Tennessee privacy law (TIPA): overview | US State Privacy Laws, DPO School

Amendments

2026 Tenn. Pub. Acts ch. 614 (HB 2453), signed 2026-03-26, § 9 (in force July 1, 2026). Deletes the words 'or data generated from a photograph or video or audio recording' from the exclusions in the definition of biometric data, so data derived from photos or recordings can now be biometric (and so sensitive) data.

Topics

ApplicabilityThe Act applies only to persons doing business in Tennessee or targeting its residents that have more than $25 million in revenue and that either handle personal information of at least 175,000 consumers in a calendar year, or handle data of at least 25,000 consumers and earn more than 50% of gross revenue from selling it. Financial institutions, licensed insurers and insurance producers, HIPAA covered entities and business associates, nonprofits and higher education institutions are exempt as entities.
Consumer rightsConsumers may confirm and access, correct, delete, obtain a portable copy of data they provided, and opt out of sale, targeted advertising and profiling with significant effects. Controllers must answer within 45 days, extendable once by 45 days, and decide appeals within 60 days. Responses are free up to twice a year.
Sensitive dataSensitive data may be processed only with the consumer's opt-in consent; data of a known child (under 13) must be processed under COPPA. Since 1 Jul 2026 biometric data can include data generated from photographs or video or audio recordings. There is no separate teen rule.
Controller dutiesControllers must limit collection to what is adequate, relevant and reasonably necessary, keep reasonable security, and publish a privacy notice. Tennessee does not require controllers to honour universal opt-out signals. Data protection assessments are required for targeted advertising, sale, risky profiling, sensitive data and other high-risk processing.
ProcessorsProcessors must follow the controller's instructions and help with consumer requests and assessments. A binding contract must set out instructions, nature, purpose, data types, duration and the parties' rights and duties, and must require confidentiality, deletion or return, proof of compliance, cooperation with assessments (or an independent assessment) and subcontractor flow-down.
EnforcementThe Attorney General and Reporter enforces the Act exclusively after a permanent 60-day notice and cure period. Courts may impose civil penalties of up to $7,500 per violation and may treble the award for wilful or knowing violations. A business has an affirmative defence if it keeps and follows a written privacy program that reasonably conforms to the NIST Privacy Framework or comparable documented standards.

Sources

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Tennessee statute

Reference material, not legal advice.