Compare state privacy laws: controller duties
Notices, opt-out signals, data protection assessments and minimization.
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Each entry gives the statute section it comes from. "None" means the law has no such test, period or right. Reference material, not legal advice.
| State | Universal opt-out signal | Data protection assessments | Data minimization standard |
|---|---|---|---|
| California | required (regulations in force; browser signal duty from 2027-01-01)Cal. Code Regs. tit. 11, § 7025; Cal. Civ. Code § 1798.136 | required (risk assessments from 2026-01-01; CPPA submissions from 2028-04-01)Cal. Code Regs. tit. 11, §§ 7150, 7157 | reasonably necessary and proportionateCal. Civ. Code § 1798.100(c) |
| Virginia | not required§ 59.1-578 | required§ 59.1-580 | adequate, relevant and reasonably necessary§ 59.1-578(A)(1) |
| Colorado | required from 2024-07-01C.R.S. § 6-1-1306(1)(a)(IV)(B) | requiredC.R.S. § 6-1-1309 | adequate, relevant and limited to what is reasonably necessaryC.R.S. § 6-1-1308(3) |
| Connecticut | required from 2025-01-01Conn. Gen. Stat. § 42-520(c)(1)(A)(ii) | requiredConn. Gen. Stat. § 42-522(b) | reasonably necessary and proportionate (from 2026-07-01)Conn. Gen. Stat. § 42-520(a)(1)(A) |
| Utah | not required§§ 13-61-201 to 13-61-302 | not required§§ 13-61-301 to 13-61-305 | no express duty in the text§ 13-61-302 |
| Oregon | required from 2026-01-01ORS 646A.578(5)(c) | requiredORS 646A.586 | reasonably necessaryORS 646A.578(1)(b) |
| Texas | required from 2025-01-01§ 541.055(e) | required§ 541.105 | reasonably necessary§ 541.101(a)(1) |
| Montana | required from 2025-01-01§ 30-14-2809(3)(b) | required§ 30-14-2814; § 30-14-2819 | reasonably necessary§ 30-14-2812(1)(a) |
| Delaware | required from 2026-01-01§ 12D-106(e)(1)a.2 | required (controllers with 100,000+ consumers; 50,000+ from 2027-01-01)§ 12D-108(a) | reasonably necessary (reasonably necessary and proportional from 2027-01-01)§ 12D-106(a)(1) |
| Iowa | not required§ 715D.4 | not required§ 715D.4 | no duty§ 715D.4 |
| Nebraska | authorized agent technology (such as browser or device setting) to be honoured from 2025-01-01, subject to exceptions§ 87-1111(5) | required§ 87-1116 | reasonably necessary§ 87-1112(1)(a) |
| New Hampshire | required from 2025-01-01RSA 507-H:6, V(a)(1)(B) | requiredRSA 507-H:8, I | reasonably necessaryRSA 507-H:6, I(a) |
| New Jersey | required from 2025-07-15C.56:8-166.11(b)(1) | requiredC.56:8-166.12(a)(10) | reasonably necessaryC.56:8-166.12(a)(1) |
| Tennessee | not requiredTenn. Code Ann. § 47-18-3305 | requiredTenn. Code Ann. § 47-18-3307(a) | reasonably necessaryTenn. Code Ann. § 47-18-3305(a)(1) |
| Minnesota | required from 2025-07-31§ 325M.14, subd. 3 | required§ 325M.18(b) | reasonably necessary (plus retention limit and data inventory)§ 325M.16, subd. 2(a), (c) and (g) |
| Maryland | opt-out preference signal listed as a method from 2025-10-01; authorized agent browser or device settings must be honoured§ 14-4707(f)(3)(ii); § 14-4706 | required (including each algorithm used)§ 14-4710(b) | reasonably necessary and proportionate to a requested product or service; strictly necessary for sensitive data§ 14-4707(a)(1); § 14-4707(b)(1)(i) |
| Indiana | not requiredIC 24-15-4 | requiredIC 24-15-6-1(b) | reasonably necessaryIC 24-15-4-1(1) |
| Kentucky | not requiredKRS 367.3611 to 367.3629 | required (for activities created or generated on or after 2026-06-01)KRS 367.3621(1) and (8) | reasonably necessaryKRS 367.3617(1)(a) |
| Rhode Island | not required§ 6-48.1-5; § 6-48.1-6 | required§ 6-48.1-7(e) | no general duty (reasonably necessary and proportionate only for processing under exemptions)§ 6-48.1-7(s) |
| Louisiana | conditional, from 2027-01-01 (authorized agent technology, with exceptions)La. R.S. 51:1780.3(E)(5), (6) | requiredLa. R.S. 51:1780.4(E) | adequate, relevant and reasonably necessaryLa. R.S. 51:1780.4(A)(1)(a) |
| Oklahoma | not requiredSB 546 §§ 2 to 8 (75A O.S. §§ 301 to 307) | requiredSB 546 § 10 (75A O.S. § 309) | adequate, relevant and reasonably necessarySB 546 § 7(A)(1) (75A O.S. § 306) |
| Alabama | not expressly required (conflict rule only)Act 2026-552, § 6(c) (Ala. Code § 8-44-6) | not requiredAct 2026-552, §§ 7 to 10 (Ala. Code §§ 8-44-7 to 8-44-10) | adequate, relevant and reasonably necessaryAct 2026-552, § 7(a)(1) (Ala. Code § 8-44-7) |
| Vermont | required from 2028-01-01Act 145, Sec. 1, 9 V.S.A. § 2415e(d)(2)(C) | requiredAct 145, Sec. 1, 9 V.S.A. § 2415g | reasonably necessary and proportionateAct 145, Sec. 1, 9 V.S.A. § 2415e(a)(1) |
| Narrower laws | |||
| Florida | not requiredFla. Stat. § 501.705 | requiredFla. Stat. § 501.713 | adequate, relevant and reasonably necessaryFla. Stat. § 501.71(1)(a) |
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
- Article 35: Data protection impact assessment (assessments)