---
title: "Compare state privacy laws: enforcement"
canonical: "https://dposchool.com/state-privacy-laws/topic/enforcement"
source:
  - "https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5."
  - "https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/"
  - "https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf"
  - "https://www.cga.ct.gov/current/pub/chap_743jj.htm"
  - "https://le.utah.gov/xcode/Title13/Chapter61/13-61.html"
  - "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html"
  - "https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm"
  - "https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html"
  - "https://delcode.delaware.gov/title6/c012d/index.html"
  - "https://www.legis.iowa.gov/docs/code/715D.pdf"
  - "https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101"
  - "https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm"
  - "https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM"
  - "https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf"
  - "https://www.revisor.mn.gov/statutes/cite/325M.10"
  - "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4701&enactments=false"
  - "https://iga.in.gov/ic/2026/Title_24.pdf"
  - "https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=39092"
  - "https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm"
  - "https://legis.la.gov/legis/ViewDocument.aspx?d=1480202"
  - "https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf"
  - "https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf"
  - "https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf"
  - "http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501PartVContentsIndex.html"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

# Compare state privacy laws: enforcement

Who enforces the law, cure periods, penalties and private actions.

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

Each entry gives the statute section it comes from. "None" means the law has no such test, period or right. Reference material, not legal advice.

| State | Enforcer | Cure period (days) | Cure period ends | Maximum civil penalty | Private right of action |
| --- | --- | --- | --- | --- | --- |
| [California](https://dposchool.com/state-privacy-laws/state/california/enforcement) | CPPA and AG (Cal. Civ. Code §§ 1798.155, 1798.199.90) | None (Cal. Civ. Code § 1798.199.45(a)) | none (Cal. Civ. Code § 1798.199.45(a)) | $2,663 per violation; $7,988 intentional or minors under 16 (from 2025-01-01) (Cal. Civ. Code §§ 1798.155(a), 1798.199.90(a)) | limited (breach) (Cal. Civ. Code § 1798.150) |
| [Virginia](https://dposchool.com/state-privacy-laws/state/virginia/enforcement) | AG (§ 59.1-584(A)) | 30 (§ 59.1-584(B)) | none (§ 59.1-584(B)) | $7,500 per violation (§ 59.1-584(C)) | no (§ 59.1-584(E)) |
| [Colorado](https://dposchool.com/state-privacy-laws/state/colorado/enforcement) | AG and district attorneys (C.R.S. § 6-1-1311(1)(a)) | 60 (C.R.S. § 6-1-1311(1)(d)) | 2025-01-01 (C.R.S. § 6-1-1311(1)(d)(I)) | $20,000 per violation ($50,000 if against an elderly person) (C.R.S. § 6-1-112(1)(a), (c)) | no (C.R.S. § 6-1-1310(1)) |
| [Connecticut](https://dposchool.com/state-privacy-laws/state/connecticut/enforcement) | AG (Conn. Gen. Stat. § 42-525(a)) | 60 (Conn. Gen. Stat. § 42-525(b)) | 2024-12-31 (Conn. Gen. Stat. § 42-525(b) to (c)) | $5,000 per wilful violation (CUTPA) (Conn. Gen. Stat. § 42-110o(b)) | no (Conn. Gen. Stat. § 42-525(d)) |
| [Utah](https://dposchool.com/state-privacy-laws/state/utah/enforcement) | AG (§ 13-61-402(1)) | 30 (§ 13-61-402(3)) | none (§ 13-61-402(3)) | $7,500 per violation plus actual damages (§ 13-61-402(3)(d)) | no (§ 13-61-305) |
| [Oregon](https://dposchool.com/state-privacy-laws/state/oregon/enforcement) | AG (ORS 646A.589(7)) | None (2025 c.417 § 5) | 2026-01-01 (2025 c.417 § 5(2)) | $7,500 per violation (ORS 646A.589(4)(a)) | no (ORS 646A.589(7)) |
| [Texas](https://dposchool.com/state-privacy-laws/state/texas/enforcement) | AG (§ 541.151) | 30 (§ 541.154) | none (§ 541.154) | $7,500 per violation (§ 541.155(a)) | no (§ 541.156) |
| [Montana](https://dposchool.com/state-privacy-laws/state/montana/enforcement) | AG (§ 30-14-2817(1)) | None (§ 30-14-2817) | 2025-10-01 (§ 30-14-2817) | $7,500 per violation (§ 30-14-2820(2)) | no (§ 30-14-2817(5)) |
| [Delaware](https://dposchool.com/state-privacy-laws/state/delaware/enforcement) | AG (Department of Justice) (§ 12D-111(a)) | 60 (§ 12D-111(b)) | 2025-12-31 (§ 12D-111(b), (c)) | $10,000 per wilful violation (§ 12D-111(e); Del. Code Ann. tit. 6, § 2522(b)) | no (§ 12D-111(d)) |
| [Iowa](https://dposchool.com/state-privacy-laws/state/iowa/enforcement) | AG (§ 715D.8(1)) | 90 (§ 715D.8(2)) | none (§ 715D.8(2)) | $7,500 per violation (§ 715D.8(3)) | no (§ 715D.8(4)) |
| [Nebraska](https://dposchool.com/state-privacy-laws/state/nebraska/enforcement) | AG (§ 87-1119) | 30 (§ 87-1122) | none (§ 87-1122) | $7,500 per violation (§ 87-1124(1)) | no (§ 87-1125) |
| [New Hampshire](https://dposchool.com/state-privacy-laws/state/new-hampshire/enforcement) | AG (RSA 507-H:11, I) | 60 (RSA 507-H:11, II) | 2025-12-31 (RSA 507-H:11, II-III) | $10,000 per violation (RSA 507-H:11, V; RSA 358-A:4, III(b)) | no (RSA 507-H:11, IV) |
| [New Jersey](https://dposchool.com/state-privacy-laws/state/new-jersey/enforcement) | AG (Division of Consumer Affairs) (C.56:8-166.19) | 30 (C.56:8-166.17(b)) | 2026-07-01 (C.56:8-166.17(b)) | $10,000 first offence, $20,000 later offences (Consumer Fraud Act); $50,000 per record for selling sensitive data (N.J.S.A. 56:8-13; C.56:8-166.23) | no (C.56:8-166.19) |
| [Tennessee](https://dposchool.com/state-privacy-laws/state/tennessee/enforcement) | AG (Tenn. Code Ann. § 47-18-3313(a)) | 60 (Tenn. Code Ann. § 47-18-3313(b)) | none (Tenn. Code Ann. § 47-18-3313(b)) | $7,500 per violation (treble for wilful or knowing violations) (Tenn. Code Ann. § 47-18-3313(d)) | no (Tenn. Code Ann. § 47-18-3313(e)) |
| [Minnesota](https://dposchool.com/state-privacy-laws/state/minnesota/enforcement) | AG (§ 325M.20(b)) | 30 (§ 325M.20(a)) | 2026-01-31 (§ 325M.20(a)) | $7,500 per violation (§ 325M.20(c)) | no (§ 325M.20(d)) |
| [Maryland](https://dposchool.com/state-privacy-laws/state/maryland/enforcement) | AG (Consumer Protection Division) (§ 14-4713) | 60 (§ 14-4714(c)) | 2027-04-01 (§ 14-4714(a)) | $10,000 per violation; $25,000 per repeated violation (§ 13-410) | no (§ 14-4713(a)(2)) |
| [Indiana](https://dposchool.com/state-privacy-laws/state/indiana/enforcement) | AG (IC 24-15-10-1) | 30 (IC 24-15-10-3) | none (IC 24-15-10-3) | $7,500 per violation (IC 24-15-10-2(a)) | no (IC 24-15-10-4) |
| [Kentucky](https://dposchool.com/state-privacy-laws/state/kentucky/enforcement) | AG (KRS 367.3627(1)) | 30 (KRS 367.3627(2)) | none (KRS 367.3627(2)) | $7,500 per continued violation (KRS 367.3627(3)) | no (KRS 367.3627(4)) |
| [Rhode Island](https://dposchool.com/state-privacy-laws/state/rhode-island/enforcement) | AG (§ 6-48.1-8(b)) | None (§ 6-48.1-8) | none (§ 6-48.1-8) | $10,000 per violation (deceptive trade practice), plus $100 to $500 per unlawful disclosure (§ 6-13.1-8; § 6-48.1-8(a)) | no (§ 6-48.1-8(c)) |
| [Louisiana](https://dposchool.com/state-privacy-laws/state/louisiana/enforcement) | AG (La. R.S. 51:1780.5(A)) | 30 (La. R.S. 51:1780.5(D)) | 2027-07-31 (La. R.S. 51:1780.5(D)) | $5,000 per violation where intent to defraud is found (LUTPA); extra penalty for elderly or disabled victims (La. R.S. 51:1407(B), (C)) | no (La. R.S. 51:1780.5(C)) |
| [Oklahoma](https://dposchool.com/state-privacy-laws/state/oklahoma/enforcement) | AG (SB 546 § 12(A) (75A O.S. § 311)) | 30 (SB 546 § 13 (75A O.S. § 312)) | none (SB 546 § 13 (75A O.S. § 312)) | $7,500 per violation (SB 546 § 14(A) (75A O.S. § 313)) | no (SB 546 § 14(E) (75A O.S. § 313)) |
| [Alabama](https://dposchool.com/state-privacy-laws/state/alabama/enforcement) | AG (Act 2026-552, § 11(a) (Ala. Code § 8-44-11)) | 45 (Act 2026-552, § 11(b) (Ala. Code § 8-44-11)) | none (Act 2026-552, § 11(b) (Ala. Code § 8-44-11)) | $15,000 per violation (Act 2026-552, § 11(b)(2) (Ala. Code § 8-44-11)) | no (Act 2026-552, § 11 (Ala. Code § 8-44-11)) |
| [Vermont](https://dposchool.com/state-privacy-laws/state/vermont/enforcement) | AG (Act 145, Sec. 1, 9 V.S.A. § 2415j(a)) | 60 (Act 145, Sec. 3) | 2029-06-30 (Act 145, Sec. 3) | $10,000 per violation (Consumer Protection Act) (9 V.S.A. § 2458(b)(1)) | no (Act 145, Sec. 1, 9 V.S.A. § 2415j(a)) |
| **Narrower laws** |  |  |  |  |  |
| [Florida](https://dposchool.com/state-privacy-laws/state/florida/enforcement) | AG (Department of Legal Affairs) (Fla. Stat. § 501.72(1)) | 45 (Fla. Stat. § 501.72(2)) | none (Fla. Stat. § 501.72(2)) | $50,000 per violation (tripled in listed cases) (Fla. Stat. § 501.72(1)) | no (Fla. Stat. § 501.72(8)) |

## Other comparisons

- [Applicability](https://dposchool.com/state-privacy-laws/topic/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/topic/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/topic/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/topic/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/topic/processors)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 83: General conditions for imposing administrative fines](https://dposchool.com/gdpr/article/83) (enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / Compare: Enforcement

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents