--- title: "Compare state privacy laws: sensitive data" canonical: "https://dposchool.com/state-privacy-laws/topic/sensitive-data" source: - "https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5." - "https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/" - "https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf" - "https://www.cga.ct.gov/current/pub/chap_743jj.htm" - "https://le.utah.gov/xcode/Title13/Chapter61/13-61.html" - "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html" - "https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm" - "https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html" - "https://delcode.delaware.gov/title6/c012d/index.html" - "https://www.legis.iowa.gov/docs/code/715D.pdf" - "https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101" - "https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm" - "https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM" - "https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf" - "https://www.revisor.mn.gov/statutes/cite/325M.10" - "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false" - "https://iga.in.gov/ic/2026/Title_24.pdf" - "https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=39092" - "https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm" - "https://legis.la.gov/legis/ViewDocument.aspx?d=1480202" - "https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf" - "https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf" - "https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf" - "http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501PartVContentsIndex.html" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- # Compare state privacy laws: sensitive data How sensitive data and children's and teens' data are treated. Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) Each entry gives the statute section it comes from. "None" means the law has no such test, period or right. Reference material, not legal advice. | State | Sensitive data rule | Children and teens | | --- | --- | --- | | [California](https://dposchool.com/state-privacy-laws/state/california/sensitive-data) | limit-use (CA) (Cal. Civ. Code § 1798.121) | under 16 (opt-in to sell or share; parent if under 13) (Cal. Civ. Code § 1798.120(c)) | | [Virginia](https://dposchool.com/state-privacy-laws/state/virginia/sensitive-data) | opt-in consent (sale of precise geolocation banned from 2026-07-01) (§ 59.1-578(A)(5) to (6)) | under 13 (COPPA parental consent); social media under 16: one-hour daily limit (2025 c. 703) (§§ 59.1-578(F), 59.1-577.1) | | [Colorado](https://dposchool.com/state-privacy-laws/state/colorado/sensitive-data) | opt-in consent (to process or sell) (C.R.S. § 6-1-1308(7)) | under 13 (parental consent); under 18: consent for targeted ads, sale and profiling (from 2025-10-01) (C.R.S. §§ 6-1-1308(7), 6-1-1308.5(3)) | | [Connecticut](https://dposchool.com/state-privacy-laws/state/connecticut/sensitive-data) | opt-in consent (consent also required to sell; sale of precise geolocation banned from 2026-10-01) (Conn. Gen. Stat. § 42-520(a)(1)(D), (H), (a)(3)) | under 13 (COPPA); under 18: no targeted advertising or sale (from 2026-07-01) (Conn. Gen. Stat. §§ 42-520(a)(1)(I), 42-529a(b)(1)) | | [Utah](https://dposchool.com/state-privacy-laws/state/utah/sensitive-data) | opt-out (§ 13-61-302(3)(a)) | under 13 (COPPA) (§ 13-61-302(3)(b); § 13-61-101(8)) | | [Oregon](https://dposchool.com/state-privacy-laws/state/oregon/sensitive-data) | opt-in consent; ban on sale of precise geolocation (ORS 646A.578(2)(b), (d)(B)) | under 13 (COPPA); under 16: no sale, targeted ads or significant profiling (ORS 646A.578(2)(b) to (d)) | | [Texas](https://dposchool.com/state-privacy-laws/state/texas/sensitive-data) | opt-in consent (§ 541.101(b)(4)) | under 13 (COPPA) (§ 541.001(5), (17); § 541.101(b)(4)) | | [Montana](https://dposchool.com/state-privacy-laws/state/montana/sensitive-data) | opt-in consent (§ 30-14-2812(2)(b)) | under 13 (COPPA); consent for targeted ads or sale at 13 to 15; minors under 18 need consent for targeted ads, sale and significant profiling by online services (§ 30-14-2812(2)(b), (d); § 30-14-2811(2), (3)) | | [Delaware](https://dposchool.com/state-privacy-laws/state/delaware/sensitive-data) | opt-in consent (§ 12D-106(a)(4)) | under 13 (COPPA, parental consent); consent for targeted advertising or sale at 13 to 17 (§ 12D-106(a)(4), (a)(7)) | | [Iowa](https://dposchool.com/state-privacy-laws/state/iowa/sensitive-data) | opt-out (§ 715D.4(2)) | under 13 (COPPA) (§ 715D.1(5); § 715D.4(2)) | | [Nebraska](https://dposchool.com/state-privacy-laws/state/nebraska/sensitive-data) | opt-in consent (§ 87-1112(2)(d)) | under 13 (COPPA) (§ 87-1102(5); § 87-1112(2)(d)) | | [New Hampshire](https://dposchool.com/state-privacy-laws/state/new-hampshire/sensitive-data) | opt-in consent (RSA 507-H:6, I(d)) | under 13 (COPPA); consent for targeted advertising or sale at 13 to 15; sale of a child's data banned from 2027-01-01 (RSA 507-H:6, I(d), I(e-1), I(g)) | | [New Jersey](https://dposchool.com/state-privacy-laws/state/new-jersey/sensitive-data) | opt-in consent; ban on sale (from 2026-06-30) (C.56:8-166.12(a)(4) and (6)) | under 13 (COPPA); consent for targeted advertising, sale or profiling at 13 to 16 (C.56:8-166.12(a)(4) and (8)) | | [Tennessee](https://dposchool.com/state-privacy-laws/state/tennessee/sensitive-data) | opt-in consent (Tenn. Code Ann. § 47-18-3305(a)(6)) | under 13 (COPPA) (Tenn. Code Ann. § 47-18-3302(5); Tenn. Code Ann. § 47-18-3305(a)(6)) | | [Minnesota](https://dposchool.com/state-privacy-laws/state/minnesota/sensitive-data) | opt-in consent (§ 325M.16, subd. 2(d)) | under 13 (COPPA); consent for targeted advertising or sale at 13 to 16 (§ 325M.11(o); § 325M.16, subd. 2(d) and (f)) | | [Maryland](https://dposchool.com/state-privacy-laws/state/maryland/sensitive-data) | strictly necessary only; ban on sale (§ 14-4707(a)(1) and (2)) | under 13 (COPPA) is sensitive; no targeted advertising or sale under 18 (§ 14-4701(f); § 14-4707(a)(4) and (5)) | | [Indiana](https://dposchool.com/state-privacy-laws/state/indiana/sensitive-data) | opt-in consent (IC 24-15-4-1(5)) | under 13 (COPPA) (IC 24-15-2-6; IC 24-15-4-1(5)) | | [Kentucky](https://dposchool.com/state-privacy-laws/state/kentucky/sensitive-data) | opt-in consent (KRS 367.3617(1)(e)) | under 13 (COPPA) (KRS 367.3611(5); KRS 367.3617(1)(e)) | | [Rhode Island](https://dposchool.com/state-privacy-laws/state/rhode-island/sensitive-data) | opt-in consent (§ 6-48.1-4(c)) | under 13 (COPPA) (§ 6-48.1-2(5); § 6-48.1-4(c)) | | [Louisiana](https://dposchool.com/state-privacy-laws/state/louisiana/sensitive-data) | opt-in consent (La. R.S. 51:1780.4(A)(2)(d)) | under 13 (COPPA) (La. R.S. 51:1780.1(5); 51:1780.4(A)(2)(d)) | | [Oklahoma](https://dposchool.com/state-privacy-laws/state/oklahoma/sensitive-data) | opt-in consent (SB 546 § 7(B)(4) (75A O.S. § 306)) | under 13 (COPPA) (SB 546 § 1(5); § 7(B)(4) (75A O.S. §§ 300, 306)) | | [Alabama](https://dposchool.com/state-privacy-laws/state/alabama/sensitive-data) | opt-in consent (Act 2026-552, § 7(b)(2) (Ala. Code § 8-44-7)) | under 13 (COPPA); consent for targeted advertising or sale at 13 to 15 (Act 2026-552, § 2(4); § 7(b)(4) (Ala. Code §§ 8-44-2, 8-44-7)) | | [Vermont](https://dposchool.com/state-privacy-laws/state/vermont/sensitive-data) | opt-in consent, plus reasonably necessary; sale needs consent (Act 145, Sec. 1, 9 V.S.A. § 2415e(a)(4)) | under 13 (COPPA); no targeted advertising or sale for ages 13 to 17 (Act 145, Sec. 1, 9 V.S.A. § 2415e(a)(4)(C), (7)) | | **Narrower laws** | | | | [Florida](https://dposchool.com/state-privacy-laws/state/florida/sensitive-data) | opt-in consent (Fla. Stat. §§ 501.71(2)(d), 501.715(1)) | under 18 (13 to 17 affirmative authorization; under 13 per COPPA) (Fla. Stat. §§ 501.702(6), 501.71(2)(d)) | ## Other comparisons - [Applicability](https://dposchool.com/state-privacy-laws/topic/applicability) - [Consumer rights](https://dposchool.com/state-privacy-laws/topic/consumer-rights) - [Controller duties](https://dposchool.com/state-privacy-laws/topic/controller-duties) - [Processors](https://dposchool.com/state-privacy-laws/topic/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/topic/enforcement) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 9: Processing of special categories of personal data](https://dposchool.com/gdpr/article/9) (sensitive data) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / Compare: Sensitive data Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents