{"type":"index","name":"US State Privacy Laws","publisher":{"name":"DPO School","url":"https://dposchool.com"},"url":"https://dposchool.com/state-privacy-laws","asOf":"2026-10-28","counts":{"comprehensiveLaws":23,"narrowerLaws":1,"topics":6},"topics":[{"id":"applicability","name":"Applicability","description":"Who the law applies to: thresholds, exemptions and nonprofits.","url":"https://dposchool.com/state-privacy-laws/topic/applicability","json":"https://dposchool.com/state-privacy-laws/api/v1/topics/applicability.json"},{"id":"consumer-rights","name":"Consumer rights","description":"The rights consumers have, response deadlines and appeals.","url":"https://dposchool.com/state-privacy-laws/topic/consumer-rights","json":"https://dposchool.com/state-privacy-laws/api/v1/topics/consumer-rights.json"},{"id":"sensitive-data","name":"Sensitive data","description":"How sensitive data and children's and teens' data are treated.","url":"https://dposchool.com/state-privacy-laws/topic/sensitive-data","json":"https://dposchool.com/state-privacy-laws/api/v1/topics/sensitive-data.json"},{"id":"controller-duties","name":"Controller duties","description":"Notices, opt-out signals, data protection assessments and minimization.","url":"https://dposchool.com/state-privacy-laws/topic/controller-duties","json":"https://dposchool.com/state-privacy-laws/api/v1/topics/controller-duties.json"},{"id":"processors","name":"Processors","description":"What processors must do and what the contract with them must say.","url":"https://dposchool.com/state-privacy-laws/topic/processors","json":"https://dposchool.com/state-privacy-laws/api/v1/topics/processors.json"},{"id":"enforcement","name":"Enforcement","description":"Who enforces the law, cure periods, penalties and private actions.","url":"https://dposchool.com/state-privacy-laws/topic/enforcement","json":"https://dposchool.com/state-privacy-laws/api/v1/topics/enforcement.json"}],"states":[{"id":"CA","slug":"california","name":"California","category":"comprehensive","lawName":"California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act, Proposition 24)","citation":"Cal. Civ. Code §§ 1798.100 to 1798.199.100; Cal. Code Regs. tit. 11, § 7000 et seq.","officialUrl":"https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.","enacted":null,"inForce":"2020-01-01","url":"https://dposchool.com/state-privacy-laws/state/california","json":"https://dposchool.com/state-privacy-laws/api/v1/states/ca.json"},{"id":"VA","slug":"virginia","name":"Virginia","category":"comprehensive","lawName":"Virginia Consumer Data Protection Act","citation":"Va. Code Ann. §§ 59.1-575 to 59.1-584","officialUrl":"https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/","enacted":"2021-03-02","inForce":"2023-01-01","url":"https://dposchool.com/state-privacy-laws/state/virginia","json":"https://dposchool.com/state-privacy-laws/api/v1/states/va.json"},{"id":"CO","slug":"colorado","name":"Colorado","category":"comprehensive","lawName":"Colorado Privacy Act","citation":"C.R.S. §§ 6-1-1301 to 6-1-1314","officialUrl":"https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf","enacted":"2021-07-07","inForce":"2023-07-01","url":"https://dposchool.com/state-privacy-laws/state/colorado","json":"https://dposchool.com/state-privacy-laws/api/v1/states/co.json"},{"id":"CT","slug":"connecticut","name":"Connecticut","category":"comprehensive","lawName":"Connecticut Data Privacy Act (An Act Concerning Personal Data Privacy and Online Monitoring)","citation":"Conn. Gen. Stat. §§ 42-515 to 42-526 (minors: §§ 42-529 to 42-529e)","officialUrl":"https://www.cga.ct.gov/current/pub/chap_743jj.htm","enacted":"2022-05-10","inForce":"2023-07-01","url":"https://dposchool.com/state-privacy-laws/state/connecticut","json":"https://dposchool.com/state-privacy-laws/api/v1/states/ct.json"},{"id":"UT","slug":"utah","name":"Utah","category":"comprehensive","lawName":"Utah Consumer Privacy Act","citation":"Utah Code §§ 13-61-101 to 13-61-404 (Part 5, §§ 13-61-501 to 13-61-504, from 1 January 2027)","officialUrl":"https://le.utah.gov/xcode/Title13/Chapter61/13-61.html","enacted":"2022-03-24","inForce":"2023-12-31","url":"https://dposchool.com/state-privacy-laws/state/utah","json":"https://dposchool.com/state-privacy-laws/api/v1/states/ut.json"},{"id":"OR","slug":"oregon","name":"Oregon","category":"comprehensive","lawName":"Oregon Consumer Privacy Act","citation":"ORS 646A.570 to 646A.589","officialUrl":"https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html","enacted":"2023-07-18","inForce":"2024-07-01","url":"https://dposchool.com/state-privacy-laws/state/oregon","json":"https://dposchool.com/state-privacy-laws/api/v1/states/or.json"},{"id":"TX","slug":"texas","name":"Texas","category":"comprehensive","lawName":"Texas Data Privacy and Security Act","citation":"Tex. Bus. & Com. Code §§ 541.001 to 541.205","officialUrl":"https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm","enacted":"2023-06-18","inForce":"2024-07-01","url":"https://dposchool.com/state-privacy-laws/state/texas","json":"https://dposchool.com/state-privacy-laws/api/v1/states/tx.json"},{"id":"MT","slug":"montana","name":"Montana","category":"comprehensive","lawName":"Montana Consumer Data Privacy Act","citation":"Mont. Code Ann. §§ 30-14-2801 to 30-14-2820","officialUrl":"https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html","enacted":null,"inForce":"2024-10-01","url":"https://dposchool.com/state-privacy-laws/state/montana","json":"https://dposchool.com/state-privacy-laws/api/v1/states/mt.json"},{"id":"DE","slug":"delaware","name":"Delaware","category":"comprehensive","lawName":"Delaware Personal Data Privacy Act","citation":"Del. Code Ann. tit. 6, §§ 12D-101 to 12D-111","officialUrl":"https://delcode.delaware.gov/title6/c012d/index.html","enacted":"2023-09-11","inForce":"2025-01-01","url":"https://dposchool.com/state-privacy-laws/state/delaware","json":"https://dposchool.com/state-privacy-laws/api/v1/states/de.json"},{"id":"IA","slug":"iowa","name":"Iowa","category":"comprehensive","lawName":"Iowa Consumer Data Protection Act (Iowa Code chapter 715D)","citation":"Iowa Code §§ 715D.1 to 715D.9","officialUrl":"https://www.legis.iowa.gov/docs/code/715D.pdf","enacted":"2023-03-28","inForce":"2025-01-01","url":"https://dposchool.com/state-privacy-laws/state/iowa","json":"https://dposchool.com/state-privacy-laws/api/v1/states/ia.json"},{"id":"NE","slug":"nebraska","name":"Nebraska","category":"comprehensive","lawName":"Nebraska Data Privacy Act","citation":"Neb. Rev. Stat. §§ 87-1101 to 87-1130","officialUrl":"https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101","enacted":"2024-04-17","inForce":"2025-01-01","url":"https://dposchool.com/state-privacy-laws/state/nebraska","json":"https://dposchool.com/state-privacy-laws/api/v1/states/ne.json"},{"id":"NH","slug":"new-hampshire","name":"New Hampshire","category":"comprehensive","lawName":"New Hampshire Expectation of Privacy Act (RSA chapter 507-H)","citation":"N.H. Rev. Stat. Ann. §§ 507-H:1 to 507-H:12","officialUrl":"https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm","enacted":null,"inForce":"2025-01-01","url":"https://dposchool.com/state-privacy-laws/state/new-hampshire","json":"https://dposchool.com/state-privacy-laws/api/v1/states/nh.json"},{"id":"NJ","slug":"new-jersey","name":"New Jersey","category":"comprehensive","lawName":"New Jersey Data Privacy Act","citation":"N.J.S.A. 56:8-166.4 to 56:8-166.19 (P.L.2023, c.266), with N.J.S.A. 56:8-166.20 to 56:8-166.24 (P.L.2026, c.25)","officialUrl":"https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM","enacted":"2024-01-16","inForce":"2025-01-15","url":"https://dposchool.com/state-privacy-laws/state/new-jersey","json":"https://dposchool.com/state-privacy-laws/api/v1/states/nj.json"},{"id":"TN","slug":"tennessee","name":"Tennessee","category":"comprehensive","lawName":"Tennessee Information Protection Act","citation":"Tenn. Code Ann. §§ 47-18-3301 to 47-18-3314","officialUrl":"https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf","enacted":"2023-05-11","inForce":"2025-07-01","url":"https://dposchool.com/state-privacy-laws/state/tennessee","json":"https://dposchool.com/state-privacy-laws/api/v1/states/tn.json"},{"id":"MN","slug":"minnesota","name":"Minnesota","category":"comprehensive","lawName":"Minnesota Consumer Data Privacy Act","citation":"Minn. Stat. §§ 325M.10 to 325M.21","officialUrl":"https://www.revisor.mn.gov/statutes/cite/325M.10","enacted":"2024-05-24","inForce":"2025-07-31","url":"https://dposchool.com/state-privacy-laws/state/minnesota","json":"https://dposchool.com/state-privacy-laws/api/v1/states/mn.json"},{"id":"MD","slug":"maryland","name":"Maryland","category":"comprehensive","lawName":"Maryland Online Data Privacy Act","citation":"Md. Code Ann., Com. Law §§ 14-4701 to 14-4714 (enacted as §§ 14-4601 to 14-4614)","officialUrl":"https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4701&enactments=false","enacted":"2024-05-09","inForce":"2025-10-01","url":"https://dposchool.com/state-privacy-laws/state/maryland","json":"https://dposchool.com/state-privacy-laws/api/v1/states/md.json"},{"id":"IN","slug":"indiana","name":"Indiana","category":"comprehensive","lawName":"Indiana Consumer Data Protection Act","citation":"Ind. Code §§ 24-15-1-1 to 24-15-11-2","officialUrl":"https://iga.in.gov/ic/2026/Title_24.pdf","enacted":null,"inForce":"2026-01-01","url":"https://dposchool.com/state-privacy-laws/state/indiana","json":"https://dposchool.com/state-privacy-laws/api/v1/states/in.json"},{"id":"KY","slug":"kentucky","name":"Kentucky","category":"comprehensive","lawName":"Kentucky Consumer Data Protection Act","citation":"KRS 367.3611 to 367.3629","officialUrl":"https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=39092","enacted":"2024-04-04","inForce":"2026-01-01","url":"https://dposchool.com/state-privacy-laws/state/kentucky","json":"https://dposchool.com/state-privacy-laws/api/v1/states/ky.json"},{"id":"RI","slug":"rhode-island","name":"Rhode Island","category":"comprehensive","lawName":"Rhode Island Data Transparency and Privacy Protection Act","citation":"R.I. Gen. Laws §§ 6-48.1-1 to 6-48.1-10","officialUrl":"https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm","enacted":"2024-06-28","inForce":"2026-01-01","url":"https://dposchool.com/state-privacy-laws/state/rhode-island","json":"https://dposchool.com/state-privacy-laws/api/v1/states/ri.json"},{"id":"LA","slug":"louisiana","name":"Louisiana","category":"comprehensive","lawName":"Louisiana Data Privacy Act","citation":"La. R.S. 51:1780.1 to 1780.5 (Chapter 20-B of Title 51, enacted by Act No. 502 of the 2026 Regular Session)","officialUrl":"https://legis.la.gov/legis/ViewDocument.aspx?d=1480202","enacted":"2026-05-29","inForce":"2027-01-01","url":"https://dposchool.com/state-privacy-laws/state/louisiana","json":"https://dposchool.com/state-privacy-laws/api/v1/states/la.json"},{"id":"OK","slug":"oklahoma","name":"Oklahoma","category":"comprehensive","lawName":"Oklahoma consumer data privacy act (Enrolled Senate Bill 546; the act gives itself no short title)","citation":"Okla. Stat. tit. 75A, §§ 300 to 320 (to be codified by SB 546 (2026), Secs. 1 to 21)","officialUrl":"https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf","enacted":"2026-03-20","inForce":"2027-01-01","url":"https://dposchool.com/state-privacy-laws/state/oklahoma","json":"https://dposchool.com/state-privacy-laws/api/v1/states/ok.json"},{"id":"AL","slug":"alabama","name":"Alabama","category":"comprehensive","lawName":"Alabama Personal Data Protection Act","citation":"Ala. Code §§ 8-44-1 to 8-44-11 (Act 2026-552, §§ 1 to 11)","officialUrl":"https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf","enacted":"2026-04-16","inForce":"2027-05-01","url":"https://dposchool.com/state-privacy-laws/state/alabama","json":"https://dposchool.com/state-privacy-laws/api/v1/states/al.json"},{"id":"VT","slug":"vermont","name":"Vermont","category":"comprehensive","lawName":"Vermont Data Privacy and Online Surveillance Act","citation":"9 V.S.A. §§ 2415a to 2415k (9 V.S.A. chapter 61A, subchapter 1, added by 2026 Act 145, Sec. 1)","officialUrl":"https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf","enacted":"2026-06-16","inForce":"2028-01-01","url":"https://dposchool.com/state-privacy-laws/state/vermont","json":"https://dposchool.com/state-privacy-laws/api/v1/states/vt.json"}],"narrowerLaws":[{"id":"FL","slug":"florida","name":"Florida","category":"narrower","lawName":"Florida Digital Bill of Rights","citation":"Fla. Stat. §§ 501.701 to 501.722 (ch. 501, part V)","officialUrl":"http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501PartVContentsIndex.html","enacted":"2023-06-06","inForce":"2024-07-01","url":"https://dposchool.com/state-privacy-laws/state/florida","json":"https://dposchool.com/state-privacy-laws/api/v1/states/fl.json"}],"source":"Statute and session-law text from the official legislature sites (public domain), agency regulations and guidance from the agencies' own sites; no publisher annotations.","review":{"status":"reviewed","reviewedBy":{"name":"Sergio Maldonado Elvira","title":"Principal Attorney","url":"https://northend.law/leadership"},"lastReviewed":"2026-10-29","note":"Prepared from the official legislature and agency sources listed. Reviewed by Sergio Maldonado Elvira on 29 October 2026.","about":"https://dposchool.com/state-privacy-laws/about#review"},"disclaimer":"Reference material, not legal advice. Verify against the official text of each statute."}