Compare state privacy laws: enforcement
Who enforces the law, cure periods, penalties and private actions.
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Each entry gives the statute section it comes from. "None" means the law has no such test, period or right. Reference material, not legal advice.
| State | Enforcer | Cure period (days) | Cure period ends | Maximum civil penalty | Private right of action |
|---|---|---|---|---|---|
| California | CPPA and AGCal. Civ. Code §§ 1798.155, 1798.199.90 | NoneCal. Civ. Code § 1798.199.45(a) | noneCal. Civ. Code § 1798.199.45(a) | $2,663 per violation; $7,988 intentional or minors under 16 (from 2025-01-01)Cal. Civ. Code §§ 1798.155(a), 1798.199.90(a) | limited (breach)Cal. Civ. Code § 1798.150 |
| Virginia | AG§ 59.1-584(A) | 30§ 59.1-584(B) | none§ 59.1-584(B) | $7,500 per violation§ 59.1-584(C) | no§ 59.1-584(E) |
| Colorado | AG and district attorneysC.R.S. § 6-1-1311(1)(a) | 60C.R.S. § 6-1-1311(1)(d) | 2025-01-01C.R.S. § 6-1-1311(1)(d)(I) | $20,000 per violation ($50,000 if against an elderly person)C.R.S. § 6-1-112(1)(a), (c) | noC.R.S. § 6-1-1310(1) |
| Connecticut | AGConn. Gen. Stat. § 42-525(a) | 60Conn. Gen. Stat. § 42-525(b) | 2024-12-31Conn. Gen. Stat. § 42-525(b) to (c) | $5,000 per wilful violation (CUTPA)Conn. Gen. Stat. § 42-110o(b) | noConn. Gen. Stat. § 42-525(d) |
| Utah | AG§ 13-61-402(1) | 30§ 13-61-402(3) | none§ 13-61-402(3) | $7,500 per violation plus actual damages§ 13-61-402(3)(d) | no§ 13-61-305 |
| Oregon | AGORS 646A.589(7) | None2025 c.417 § 5 | 2026-01-012025 c.417 § 5(2) | $7,500 per violationORS 646A.589(4)(a) | noORS 646A.589(7) |
| Texas | AG§ 541.151 | 30§ 541.154 | none§ 541.154 | $7,500 per violation§ 541.155(a) | no§ 541.156 |
| Montana | AG§ 30-14-2817(1) | None§ 30-14-2817 | 2025-10-01§ 30-14-2817 | $7,500 per violation§ 30-14-2820(2) | no§ 30-14-2817(5) |
| Delaware | AG (Department of Justice)§ 12D-111(a) | 60§ 12D-111(b) | 2025-12-31§ 12D-111(b), (c) | $10,000 per wilful violation§ 12D-111(e); Del. Code Ann. tit. 6, § 2522(b) | no§ 12D-111(d) |
| Iowa | AG§ 715D.8(1) | 90§ 715D.8(2) | none§ 715D.8(2) | $7,500 per violation§ 715D.8(3) | no§ 715D.8(4) |
| Nebraska | AG§ 87-1119 | 30§ 87-1122 | none§ 87-1122 | $7,500 per violation§ 87-1124(1) | no§ 87-1125 |
| New Hampshire | AGRSA 507-H:11, I | 60RSA 507-H:11, II | 2025-12-31RSA 507-H:11, II-III | $10,000 per violationRSA 507-H:11, V; RSA 358-A:4, III(b) | noRSA 507-H:11, IV |
| New Jersey | AG (Division of Consumer Affairs)C.56:8-166.19 | 30C.56:8-166.17(b) | 2026-07-01C.56:8-166.17(b) | $10,000 first offence, $20,000 later offences (Consumer Fraud Act); $50,000 per record for selling sensitive dataN.J.S.A. 56:8-13; C.56:8-166.23 | noC.56:8-166.19 |
| Tennessee | AGTenn. Code Ann. § 47-18-3313(a) | 60Tenn. Code Ann. § 47-18-3313(b) | noneTenn. Code Ann. § 47-18-3313(b) | $7,500 per violation (treble for wilful or knowing violations)Tenn. Code Ann. § 47-18-3313(d) | noTenn. Code Ann. § 47-18-3313(e) |
| Minnesota | AG§ 325M.20(b) | 30§ 325M.20(a) | 2026-01-31§ 325M.20(a) | $7,500 per violation§ 325M.20(c) | no§ 325M.20(d) |
| Maryland | AG (Consumer Protection Division)§ 14-4713 | 60§ 14-4714(c) | 2027-04-01§ 14-4714(a) | $10,000 per violation; $25,000 per repeated violation§ 13-410 | no§ 14-4713(a)(2) |
| Indiana | AGIC 24-15-10-1 | 30IC 24-15-10-3 | noneIC 24-15-10-3 | $7,500 per violationIC 24-15-10-2(a) | noIC 24-15-10-4 |
| Kentucky | AGKRS 367.3627(1) | 30KRS 367.3627(2) | noneKRS 367.3627(2) | $7,500 per continued violationKRS 367.3627(3) | noKRS 367.3627(4) |
| Rhode Island | AG§ 6-48.1-8(b) | None§ 6-48.1-8 | none§ 6-48.1-8 | $10,000 per violation (deceptive trade practice), plus $100 to $500 per unlawful disclosure§ 6-13.1-8; § 6-48.1-8(a) | no§ 6-48.1-8(c) |
| Louisiana | AGLa. R.S. 51:1780.5(A) | 30La. R.S. 51:1780.5(D) | 2027-07-31La. R.S. 51:1780.5(D) | $5,000 per violation where intent to defraud is found (LUTPA); extra penalty for elderly or disabled victimsLa. R.S. 51:1407(B), (C) | noLa. R.S. 51:1780.5(C) |
| Oklahoma | AGSB 546 § 12(A) (75A O.S. § 311) | 30SB 546 § 13 (75A O.S. § 312) | noneSB 546 § 13 (75A O.S. § 312) | $7,500 per violationSB 546 § 14(A) (75A O.S. § 313) | noSB 546 § 14(E) (75A O.S. § 313) |
| Alabama | AGAct 2026-552, § 11(a) (Ala. Code § 8-44-11) | 45Act 2026-552, § 11(b) (Ala. Code § 8-44-11) | noneAct 2026-552, § 11(b) (Ala. Code § 8-44-11) | $15,000 per violationAct 2026-552, § 11(b)(2) (Ala. Code § 8-44-11) | noAct 2026-552, § 11 (Ala. Code § 8-44-11) |
| Vermont | AGAct 145, Sec. 1, 9 V.S.A. § 2415j(a) | 60Act 145, Sec. 3 | 2029-06-30Act 145, Sec. 3 | $10,000 per violation (Consumer Protection Act)9 V.S.A. § 2458(b)(1) | noAct 145, Sec. 1, 9 V.S.A. § 2415j(a) |
| Narrower laws | |||||
| Florida | AG (Department of Legal Affairs)Fla. Stat. § 501.72(1) | 45Fla. Stat. § 501.72(2) | noneFla. Stat. § 501.72(2) | $50,000 per violation (tripled in listed cases)Fla. Stat. § 501.72(1) | noFla. Stat. § 501.72(8) |
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.