective date were confirmed in an Oklahoma House of Representatives release (March 23, 2026), and the cure period, penalty and nonprofit exemption come from law firm summaries; Governor Stitt signed SB 546 on March 20, 2026, according to Mayer Brown. For Alabama, the enrolled bill text could not be opened, so its figures come from law firm summaries checked against the IAPP chart. For Louisiana and Vermont, the figures were read on the enacted Act text on each legislature's site.

State	Statute	Effective	Applies when a business handles data of (per year)	Cure period	Enforcer	Private right of action
California	Civ. Code 1798.100 et seq. (CCPA, as amended by CPRA)	Jan. 1, 2020 (CPRA Jan. 1, 2023)	Revenue over $26,625,000; or buys, sells or shares data of 100,000 residents or households; or 50% of revenue from selling	None required	CPPA and Attorney General	Only for certain breaches (1798.150)
Virginia	Va. Code 59.1-575 to 59.1-585	Jan. 1, 2023	100,000; or 25,000 and over 50% of revenue from selling	30 days, permanent	Attorney General (exclusive)	No
Colorado	C.R.S. 6-1-1301 et seq.	July 1, 2023	100,000 or more; or 25,000 or more and any revenue or discount from selling	60 days, ended Jan. 1, 2025	Attorney General and district attorneys	No
Connecticut	Conn. Gen. Stat. 42-515 to 42-527	July 1, 2023	Since July 1, 2026: 35,000; or any sensitive data; or offers data for sale (was 100,000, or 25,000 and over 25%)	60 days through Dec. 31, 2024; now at AG discretion	Attorney General (exclusive)	No
Utah	Utah Code 13-61-101 et seq.	Dec. 31, 2023	Revenue of $25 million or more and 100,000; or 25,000 and over 50% from selling	30 days	Attorney General (on referral from the Division of Consumer Protection)	No
Texas	Bus. and Com. Code ch. 541	July 1, 2024	Any business that is not an SBA-defined small business; small businesses need consent to sell sensitive data	30 days	Attorney General (exclusive)	No
Oregon	ORS 646A.570 to 646A.589	July 1, 2024	100,000; or 25,000 and 25% or more from selling; auto makers regardless under a 2025 amendment (per law firm reporting)	30 days, ended Jan. 1, 2026	Attorney General (Oregon DOJ)	No
Montana	Mont. Code 30-14-2801 et seq.	Oct. 1, 2024	25,000; or 15,000 and over 25% from selling (as amended 2025)	None in current text (2025 amendment)	Attorney General (exclusive)	No
Iowa	Iowa Code ch. 715D	Jan. 1, 2025	100,000; or 25,000 and over 50% from selling	90 days	Attorney General (exclusive)	No
Delaware	6 Del. C. ch. 12D	Jan. 1, 2025	35,000; or 10,000 and over 20% from selling. From Jan. 1, 2027: 10,000; or 5,000 with the revenue test; plus third parties that acquire data	60 days in 2025; now at DOJ discretion	Department of Justice	No
Nebraska	Neb. Rev. Stat. 87-1101 to 87-1130	Jan. 1, 2025	Any business that is not an SBA-defined small business; consent rule for selling sensitive data reaches more	30 days	Attorney General	No
New Hampshire	RSA 507-H	Jan. 1, 2025	35,000 unique consumers; or 10,000 and over 25% from selling	60 days in 2025; now at AG discretion	Attorney General (exclusive)	No
New Jersey	N.J.S.A. 56:8-166.4 to 166.19	Jan. 15, 2025	100,000; or 25,000 and any revenue or discount from selling	30 days during the first 18 months (to about July 1, 2026)	Attorney General; Division of Consumer Affairs issues notices	No
Tennessee	Tenn. Code 47-18-3301 to 3315	July 1, 2025	Revenue over $25 million and 175,000; or 25,000 and over 50% from selling	60 days	Attorney General (exclusive)	No
Minnesota	Minn. Stat. 325M.10 to 325M.21	July 31, 2025	100,000; or 25,000 and over 25% from selling; SBA small businesses exempt except the sensitive data sale rule	30 days, expired Jan. 31, 2026	Attorney General	No
Maryland	Md. Com. Law 14-4701 to 14-4714	Oct. 1, 2025	35,000; or 10,000 and over 20% from selling	At least 60 days if offered, for violations through Apr. 1, 2027	AG Consumer Protection Division	No
Indiana	Ind. Code 24-15	Jan. 1, 2026	100,000 Indiana residents; or 25,000 and over 50% from selling	30 days	Attorney General (exclusive)	No
Kentucky	KRS 367.3611 to 367.3629	Jan. 1, 2026	100,000; or 25,000 and over 50% from selling	30 days	Attorney General (exclusive)	No
Rhode Island	R.I. Gen. Laws 6-48.1	Jan. 1, 2026	35,000; or 10,000 and over 20% from selling	None	Attorney General (sole)	No
Oklahoma	SB 546 (2026)	Jan. 1, 2027	100,000; or 25,000 and over 50% from selling	30 days, no sunset stated	Attorney General (exclusive)	No
Louisiana	SB 386, Act 502 of 2026, R.S. 51:1780.1 to 1780.5	Jan. 1, 2027	Revenue over $25 million; or buys, receives, sells or shares data of 75,000 or more consumers, households or devices; or 50% or more of revenue from selling	30 days until July 31, 2027	Attorney General	No
Alabama	HB 351 (2026)	May 1, 2027	More than 25,000; or about 25% of revenue from selling (summaries differ on "more than" or "at least" 25%); businesses under 500 employees and nonprofits under 100 that do not sell data exempt	45 days, no sunset	Attorney General	No
Vermont	S.71, Act 145 of 2026, 9 V.S.A. 2415a to 2415k	Jan. 1, 2028	35,000 residents; or sensitive data of 3,000; or sells data of 3,000; consumer health data at any volume	60 days, through June 30, 2029	Attorney General (exclusive)	No

Penalties mostly run up to $7,500 per violation where the statute sets its own figure (Virginia, Utah, Texas, Oregon, Iowa, Nebraska, Tennessee, Minnesota, Indiana, Kentucky and, per the law firm summary, Oklahoma). Tennessee also allows treble damages for willful or knowing violations. Connecticut, Delaware, New Hampshire, New Jersey and Maryland route violations through their general consumer protection statutes instead. Rhode Island adds a fine of $100 to $500 per unlawful disclosure on top of its deceptive trade practices law. One law firm summary reports Alabama's cap as $15,000 per violation; that figure was not confirmed on the bill text.

What the Virginia model shares

Virginia's 2021 law set the template that 20 or so states have adapted. A covered controller must honor rights to confirm whether it processes a person's data, to access it, correct it, delete it and get a portable copy, and to opt out of three things: sale, targeted advertising, and profiling in furtherance of decisions with legal or similarly significant effects. Processing sensitive data (race, religion, health, sexual orientation, citizenship status, genetic and biometric data, children's data, precise geolocation) needs opt-in consent. Controllers must post a privacy notice, limit collection to what is adequate, relevant and reasonably necessary for disclosed purposes, use reasonable security, sign contracts with processors, and run data protection assessments for targeted advertising, sales, risky profiling and sensitive data. Entity exemptions follow a familiar list. Virginia's 59.1-576(B) exempts government bodies, GLBA financial institutions, HIPAA covered entities and business associates, nonprofits, and colleges. Most states copy part of that list, but not all of it: Oregon's Department of Justice says its law applies to nonprofit as well as for-profit businesses, and Alabama exempts only nonprofits with fewer than 100 employees that do not sell data. Read each law's own exemption section.

Where the laws differ

Maryland's data minimization. Maryland moved from "reasonably necessary for disclosed purposes" to a stricter test. Under Commercial Law 14-4707, collection of personal data must be "reasonably necessary and proportionate" to provide or maintain the specific product or service the consumer asked for, and sensitive data may be collected, processed or shared only when "strictly necessary" for that purpose. Selling sensitive data is banned outright, consent or not, and so is selling or targeting ads to the data of anyone the controller knew or should have known was under 18.

Texas and Nebraska's small business rule. These two states dropped the consumer count altogether. Texas's law applies to anyone doing business in Texas who processes personal data and is not a small business under federal Small Business Administration size standards, and even a small business must get consent before selling sensitive data (Texas AG). Nebraska copied the structure in 87-1103 and 87-1118. Minnesota uses a count but exempts SBA small businesses from everything except its own sensitive data sale rule in 325M.17.

Minnesota's right to question profiling. Under Minn. Stat. 325M.14, a person subjected to a profiling decision with legal or similarly significant effects can question the result, be told why the profiling led to the decision, review the personal data used, and, if the data was wrong, have it corrected and the decision reevaluated. Minnesota also gives a right to a list of the specific third parties that got a person's data. Vermont, effective 2028, adds a similar right to contest profiling results and a third-party list, plus a requirement that privacy notices say whether personal data is used to train large language models.

Connecticut's 2025 rewrite. Public Act 25-113 cut Connecticut's threshold to 35,000 consumers and added two triggers with no volume floor: controlling or processing any sensitive data, or offering personal data for sale (effective July 1, 2026). It also requires impact assessments for profiling used in decisions with legal or similarly significant effects, for processing created on or after August 1, 2026.

Tennessee's safe harbor. Tenn. Code 47-18-3314 gives an affirmative defense to a business that keeps a written privacy program reasonably conforming to the NIST Privacy Framework (Version 1.0) or a comparable standard, updated within two years of a framework revision. Tennessee also has the highest volume threshold, 175,000 consumers, and a $25 million revenue floor.

2026 amendments. A July 2026 law firm review reported that Virginia banned the sale of precise geolocation data effective July 1, 2026, Connecticut did the same effective October 1, 2026, New Jersey banned the sale of sensitive data by anyone regardless of size effective June 30, 2026, and Maryland redefined precise geolocation to a 1,750-foot radius effective July 1, 2026. These were reported by Venable and not checked against each session law here.

Colorado's AI Act. Colorado's 2024 artificial intelligence law (SB 24-205), which would have required developers and deployers of high-risk AI systems to guard against algorithmic discrimination, was repealed and reenacted in narrower, notice-based form by SB 26-189, signed May 14, 2026 and effective January 1, 2027, according to law firm reporting. The legislature's bill page still showed the bill as introduced when checked in October 2026, so confirm the final text there.

Universal opt-out signals

A universal opt-out mechanism lets a person set one signal in a browser or device instead of clicking "do not sell" on every site. California treats the Global Privacy Control as a valid opt-out request that covered businesses must honor. Colorado required controllers to honor recognized universal opt-out mechanisms starting July 1, 2024 (Colorado AG), and Connecticut's requirement took effect January 1, 2025 (Connecticut AG). Several later laws include the same duty, often with a delayed start date; check each statute's opt-out section. The Tractor Supply case shows the risk: the CPPA fined the company in part because its opt-out tools ignored the GPC.

Data broker registries and California's DROP

Four states run registries for companies that sell data about people they do not deal with directly.

• California: brokers register each year with the CPPA between January 1 and 31. Under the Delete Act, the agency had to build a single deletion system by January 1, 2026, and the Delete Request and Opt-out Platform (DROP) is live. Starting August 1, 2026, registered brokers must check it at least once every 45 days and process requests, with independent audits starting January 1, 2028 (Civil Code 1798.99.86; CPPA).
• Vermont: annual registration with the Secretary of State under 9 V.S.A. chapter 62, subchapter 5, due January 1 to 31 with a $100 fee (Vermont SOS). Under the version of 9 V.S.A. 2446 effective January 1, 2027, the deadline moves to July 1, the fee rises to $900 and brokers must post a $20,000 bond.
• Texas: registration with the Secretary of State with a $300 fee (Bus. and Com. Code 509.005). The Attorney General said in a July 21, 2025 release that its enforcement pushed registrations above 200.
• Oregon: registration with the Department of Consumer and Business Services before collecting, selling or licensing brokered personal data, under a 2023 law (ORS 646A.593).

Connecticut's registration starts January 1, 2027 and New Jersey's in spring 2027, according to the July 2026 Venable review. Police purchases of broker data are covered in Data Brokers and Police Purchases, and the federal ban on sales to foreign adversaries in lesson 07.

Biometric laws

Law	Consent rule	Damages or penalty	Who can sue
Illinois BIPA, 740 ILCS 14	Written notice of purpose and duration and a written release before collection; public retention policy; destruction within 3 years of last interaction at most; no selling or profiting	$1,000 per negligent and $5,000 per intentional or reckless violation, or actual damages; one recovery per person per method since Aug. 2, 2024	Any aggrieved person, plus attorney fees
Texas CUBI, Bus. and Com. Code 503.001	Inform and get consent before capturing for a commercial purpose; limited disclosure; destroy within a year after the purpose ends	Up to $25,000 per violation	Attorney General only
Washington, RCW 19.375	Notice, consent, or a way to prevent commercial use, before enrolling an identifier in a database for a commercial purpose	Consumer Protection Act remedies	Attorney General only
Colorado, HB 24-1130 (amending the Colorado Privacy Act)	Disclosure and consent before collection; written retention, incident response and deletion policy; limits on employer consent demands	Colorado Privacy Act enforcement	Attorney General and district attorneys

Illinois. In Rosenbach v. Six Flags (January 25, 2019), the Illinois Supreme Court held that a person need not show any injury beyond the violation to be "aggrieved" and sue. In Cothron v. White Castle (February 17, 2023, 4 to 3), it held that a claim accrues with each scan or transmission without consent, while noting damages are discretionary and inviting the legislature to address the potential for enormous awards. The legislature answered with Public Act 103-769, effective August 2, 2024, which makes repeated collection of the same data from the same person by the same method a single violation (740 ILCS 14/20). The largest BIPA class settlement, In re Facebook Biometric Information Privacy Litigation, was approved for $650 million on February 26, 2021 in the Northern District of California, with about 1.57 million claimants receiving at least $345 each.

Texas. On July 30, 2024 the Attorney General announced a $1.4 billion settlement with Meta, payable over five years, under CUBI and the Deceptive Trade Practices Act, over facial recognition run on photos uploaded to Facebook through the Tag Suggestions feature. On May 9, 2025 he announced a $1.375 billion settlement in principle with Google resolving suits filed in 2022 over location tracking, incognito-mode searches, and voiceprints and facial geometry.

Health data laws. Washington's My Health My Data Act reaches consumer health data outside HIPAA, applied to most regulated entities from March 31, 2024 and to small businesses from June 30, 2024, and is the rare privacy law that lets individuals sue, through the Consumer Protection Act (Washington AG). Nevada and Connecticut have similar rules and Vermont's 2026 law applies its health data rules at any volume. Lesson 03 covers these in detail (Health Privacy: HIPAA and Beyond).

State enforcement outside California

Texas has been the most active. It sued General Motors on August 13, 2024, alleging GM collected trip data from 2015 and newer vehicles, enrolled customers in OnStar Smart Driver during setup with the warning that declining would disable safety features, and sold the data to companies that built driving scores for insurers, affecting more than 1.5 million Texans. On January 13, 2025 it sued Allstate and its subsidiary Arity under the Texas Data Privacy and Security Act, alleging they paid app developers to embed software that collected location and movement data from more than 45 million Americans' phones without notice or consent. The Attorney General described that as the first suit under a state consumer privacy law. A July 2025 release said the office had sent dozens of TDPSA violation notices and received more than 2,000 privacy complaints through a portal launched in July 2024.

Connecticut's Attorney General had to report to the legislature's general law committee by February 1, 2024 on the notices of violation issued and how many were cured, under 42-525. Reports like that, and the press pages of each attorney general, are the best public record of what regulators are looking at in the states without big settlements yet.

Questions and answers

I live in Idaho. Do any of these laws protect me?

Not directly. Most laws protect residents of their own state. In practice, many national companies apply the same privacy controls to every user, so the opt-out links and request forms built for California or Virginia often work for Idahoans too. Idaho's own laws are covered in lesson 10.

Why do some trackers say 24 states?

They count Florida. Florida's law applies only to companies with more than $1 billion in global revenue that also meet an advertising, smart speaker or app store test, so the IAPP and this course list it separately.

What counts as a "consumer" in these laws?

A resident acting in a personal or household capacity. Most laws exclude people acting in a commercial or employment context, so business contact data and employee files are outside them. California is the main exception for employees.

Does a nonprofit have to comply?

It depends on the state. Virginia's 59.1-576(B) exempts nonprofit organizations, and law firm summaries report the same for Oklahoma. Oregon's Department of Justice says its law applies to nonprofits too. Alabama exempts nonprofits with fewer than 100 employees that do not sell data. Campaigns and advocacy groups should read the exemption section of each state where their supporters live; course 61 covers starting a nonprofit or advocacy group.

How fast must a company answer my request?

Under Va. Code 59.1-577, the model most states copied, within 45 days, with one 45-day extension when reasonably necessary and explained. A denied request can be appealed, and the appeal answer is due within 60 days. Other states' timing provisions vary, so read the specific statute.

What is the difference between a "sale" and "sharing"?

California separates sale (for money or other valuable consideration) from sharing (for cross-context behavioral advertising, paid or not). The Virginia-model states cover the second practice with a separate targeted advertising opt-out. Lesson 01 has the definitions.

Can a company punish me for using these rights?

California's law includes a right not to be discriminated against for exercising CCPA rights, listed on the Attorney General's CCPA page. The Virginia-model laws have similar anti-retaliation language. Read the statute's nondiscrimination section for the exceptions it allows.

Is DROP the same as the Do Not Call list?

It works similarly for data brokers. One request through California's platform goes to every registered broker, which must check the platform at least every 45 days starting August 1, 2026. It reaches only registered data brokers, not companies you deal with directly.

Hard questions

Should state privacy laws let individuals sue?

Supporters point to BIPA: its private right is why companies stopped scanning faces without consent in Illinois, and agencies cannot police thousands of companies. Opponents point to the same law: liquidated damages per scan produced settlements like Facebook's $650 million and exposure the Illinois Supreme Court itself called potentially enormous in Cothron, before the legislature cut it back in 2024. Every broad consumer privacy law passed since California's has left enforcement to the state, which suggests most legislatures have sided with the second view, while Washington's health data law shows some will choose the first for sensitive data.

Should cure periods be permanent?

Businesses argue that a right to fix a problem before facing penalties is fair for new, complex laws and encourages compliance over litigation; Virginia, Iowa, Utah, Tennessee, Indiana, Kentucky and Alabama made it permanent. Enforcers and privacy groups argue a permanent cure lets a company violate the law until caught, then fix it at no cost; Colorado, Connecticut, Oregon and others let theirs expire after a year or two. The AG discretion model in Connecticut, Delaware and New Hampshire is a middle position.

Is data minimization better than notice and choice?

Maryland's strictly necessary standard reflects the view that people cannot meaningfully read and consent to every privacy notice, so the law should limit collection itself. Opponents argue that strict necessity is hard to apply to new products, could block useful services, and substitutes a regulator's judgment for a consumer's choice. Most states still rely on disclosure plus opt-outs and opt-in for sensitive data. Maryland's enforcement after April 2027 will be the first real test.

Should a state law reach any business, regardless of size?

Texas and Nebraska chose federal small business standards, which can cover a regional company with a modest customer list. Supporters say privacy harms do not depend on a company's size, and data brokers and app developers can be small. Others argue that small businesses lack compliance staff and that a consumer count keeps the law aimed at companies that handle data at scale. The trend in 2025 and 2026 has been toward lower thresholds (Montana, Connecticut, Delaware), not higher.

Should biometric data be banned from sale outright?

Illinois and Texas already bar selling biometric identifiers except in narrow cases, and Maryland bans selling all sensitive data. Supporters say a face or fingerprint cannot be changed after a leak, so consent is an inadequate safeguard. Others argue that consent-based sharing supports fraud prevention, identity verification and accessibility tools. Most states allow processing with opt-in consent and leave sale bans to the specific biometric statutes.