US State Privacy Laws
The 23 comprehensive US state consumer privacy laws, state by state and topic by topic. Every statement names its statute section and links to the official text.
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Reference material, not legal advice. About this navigator
Comprehensive state privacy laws
In order of entry into force. Laws enacted but not yet in force show the date they take effect.
| State | Law | Citation | In force | Official text |
|---|---|---|---|---|
| California | California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act, Proposition 24) | Cal. Civ. Code §§ 1798.100 to 1798.199.100; Cal. Code Regs. tit. 11, § 7000 et seq. | January 1, 2020 | Statute |
| Virginia | Virginia Consumer Data Protection Act | Va. Code Ann. §§ 59.1-575 to 59.1-584 | January 1, 2023 | Statute |
| Colorado | Colorado Privacy Act | C.R.S. §§ 6-1-1301 to 6-1-1314 | July 1, 2023 | Statute |
| Connecticut | Connecticut Data Privacy Act (An Act Concerning Personal Data Privacy and Online Monitoring) | Conn. Gen. Stat. §§ 42-515 to 42-526 (minors: §§ 42-529 to 42-529e) | July 1, 2023 | Statute |
| Utah | Utah Consumer Privacy Act | Utah Code §§ 13-61-101 to 13-61-404 (Part 5, §§ 13-61-501 to 13-61-504, from 1 January 2027) | December 31, 2023 | Statute |
| Oregon | Oregon Consumer Privacy Act | ORS 646A.570 to 646A.589 | July 1, 2024 | Statute |
| Texas | Texas Data Privacy and Security Act | Tex. Bus. & Com. Code §§ 541.001 to 541.205 | July 1, 2024 | Statute |
| Montana | Montana Consumer Data Privacy Act | Mont. Code Ann. §§ 30-14-2801 to 30-14-2820 | October 1, 2024 | Statute |
| Delaware | Delaware Personal Data Privacy Act | Del. Code Ann. tit. 6, §§ 12D-101 to 12D-111 | January 1, 2025 | Statute |
| Iowa | Iowa Consumer Data Protection Act (Iowa Code chapter 715D) | Iowa Code §§ 715D.1 to 715D.9 | January 1, 2025 | Statute |
| Nebraska | Nebraska Data Privacy Act | Neb. Rev. Stat. §§ 87-1101 to 87-1130 | January 1, 2025 | Statute |
| New Hampshire | New Hampshire Expectation of Privacy Act (RSA chapter 507-H) | N.H. Rev. Stat. Ann. §§ 507-H:1 to 507-H:12 | January 1, 2025 | Statute |
| New Jersey | New Jersey Data Privacy Act | N.J.S.A. 56:8-166.4 to 56:8-166.19 (P.L.2023, c.266), with N.J.S.A. 56:8-166.20 to 56:8-166.24 (P.L.2026, c.25) | January 15, 2025 | Statute |
| Tennessee | Tennessee Information Protection Act | Tenn. Code Ann. §§ 47-18-3301 to 47-18-3314 | July 1, 2025 | Statute |
| Minnesota | Minnesota Consumer Data Privacy Act | Minn. Stat. §§ 325M.10 to 325M.21 | July 31, 2025 | Statute |
| Maryland | Maryland Online Data Privacy Act | Md. Code Ann., Com. Law §§ 14-4701 to 14-4714 (enacted as §§ 14-4601 to 14-4614) | October 1, 2025 | Statute |
| Indiana | Indiana Consumer Data Protection Act | Ind. Code §§ 24-15-1-1 to 24-15-11-2 | January 1, 2026 | Statute |
| Kentucky | Kentucky Consumer Data Protection Act | KRS 367.3611 to 367.3629 | January 1, 2026 | Statute |
| Rhode Island | Rhode Island Data Transparency and Privacy Protection Act | R.I. Gen. Laws §§ 6-48.1-1 to 6-48.1-10 | January 1, 2026 | Statute |
| Louisiana | Louisiana Data Privacy Act | La. R.S. 51:1780.1 to 1780.5 (Chapter 20-B of Title 51, enacted by Act No. 502 of the 2026 Regular Session) | Enacted, in force January 1, 2027 | Statute |
| Oklahoma | Oklahoma consumer data privacy act (Enrolled Senate Bill 546; the act gives itself no short title) | Okla. Stat. tit. 75A, §§ 300 to 320 (to be codified by SB 546 (2026), Secs. 1 to 21) | Enacted, in force January 1, 2027 | Statute |
| Alabama | Alabama Personal Data Protection Act | Ala. Code §§ 8-44-1 to 8-44-11 (Act 2026-552, §§ 1 to 11) | Enacted, in force May 1, 2027 | Statute |
| Vermont | Vermont Data Privacy and Online Surveillance Act | 9 V.S.A. §§ 2415a to 2415k (9 V.S.A. chapter 61A, subchapter 1, added by 2026 Act 145, Sec. 1) | Enacted, in force January 1, 2028 | Statute |
Narrower laws
Laws that are narrower in scope than the comprehensive laws. See each law's applicability page.