{"type":"topic-comparison","id":"enforcement","name":"Enforcement","description":"Who enforces the law, cure periods, penalties and private actions.","url":"https://dposchool.com/state-privacy-laws/topic/enforcement","columns":[{"key":"enforcer","label":"Enforcer"},{"key":"cureDays","label":"Cure period (days)"},{"key":"cureSunset","label":"Cure period ends"},{"key":"penaltyMax","label":"Maximum civil penalty"},{"key":"privateRight","label":"Private right of action"}],"rows":[{"state":{"id":"CA","name":"California","category":"comprehensive","url":"https://dposchool.com/state-privacy-laws/state/california/enforcement","json":"https://dposchool.com/state-privacy-laws/api/v1/states/ca/enforcement.json"},"cells":{"enforcer":{"value":"CPPA and AG","section":"Cal. Civ. Code §§ 1798.155, 1798.199.90"},"cureDays":{"value":null,"section":"Cal. Civ. Code § 1798.199.45(a)"},"cureSunset":{"value":"none","section":"Cal. Civ. Code § 1798.199.45(a)"},"penaltyMax":{"value":"$2,663 per violation; $7,988 intentional or minors under 16 (from 2025-01-01)","section":"Cal. Civ. Code §§ 1798.155(a), 1798.199.90(a)"},"privateRight":{"value":"limited (breach)","section":"Cal. Civ. Code § 1798.150"}}},{"state":{"id":"VA","name":"Virginia","category":"comprehensive","url":"https://dposchool.com/state-privacy-laws/state/virginia/enforcement","json":"https://dposchool.com/state-privacy-laws/api/v1/states/va/enforcement.json"},"cells":{"enforcer":{"value":"AG","section":"§ 59.1-584(A)"},"cureDays":{"value":30,"section":"§ 59.1-584(B)"},"cureSunset":{"value":"none","section":"§ 59.1-584(B)"},"penaltyMax":{"value":"$7,500 per violation","section":"§ 59.1-584(C)"},"privateRight":{"value":"no","section":"§ 59.1-584(E)"}}},{"state":{"id":"CO","name":"Colorado","category":"comprehensive","url":"https://dposchool.com/state-privacy-laws/state/colorado/enforcement","json":"https://dposchool.com/state-privacy-laws/api/v1/states/co/enforcement.json"},"cells":{"enforcer":{"value":"AG and district attorneys","section":"C.R.S. § 6-1-1311(1)(a)"},"cureDays":{"value":60,"section":"C.R.S. § 6-1-1311(1)(d)"},"cureSunset":{"value":"2025-01-01","section":"C.R.S. § 6-1-1311(1)(d)(I)"},"penaltyMax":{"value":"$20,000 per violation ($50,000 if against an elderly person)","section":"C.R.S. § 6-1-112(1)(a), (c)"},"privateRight":{"value":"no","section":"C.R.S. § 6-1-1310(1)"}}},{"state":{"id":"CT","name":"Connecticut","category":"comprehensive","url":"https://dposchool.com/state-privacy-laws/state/connecticut/enforcement","json":"https://dposchool.com/state-privacy-laws/api/v1/states/ct/enforcement.json"},"cells":{"enforcer":{"value":"AG","section":"Conn. Gen. Stat. § 42-525(a)"},"cureDays":{"value":60,"section":"Conn. Gen. Stat. § 42-525(b)"},"cureSunset":{"value":"2024-12-31","section":"Conn. Gen. Stat. § 42-525(b) to (c)"},"penaltyMax":{"value":"$5,000 per wilful violation (CUTPA)","section":"Conn. Gen. Stat. § 42-110o(b)"},"privateRight":{"value":"no","section":"Conn. Gen. Stat. § 42-525(d)"}}},{"state":{"id":"UT","name":"Utah","category":"comprehensive","url":"https://dposchool.com/state-privacy-laws/state/utah/enforcement","json":"https://dposchool.com/state-privacy-laws/api/v1/states/ut/enforcement.json"},"cells":{"enforcer":{"value":"AG","section":"§ 13-61-402(1)"},"cureDays":{"value":30,"section":"§ 13-61-402(3)"},"cureSunset":{"value":"none","section":"§ 13-61-402(3)"},"penaltyMax":{"value":"$7,500 per violation plus actual damages","section":"§ 13-61-402(3)(d)"},"privateRight":{"value":"no","section":"§ 13-61-305"}}},{"state":{"id":"OR","name":"Oregon","category":"comprehensive","url":"https://dposchool.com/state-privacy-laws/state/oregon/enforcement","json":"https://dposchool.com/state-privacy-laws/api/v1/states/or/enforcement.json"},"cells":{"enforcer":{"value":"AG","section":"ORS 646A.589(7)"},"cureDays":{"value":null,"section":"2025 c.417 § 5"},"cureSunset":{"value":"2026-01-01","section":"2025 c.417 § 5(2)"},"penaltyMax":{"value":"$7,500 per violation","section":"ORS 646A.589(4)(a)"},"privateRight":{"value":"no","section":"ORS 646A.589(7)"}}},{"state":{"id":"TX","name":"Texas","category":"comprehensive","url":"https://dposchool.com/state-privacy-laws/state/texas/enforcement","json":"https://dposchool.com/state-privacy-laws/api/v1/states/tx/enforcement.json"},"cells":{"enforcer":{"value":"AG","section":"§ 541.151"},"cureDays":{"value":30,"section":"§ 541.154"},"cureSunset":{"value":"none","section":"§ 541.154"},"penaltyMax":{"value":"$7,500 per violation","section":"§ 541.155(a)"},"privateRight":{"value":"no","section":"§ 541.156"}}},{"state":{"id":"MT","name":"Montana","category":"comprehensive","url":"https://dposchool.com/state-privacy-laws/state/montana/enforcement","json":"https://dposchool.com/state-privacy-laws/api/v1/states/mt/enforcement.json"},"cells":{"enforcer":{"value":"AG","section":"§ 30-14-2817(1)"},"cureDays":{"value":null,"section":"§ 30-14-2817"},"cureSunset":{"value":"2025-10-01","section":"§ 30-14-2817"},"penaltyMax":{"value":"$7,500 per violation","section":"§ 30-14-2820(2)"},"privateRight":{"value":"no","section":"§ 30-14-2817(5)"}}},{"state":{"id":"DE","name":"Delaware","category":"comprehensive","url":"https://dposchool.com/state-privacy-laws/state/delaware/enforcement","json":"https://dposchool.com/state-privacy-laws/api/v1/states/de/enforcement.json"},"cells":{"enforcer":{"value":"AG (Department of Justice)","section":"§ 12D-111(a)"},"cureDays":{"value":60,"section":"§ 12D-111(b)"},"cureSunset":{"value":"2025-12-31","section":"§ 12D-111(b), (c)"},"penaltyMax":{"value":"$10,000 per wilful violation","section":"§ 12D-111(e); Del. Code Ann. tit. 6, § 2522(b)"},"privateRight":{"value":"no","section":"§ 12D-111(d)"}}},{"state":{"id":"IA","name":"Iowa","category":"comprehensive","url":"https://dposchool.com/state-privacy-laws/state/iowa/enforcement","json":"https://dposchool.com/state-privacy-laws/api/v1/states/ia/enforcement.json"},"cells":{"enforcer":{"value":"AG","section":"§ 715D.8(1)"},"cureDays":{"value":90,"section":"§ 715D.8(2)"},"cureSunset":{"value":"none","section":"§ 715D.8(2)"},"penaltyMax":{"value":"$7,500 per violation","section":"§ 715D.8(3)"},"privateRight":{"value":"no","section":"§ 715D.8(4)"}}},{"state":{"id":"NE","name":"Nebraska","category":"comprehensive","url":"https://dposchool.com/state-privacy-laws/state/nebraska/enforcement","json":"https://dposchool.com/state-privacy-laws/api/v1/states/ne/enforcement.json"},"cells":{"enforcer":{"value":"AG","section":"§ 87-1119"},"cureDays":{"value":30,"section":"§ 87-1122"},"cureSunset":{"value":"none","section":"§ 87-1122"},"penaltyMax":{"value":"$7,500 per violation","section":"§ 87-1124(1)"},"privateRight":{"value":"no","section":"§ 87-1125"}}},{"state":{"id":"NH","name":"New Hampshire","category":"comprehensive","url":"https://dposchool.com/state-privacy-laws/state/new-hampshire/enforcement","json":"https://dposchool.com/state-privacy-laws/api/v1/states/nh/enforcement.json"},"cells":{"enforcer":{"value":"AG","section":"RSA 507-H:11, I"},"cureDays":{"value":60,"section":"RSA 507-H:11, II"},"cureSunset":{"value":"2025-12-31","section":"RSA 507-H:11, II-III"},"penaltyMax":{"value":"$10,000 per violation","section":"RSA 507-H:11, V; RSA 358-A:4, III(b)"},"privateRight":{"value":"no","section":"RSA 507-H:11, IV"}}},{"state":{"id":"NJ","name":"New Jersey","category":"comprehensive","url":"https://dposchool.com/state-privacy-laws/state/new-jersey/enforcement","json":"https://dposchool.com/state-privacy-laws/api/v1/states/nj/enforcement.json"},"cells":{"enforcer":{"value":"AG (Division of Consumer Affairs)","section":"C.56:8-166.19"},"cureDays":{"value":30,"section":"C.56:8-166.17(b)"},"cureSunset":{"value":"2026-07-01","section":"C.56:8-166.17(b)"},"penaltyMax":{"value":"$10,000 first offence, $20,000 later offences (Consumer Fraud Act); $50,000 per record for selling sensitive data","section":"N.J.S.A. 56:8-13; C.56:8-166.23"},"privateRight":{"value":"no","section":"C.56:8-166.19"}}},{"state":{"id":"TN","name":"Tennessee","category":"comprehensive","url":"https://dposchool.com/state-privacy-laws/state/tennessee/enforcement","json":"https://dposchool.com/state-privacy-laws/api/v1/states/tn/enforcement.json"},"cells":{"enforcer":{"value":"AG","section":"Tenn. Code Ann. § 47-18-3313(a)"},"cureDays":{"value":60,"section":"Tenn. Code Ann. § 47-18-3313(b)"},"cureSunset":{"value":"none","section":"Tenn. Code Ann. § 47-18-3313(b)"},"penaltyMax":{"value":"$7,500 per violation (treble for wilful or knowing violations)","section":"Tenn. Code Ann. § 47-18-3313(d)"},"privateRight":{"value":"no","section":"Tenn. Code Ann. § 47-18-3313(e)"}}},{"state":{"id":"MN","name":"Minnesota","category":"comprehensive","url":"https://dposchool.com/state-privacy-laws/state/minnesota/enforcement","json":"https://dposchool.com/state-privacy-laws/api/v1/states/mn/enforcement.json"},"cells":{"enforcer":{"value":"AG","section":"§ 325M.20(b)"},"cureDays":{"value":30,"section":"§ 325M.20(a)"},"cureSunset":{"value":"2026-01-31","section":"§ 325M.20(a)"},"penaltyMax":{"value":"$7,500 per violation","section":"§ 325M.20(c)"},"privateRight":{"value":"no","section":"§ 325M.20(d)"}}},{"state":{"id":"MD","name":"Maryland","category":"comprehensive","url":"https://dposchool.com/state-privacy-laws/state/maryland/enforcement","json":"https://dposchool.com/state-privacy-laws/api/v1/states/md/enforcement.json"},"cells":{"enforcer":{"value":"AG (Consumer Protection Division)","section":"§ 14-4713"},"cureDays":{"value":60,"section":"§ 14-4714(c)"},"cureSunset":{"value":"2027-04-01","section":"§ 14-4714(a)"},"penaltyMax":{"value":"$10,000 per violation; $25,000 per repeated violation","section":"§ 13-410"},"privateRight":{"value":"no","section":"§ 14-4713(a)(2)"}}},{"state":{"id":"IN","name":"Indiana","category":"comprehensive","url":"https://dposchool.com/state-privacy-laws/state/indiana/enforcement","json":"https://dposchool.com/state-privacy-laws/api/v1/states/in/enforcement.json"},"cells":{"enforcer":{"value":"AG","section":"IC 24-15-10-1"},"cureDays":{"value":30,"section":"IC 24-15-10-3"},"cureSunset":{"value":"none","section":"IC 24-15-10-3"},"penaltyMax":{"value":"$7,500 per violation","section":"IC 24-15-10-2(a)"},"privateRight":{"value":"no","section":"IC 24-15-10-4"}}},{"state":{"id":"KY","name":"Kentucky","category":"comprehensive","url":"https://dposchool.com/state-privacy-laws/state/kentucky/enforcement","json":"https://dposchool.com/state-privacy-laws/api/v1/states/ky/enforcement.json"},"cells":{"enforcer":{"value":"AG","section":"KRS 367.3627(1)"},"cureDays":{"value":30,"section":"KRS 367.3627(2)"},"cureSunset":{"value":"none","section":"KRS 367.3627(2)"},"penaltyMax":{"value":"$7,500 per continued violation","section":"KRS 367.3627(3)"},"privateRight":{"value":"no","section":"KRS 367.3627(4)"}}},{"state":{"id":"RI","name":"Rhode Island","category":"comprehensive","url":"https://dposchool.com/state-privacy-laws/state/rhode-island/enforcement","json":"https://dposchool.com/state-privacy-laws/api/v1/states/ri/enforcement.json"},"cells":{"enforcer":{"value":"AG","section":"§ 6-48.1-8(b)"},"cureDays":{"value":null,"section":"§ 6-48.1-8"},"cureSunset":{"value":"none","section":"§ 6-48.1-8"},"penaltyMax":{"value":"$10,000 per violation (deceptive trade practice), plus $100 to $500 per unlawful disclosure","section":"§ 6-13.1-8; § 6-48.1-8(a)"},"privateRight":{"value":"no","section":"§ 6-48.1-8(c)"}}},{"state":{"id":"LA","name":"Louisiana","category":"comprehensive","url":"https://dposchool.com/state-privacy-laws/state/louisiana/enforcement","json":"https://dposchool.com/state-privacy-laws/api/v1/states/la/enforcement.json"},"cells":{"enforcer":{"value":"AG","section":"La. R.S. 51:1780.5(A)"},"cureDays":{"value":30,"section":"La. R.S. 51:1780.5(D)"},"cureSunset":{"value":"2027-07-31","section":"La. R.S. 51:1780.5(D)"},"penaltyMax":{"value":"$5,000 per violation where intent to defraud is found (LUTPA); extra penalty for elderly or disabled victims","section":"La. R.S. 51:1407(B), (C)"},"privateRight":{"value":"no","section":"La. R.S. 51:1780.5(C)"}}},{"state":{"id":"OK","name":"Oklahoma","category":"comprehensive","url":"https://dposchool.com/state-privacy-laws/state/oklahoma/enforcement","json":"https://dposchool.com/state-privacy-laws/api/v1/states/ok/enforcement.json"},"cells":{"enforcer":{"value":"AG","section":"SB 546 § 12(A) (75A O.S. § 311)"},"cureDays":{"value":30,"section":"SB 546 § 13 (75A O.S. § 312)"},"cureSunset":{"value":"none","section":"SB 546 § 13 (75A O.S. § 312)"},"penaltyMax":{"value":"$7,500 per violation","section":"SB 546 § 14(A) (75A O.S. § 313)"},"privateRight":{"value":"no","section":"SB 546 § 14(E) (75A O.S. § 313)"}}},{"state":{"id":"AL","name":"Alabama","category":"comprehensive","url":"https://dposchool.com/state-privacy-laws/state/alabama/enforcement","json":"https://dposchool.com/state-privacy-laws/api/v1/states/al/enforcement.json"},"cells":{"enforcer":{"value":"AG","section":"Act 2026-552, § 11(a) (Ala. Code § 8-44-11)"},"cureDays":{"value":45,"section":"Act 2026-552, § 11(b) (Ala. Code § 8-44-11)"},"cureSunset":{"value":"none","section":"Act 2026-552, § 11(b) (Ala. Code § 8-44-11)"},"penaltyMax":{"value":"$15,000 per violation","section":"Act 2026-552, § 11(b)(2) (Ala. Code § 8-44-11)"},"privateRight":{"value":"no","section":"Act 2026-552, § 11 (Ala. Code § 8-44-11)"}}},{"state":{"id":"VT","name":"Vermont","category":"comprehensive","url":"https://dposchool.com/state-privacy-laws/state/vermont/enforcement","json":"https://dposchool.com/state-privacy-laws/api/v1/states/vt/enforcement.json"},"cells":{"enforcer":{"value":"AG","section":"Act 145, Sec. 1, 9 V.S.A. § 2415j(a)"},"cureDays":{"value":60,"section":"Act 145, Sec. 3"},"cureSunset":{"value":"2029-06-30","section":"Act 145, Sec. 3"},"penaltyMax":{"value":"$10,000 per violation (Consumer Protection Act)","section":"9 V.S.A. § 2458(b)(1)"},"privateRight":{"value":"no","section":"Act 145, Sec. 1, 9 V.S.A. § 2415j(a)"}}},{"state":{"id":"FL","name":"Florida","category":"narrower","url":"https://dposchool.com/state-privacy-laws/state/florida/enforcement","json":"https://dposchool.com/state-privacy-laws/api/v1/states/fl/enforcement.json"},"cells":{"enforcer":{"value":"AG (Department of Legal Affairs)","section":"Fla. Stat. § 501.72(1)"},"cureDays":{"value":45,"section":"Fla. Stat. § 501.72(2)"},"cureSunset":{"value":"none","section":"Fla. Stat. § 501.72(2)"},"penaltyMax":{"value":"$50,000 per violation (tripled in listed cases)","section":"Fla. Stat. § 501.72(1)"},"privateRight":{"value":"no","section":"Fla. Stat. § 501.72(8)"}}}],"nullMeans":"A null value means the law has no such test, period or right.","asOf":"2026-10-28","review":{"status":"reviewed","reviewedBy":{"name":"Sergio Maldonado Elvira","title":"Principal Attorney","url":"https://northend.law/leadership"},"lastReviewed":"2026-10-29","note":"Prepared from the official legislature and agency sources listed. Reviewed by Sergio Maldonado Elvira on 29 October 2026.","about":"https://dposchool.com/state-privacy-laws/about#review"},"relatedGdpr":{"note":"Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.","articles":[{"article":83,"title":"General conditions for imposing administrative fines","about":"enforcement","url":"https://dposchool.com/gdpr/article/83"}]},"disclaimer":"Reference material, not legal advice. Verify against the official text of each statute."}