DPO SchoolDPO School

Tennessee Information Protection Act

Tennessee privacy law (TIPA): sensitive data

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Sensitive data may be processed only with the consumer's opt-in consent; data of a known child (under 13) must be processed under COPPA. Since 1 Jul 2026 biometric data can include data generated from photographs or video or audio recordings. There is no separate teen rule.

Key points

  1. Sensitive data: racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data for identification, data collected from a known child, and precise geolocation.

    Section: Tenn. Code Ann. § 47-18-3302(26)

  2. Opt-in consent is required; known-child data must be processed under COPPA.

    Section: Tenn. Code Ann. § 47-18-3305(a)(6)

  3. Child means a person under 13.

    Section: Tenn. Code Ann. § 47-18-3302(5)

  4. From 1 Jul 2026 data generated from a photograph or video or audio recording is no longer excluded from biometric data.

    Section: Tenn. Code Ann. § 47-18-3302(3)(B) (as amended by 2026 Pub. Ch. 614)

  5. Complying with COPPA verifiable parental consent satisfies parental consent duties.

    Section: Tenn. Code Ann. § 47-18-3311(b)

Sources

Compare sensitive data across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Tennessee statute

Reference material, not legal advice.