Compare state privacy laws: sensitive data
How sensitive data and children's and teens' data are treated.
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Each entry gives the statute section it comes from. "None" means the law has no such test, period or right. Reference material, not legal advice.
| State | Sensitive data rule | Children and teens |
|---|---|---|
| California | limit-use (CA)Cal. Civ. Code § 1798.121 | under 16 (opt-in to sell or share; parent if under 13)Cal. Civ. Code § 1798.120(c) |
| Virginia | opt-in consent (sale of precise geolocation banned from 2026-07-01)§ 59.1-578(A)(5) to (6) | under 13 (COPPA parental consent); social media under 16: one-hour daily limit (2025 c. 703)§§ 59.1-578(F), 59.1-577.1 |
| Colorado | opt-in consent (to process or sell)C.R.S. § 6-1-1308(7) | under 13 (parental consent); under 18: consent for targeted ads, sale and profiling (from 2025-10-01)C.R.S. §§ 6-1-1308(7), 6-1-1308.5(3) |
| Connecticut | opt-in consent (consent also required to sell; sale of precise geolocation banned from 2026-10-01)Conn. Gen. Stat. § 42-520(a)(1)(D), (H), (a)(3) | under 13 (COPPA); under 18: no targeted advertising or sale (from 2026-07-01)Conn. Gen. Stat. §§ 42-520(a)(1)(I), 42-529a(b)(1) |
| Utah | opt-out§ 13-61-302(3)(a) | under 13 (COPPA)§ 13-61-302(3)(b); § 13-61-101(8) |
| Oregon | opt-in consent; ban on sale of precise geolocationORS 646A.578(2)(b), (d)(B) | under 13 (COPPA); under 16: no sale, targeted ads or significant profilingORS 646A.578(2)(b) to (d) |
| Texas | opt-in consent§ 541.101(b)(4) | under 13 (COPPA)§ 541.001(5), (17); § 541.101(b)(4) |
| Montana | opt-in consent§ 30-14-2812(2)(b) | under 13 (COPPA); consent for targeted ads or sale at 13 to 15; minors under 18 need consent for targeted ads, sale and significant profiling by online services§ 30-14-2812(2)(b), (d); § 30-14-2811(2), (3) |
| Delaware | opt-in consent§ 12D-106(a)(4) | under 13 (COPPA, parental consent); consent for targeted advertising or sale at 13 to 17§ 12D-106(a)(4), (a)(7) |
| Iowa | opt-out§ 715D.4(2) | under 13 (COPPA)§ 715D.1(5); § 715D.4(2) |
| Nebraska | opt-in consent§ 87-1112(2)(d) | under 13 (COPPA)§ 87-1102(5); § 87-1112(2)(d) |
| New Hampshire | opt-in consentRSA 507-H:6, I(d) | under 13 (COPPA); consent for targeted advertising or sale at 13 to 15; sale of a child's data banned from 2027-01-01RSA 507-H:6, I(d), I(e-1), I(g) |
| New Jersey | opt-in consent; ban on sale (from 2026-06-30)C.56:8-166.12(a)(4) and (6) | under 13 (COPPA); consent for targeted advertising, sale or profiling at 13 to 16C.56:8-166.12(a)(4) and (8) |
| Tennessee | opt-in consentTenn. Code Ann. § 47-18-3305(a)(6) | under 13 (COPPA)Tenn. Code Ann. § 47-18-3302(5); Tenn. Code Ann. § 47-18-3305(a)(6) |
| Minnesota | opt-in consent§ 325M.16, subd. 2(d) | under 13 (COPPA); consent for targeted advertising or sale at 13 to 16§ 325M.11(o); § 325M.16, subd. 2(d) and (f) |
| Maryland | strictly necessary only; ban on sale§ 14-4707(a)(1) and (2) | under 13 (COPPA) is sensitive; no targeted advertising or sale under 18§ 14-4701(f); § 14-4707(a)(4) and (5) |
| Indiana | opt-in consentIC 24-15-4-1(5) | under 13 (COPPA)IC 24-15-2-6; IC 24-15-4-1(5) |
| Kentucky | opt-in consentKRS 367.3617(1)(e) | under 13 (COPPA)KRS 367.3611(5); KRS 367.3617(1)(e) |
| Rhode Island | opt-in consent§ 6-48.1-4(c) | under 13 (COPPA)§ 6-48.1-2(5); § 6-48.1-4(c) |
| Louisiana | opt-in consentLa. R.S. 51:1780.4(A)(2)(d) | under 13 (COPPA)La. R.S. 51:1780.1(5); 51:1780.4(A)(2)(d) |
| Oklahoma | opt-in consentSB 546 § 7(B)(4) (75A O.S. § 306) | under 13 (COPPA)SB 546 § 1(5); § 7(B)(4) (75A O.S. §§ 300, 306) |
| Alabama | opt-in consentAct 2026-552, § 7(b)(2) (Ala. Code § 8-44-7) | under 13 (COPPA); consent for targeted advertising or sale at 13 to 15Act 2026-552, § 2(4); § 7(b)(4) (Ala. Code §§ 8-44-2, 8-44-7) |
| Vermont | opt-in consent, plus reasonably necessary; sale needs consentAct 145, Sec. 1, 9 V.S.A. § 2415e(a)(4) | under 13 (COPPA); no targeted advertising or sale for ages 13 to 17Act 145, Sec. 1, 9 V.S.A. § 2415e(a)(4)(C), (7) |
| Narrower laws | ||
| Florida | opt-in consentFla. Stat. §§ 501.71(2)(d), 501.715(1) | under 18 (13 to 17 affirmative authorization; under 13 per COPPA)Fla. Stat. §§ 501.702(6), 501.71(2)(d) |
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
- Article 9: Processing of special categories of personal data (sensitive data)