--- title: "Tennessee privacy law (TIPA): overview" canonical: "https://dposchool.com/state-privacy-laws/state/tennessee" source: "https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Comprehensive state privacy law # Tennessee privacy law Tennessee Information Protection Act Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) - **Citation:** Tenn. Code Ann. §§ 47-18-3301 to 47-18-3314 - **Official text:** https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf - **Enacted:** May 11, 2023. [2023 Tenn. Pub. Acts ch. 408 (HB 1181 / SB 73)](https://wapp.capitol.tn.gov/apps/BillInfo/Default?BillNumber=HB1181&ga=113) - **In force:** July 1, 2025 - **Effective dates:** - **July 1, 2025:** main provisions (Pub. Ch. 408, § 6) - **July 1, 2024:** data protection assessments cover processing activities created or generated on or after this date, assessed once the Act is in force (Tenn. Code Ann. § 47-18-3307(f)) - **July 1, 2026:** biometric data definition widened by Pub. Ch. 614 (2026) - **Enforcer:** Attorney General and Reporter (exclusive) - **Private right of action:** No. No private right of action, including class actions, under the Act or other law (Tenn. Code Ann. § 47-18-3313(e)). - **Cure period:** 60 days. Before suing, the Attorney General must give 60 days' written notice; no action follows if the business cures and gives an express written statement that the violations are cured and will not recur. The cure period is permanent. (Tenn. Code Ann. § 47-18-3313(b)) - **Rulemaking:** No. The Act gives no rulemaking power. ## Amendments - [2026 Tenn. Pub. Acts ch. 614 (HB 2453), signed 2026-03-26, § 9](https://publications.tnsosfiles.com/acts/114/pub/pc0614.pdf) (in force July 1, 2026). Deletes the words 'or data generated from a photograph or video or audio recording' from the exclusions in the definition of biometric data, so data derived from photos or recordings can now be biometric (and so sensitive) data. ## Topics - [Applicability](https://dposchool.com/state-privacy-laws/state/tennessee/applicability): The Act applies only to persons doing business in Tennessee or targeting its residents that have more than $25 million in revenue and that either handle personal information of at least 175,000 consumers in a calendar year, or handle data of at least 25,000 consumers and earn more than 50% of gross revenue from selling it. Financial institutions, licensed insurers and insurance producers, HIPAA covered entities and business associates, nonprofits and higher education institutions are exempt as entities. - [Consumer rights](https://dposchool.com/state-privacy-laws/state/tennessee/consumer-rights): Consumers may confirm and access, correct, delete, obtain a portable copy of data they provided, and opt out of sale, targeted advertising and profiling with significant effects. Controllers must answer within 45 days, extendable once by 45 days, and decide appeals within 60 days. Responses are free up to twice a year. - [Sensitive data](https://dposchool.com/state-privacy-laws/state/tennessee/sensitive-data): Sensitive data may be processed only with the consumer's opt-in consent; data of a known child (under 13) must be processed under COPPA. Since 1 Jul 2026 biometric data can include data generated from photographs or video or audio recordings. There is no separate teen rule. - [Controller duties](https://dposchool.com/state-privacy-laws/state/tennessee/controller-duties): Controllers must limit collection to what is adequate, relevant and reasonably necessary, keep reasonable security, and publish a privacy notice. Tennessee does not require controllers to honour universal opt-out signals. Data protection assessments are required for targeted advertising, sale, risky profiling, sensitive data and other high-risk processing. - [Processors](https://dposchool.com/state-privacy-laws/state/tennessee/processors): Processors must follow the controller's instructions and help with consumer requests and assessments. A binding contract must set out instructions, nature, purpose, data types, duration and the parties' rights and duties, and must require confidentiality, deletion or return, proof of compliance, cooperation with assessments (or an independent assessment) and subcontractor flow-down. - [Enforcement](https://dposchool.com/state-privacy-laws/state/tennessee/enforcement): The Attorney General and Reporter enforces the Act exclusively after a permanent 60-day notice and cure period. Courts may impose civil penalties of up to $7,500 per violation and may treble the award for wilful or knowing violations. A business has an affirmative defence if it keeps and follows a written privacy program that reasonably conforms to the NIST Privacy Framework or comparable documented standards. ## Sources - [Public Chapter 408 (2023), enrolled HB 1181, Tennessee Information Protection Act](https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf) - [HB 1181 (113th GA) bill information: signed by Governor 05/11/2023, Pub. Ch. 408, effective 07/01/2025](https://wapp.capitol.tn.gov/apps/BillInfo/Default?BillNumber=HB1181&ga=113) - [Public Chapter 614 (2026), HB 2453, § 9 amending § 47-18-3302(3)(B)](https://publications.tnsosfiles.com/acts/114/pub/pc0614.pdf) - [HB 2453 (114th GA) bill information: signed 03/26/2026, Pub. Ch. 614](https://wapp.capitol.tn.gov/apps/BillInfo/Default?BillNumber=HB2453&ga=114) - [SB 2616 (114th GA) bill information (not enacted)](https://wapp.capitol.tn.gov/apps/BillInfo/Default?BillNumber=SB2616&ga=114) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Tennessee statute](https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf) Reference material, not legal advice. ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / Tennessee Previous: [New Jersey](https://dposchool.com/state-privacy-laws/state/new-jersey) Next: [Minnesota](https://dposchool.com/state-privacy-laws/state/minnesota) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents