DPO SchoolDPO School

Tennessee Information Protection Act

Tennessee privacy law (TIPA): consumer rights

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Consumers may confirm and access, correct, delete, obtain a portable copy of data they provided, and opt out of sale, targeted advertising and profiling with significant effects. Controllers must answer within 45 days, extendable once by 45 days, and decide appeals within 60 days. Responses are free up to twice a year.

Key points

  1. Rights: confirm and access, correct, delete, portable copy of data the consumer provided, and opt-outs of sale, targeted advertising and profiling.

    Section: Tenn. Code Ann. § 47-18-3304(a)(2)(A)-(E)

  2. A parent or legal guardian may exercise rights for a known child.

    Section: Tenn. Code Ann. § 47-18-3304(a)(1)

  3. Respond within 45 days; one 45-day extension when reasonably necessary, notified within the first 45 days with reasons.

    Section: Tenn. Code Ann. § 47-18-3304(b)(1)

  4. Responses are free up to twice a year per consumer.

    Section: Tenn. Code Ann. § 47-18-3304(b)(3)

  5. Appeals must be decided in writing within 60 days; if denied, the consumer must be told how to complain to the Attorney General.

    Section: Tenn. Code Ann. § 47-18-3304(c)

  6. Contract terms that waive or limit these rights are void.

    Section: Tenn. Code Ann. § 47-18-3305(b); Tenn. Code Ann. § 47-18-3312(a)

Sources

Compare consumer rights across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Tennessee statute

Reference material, not legal advice.