Data Privacy
Open-data reference.
Comprehensive consumer data privacy laws regulating how businesses collect, process, store, and share personal information.
Regulatory Snapshot: Data Privacy
Data Privacy legislation is in a rapid-expansion phase: 21 states have enacted data privacy rules and 0 are actively considering pending bills. PlainRegWatch tracks 21 regulations in this category - 21 enacted and 0 pending, giving an enactment ratio of 100% across the fleet. California leads with 1 enacted data privacy rule, setting a working template that neighboring states often borrow from during drafting.
The earliest tracked data privacy enactment in this dataset dates to 2018, with the most recent in 2024. Of the 21 states with any data privacy activity on record, 0 have enacted more than one rule in this area, suggesting iterative policy refinement rather than one-and-done legislation.
For compliance teams, the data privacy landscape presents a multi-jurisdictional patchwork: rules differ on applicability thresholds, effective dates, and penalty structures across the 21 enacting states. PlainRegWatch normalizes each entry to the official statute or bill number and links to the originating legislative record, review any individual regulation below for its summary, key requirements, and source URL.
States with Data Privacy Laws
| State | Enacted | Total |
|---|---|---|
| California | 1 | 1 |
| Colorado | 1 | 1 |
| Connecticut | 1 | 1 |
| Delaware | 1 | 1 |
| Florida | 1 | 1 |
| Indiana | 1 | 1 |
| Iowa | 1 | 1 |
| Kentucky | 1 | 1 |
| Maryland | 1 | 1 |
| Minnesota | 1 | 1 |
| Montana | 1 | 1 |
| Nebraska | 1 | 1 |
| New Hampshire | 1 | 1 |
| New Jersey | 1 | 1 |
| Oregon | 1 | 1 |
| Rhode Island | 1 | 1 |
| Tennessee | 1 | 1 |
| Texas | 1 | 1 |
| Utah | 1 | 1 |
| Vermont | 1 | 1 |
| Virginia | 1 | 1 |
All Data Privacy Regulations (21)
California Consumer Privacy Act / CPRA
California 2020-01-01Most comprehensive US state privacy law. Right to know, delete, opt out of sale. CPRA added correction rights, CPPA agency, data minimization.
Colorado Privacy Act
Colorado 2023-07-01Comprehensive privacy law with universal opt-out mechanism requirement via browser/device settings.
Connecticut Data Privacy Act
Connecticut 2023-07-01Modeled after VA/CO. Universal opt-out signals and consent for sensitive data.
Delaware Personal Data Privacy Act
Delaware 2025-01-01Strong with children data protections. Applies to nonprofits.
Florida Digital Bill of Rights
Florida 2024-07-01Narrowly scoped ($1B+ revenue). Focus on children under 18.
Indiana Consumer Data Protection Act
Indiana 2026-01-01Virginia model with standard consumer rights.
Iowa Consumer Data Protection Act
Iowa 2025-01-01Business-friendly with permanent 90-day cure period.
Kentucky Consumer Data Protection Act
Kentucky 2026-01-01Virginia model privacy law.
Maryland Online Data Privacy Act
Maryland 2025-10-01Among strongest. Data minimization by default. No minor data sales.
Minnesota Consumer Data Privacy Act
Minnesota 2025-07-31Strong with enhanced minor protections and data minimization.
Montana Consumer Data Privacy Act
Montana 2024-10-01Lowest population threshold nationally (50K consumers).
Nebraska Data Privacy Act
Nebraska 2025-01-01No revenue or processing threshold — broadest applicability.
New Hampshire Privacy Act
New Hampshire 2025-01-01Connecticut model with universal opt-out.
New Jersey Data Privacy Act
New Jersey 2025-01-15Strong with financial data protections and universal opt-out.
Oregon Consumer Privacy Act
Oregon 2024-07-01Strong law with no revenue thresholds. One of few applying to nonprofits.
Rhode Island Data Transparency and Privacy Protection Act
Rhode Island 2026-01-01Notable for third-party disclosure requirements.
Tennessee Information Protection Act
Tennessee 2025-07-01Affirmative defense for NIST-compliant privacy programs.
Texas Data Privacy and Security Act
Texas 2024-07-01Broadest applicability — no revenue or consumer count thresholds.
Utah Consumer Privacy Act
Utah 2023-12-31Business-friendly with narrower scope. No universal opt-out requirement.
Vermont Data Privacy Act
Vermont 2025-07-01Private right of action — only 2nd state after CA allowing consumer lawsuits.
Virginia Consumer Data Protection Act
Virginia 2023-01-01Second comprehensive state privacy law. Consumer rights to access, correct, delete, and opt out.
Frequently Asked Questions
What is the current status of data privacy regulation in the US?
As of 2024, 21 states have enacted data privacy regulations, with 0 additional states considering pending legislation. The regulatory landscape is evolving rapidly as more states act independently of federal policy.
How often is this data updated?
PlainRegWatch updates regulation data on a rolling basis as new laws are enacted, amended, or proposed. Each regulation entry includes source links for independent verification. Most state legislative sessions run January through June.
Does this data constitute legal advice?
No. This is informational data compiled from official sources. Always consult a qualified attorney or compliance professional for legal advice specific to your situation. Regulations change frequently and our summaries may not capture every nuance.
Related Guides
Related
Disclaimer: This information is provided for informational purposes only and does not constitute professional advice. Data is sourced from official state regulatory sources. Consult a qualified professional before making decisions based on this data.
Read our methodology - how this data is sourced, computed, and verified.
Every figure on PlainRegWatch is rendered directly from state source data, no number is typed in by an editor. This page draws directly on federal and state source data, no figure is typed in by an editor. See our editorial standards & corrections policy, the methodology behind these numbers, or report a data error.