Navigate US Privacy Laws Without a Law Degree
20+ states now have consumer privacy laws. Find out which apply to your business in under 2 minutes with our free compliance tools.
US Privacy Law Tracker — All 50 States
Which states have a consumer data privacy law? This map tracks every comprehensive state privacy statute across all 50 states and Washington, D.C. — color-coded by whether the law is active, enacted but not yet effective, or absent. Updated May 2026.
As of May 2026, 20 US states have an active comprehensive consumer privacy law, 1 more has been enacted with a future effective date, and the remaining 30 states and the District of Columbia have no comprehensive law.
View all 50 states & D.C. as a table
| State | Status | Law | Effective |
|---|---|---|---|
| Alabama | None | — | — |
| Alaska | None | — | — |
| Arizona | None | — | — |
| Arkansas | None | — | — |
| California | Active | CCPA/CPRA | Jan 1, 2020 |
| Colorado | Active | CPA | Jul 1, 2023 |
| Connecticut | Active | CTDPA | Jul 1, 2023 |
| Delaware | Active | DPDPA | Jan 1, 2025 |
| District of Columbia | None | — | — |
| Florida | Active | FDBR | Jul 1, 2024 |
| Georgia | None | — | — |
| Hawaii | None | — | — |
| Idaho | None | — | — |
| Illinois | None | — | — |
| Indiana | Active | INCDPA | Jan 1, 2026 |
| Iowa | Active | ICDPA | Jan 1, 2025 |
| Kansas | None | — | — |
| Kentucky | Active | KCDPA | Jan 1, 2026 |
| Louisiana | None | — | — |
| Maine | None | — | — |
| Maryland | Active | MODPA | Oct 1, 2025 |
| Massachusetts | None | — | — |
| Michigan | None | — | — |
| Minnesota | Active | MCDPA | Jul 31, 2025 |
| Mississippi | None | — | — |
| Missouri | None | — | — |
| Montana | Active | MCDPA | Oct 1, 2024 |
| Nebraska | Active | NDPA | Jan 1, 2025 |
| Nevada | None | — | — |
| New Hampshire | Active | NHPA | Jan 1, 2025 |
| New Jersey | Active | NJDPA | Jan 15, 2025 |
| New Mexico | None | — | — |
| New York | None | — | — |
| North Carolina | None | — | — |
| North Dakota | None | — | — |
| Ohio | None | — | — |
| Oklahoma | Enacted (pending) | OKCDPA | Jan 1, 2027 |
| Oregon | Active | OCPA | Jul 1, 2024 |
| Pennsylvania | None | — | — |
| Rhode Island | Active | RIDTPPA | Jan 1, 2026 |
| South Carolina | None | — | — |
| South Dakota | None | — | — |
| Tennessee | Active | TIPA | Jul 1, 2025 |
| Texas | Active | TDPSA | Jul 1, 2024 |
| Utah | Active | UCPA | Dec 31, 2023 |
| Vermont | None | — | — |
| Virginia | Active | VCDPA | Jan 1, 2023 |
| Washington | None | — | — |
| West Virginia | None | — | — |
| Wisconsin | None | — | — |
| Wyoming | None | — | — |
Source: state legislatures and attorneys general. Data retrieved 2026-05-24. Status reflects comprehensive consumer privacy laws only; sector-specific statutes (e.g. biometric or health-data laws) are not counted here.
Free Privacy Compliance Tools
Everything you need to understand and comply with US state privacy laws — no signup required.
Privacy Law Calculator
Answer a few questions about your business and instantly see which state privacy laws apply to you.
Check NowInteractive State Map
Explore privacy laws across all 50 states with our interactive map and detailed state pages.
Explore MapCompare State Laws
Side-by-side state privacy law comparison chart for any 2-4 laws. Rights, thresholds, penalties at a glance.
Compare NowGPC Compliance Checker
Find out if you need to honor Global Privacy Control signals and how to implement it.
Check GPCBiometric Compliance Checker
Check fingerprint, face-scan, and voiceprint duties under BIPA, CUBI, Washington law, and comprehensive state laws.
Check BiometricsData Broker Quiz
Determine if your business qualifies as a data broker under California law.
Take QuizDeadline Timeline
Never miss a compliance deadline. Track all upcoming effective dates and amendments.
View DeadlinesEnforcement Tracker
Track CCPA penalties, fines, and enforcement actions across all 21 state privacy laws.
View PenaltiesPrivacy Glossary
Plain-English definitions of privacy terms, from "personal information" to "data broker."
Browse TermsFeatured Compliance Guides
In-depth, plain-English guides to the state privacy laws businesses ask about most.
Vermont Data Broker Registry & H.211 Opt-Out
How to opt out of Vermont's 283 registered data brokers via the public registry, plus what H.211 (Act 138, effective 2027) changed for broker fees and disclosure duties.
Read guide Cost & BudgetHow Much Does Privacy Compliance Cost a Small Business?
A practical 2026 breakdown of privacy compliance costs — DIY vs. outsourced, state-by-state, and the real cost of a non-compliance penalty.
Read guide Opt-Out & GPCUniversal Opt-Out Mechanism (UOOM) Compliance
12 US states now require businesses to honor universal opt-out signals like Global Privacy Control — which states, the requirements, and how to implement it.
Read guide State Law GuideVirginia VCDPA 2026 Compliance Guide
Applicability thresholds, the eight consumer rights, the SB 338 geolocation ban, and how the VCDPA is enforced.
Read guide State Law GuideColorado Privacy Act (CPA) Checklist
The six 2026 compliance triggers: applicability thresholds, GPC/universal opt-out, consumer rights, and deadlines.
Read guide State Law GuideOregon Consumer Privacy Act (OCPA)
The 25% data-sale applicability threshold, the GPC requirement, and why Oregon offers no cure period.
Read guide Workplace PrivacyEmployee Data Privacy by State
Which states cover workplace data — California CCPA, Illinois BIPA, monitoring notices, and AI hiring-tool rules.
Read guide AI & PrivacyAI and Data Privacy State Laws
How 15+ state privacy laws reach AI through profiling and automated-decision-making opt-out rights.
Read guide California / CCPACCPA Cybersecurity Audit Requirements 2026
New CCPA regulations requiring qualifying businesses to run annual cybersecurity audits — who must comply and when.
Read guide Children's PrivacyCOPPA Rule Amendments: 2026 Compliance Checklist
What the FTC's amended COPPA Rule changed for kids' data — biometrics and phone numbers as personal information, written retention policies, and separate consent for ads.
Read guideBuilt for Businesses, Not Lawyers
US state privacy laws are a patchwork of 20+ different regulations with different thresholds, rights, and penalties. We cut through the complexity.
- Instant applicability check — answer 4 questions, get results
- Plain English explanations of complex legal requirements
- Side-by-side comparisons to spot differences that matter
- Printable compliance checklists for every state
- Deadline tracking so you never miss an effective date
E-commerce
Selling online to customers across states
SaaS / Tech
Processing user data at scale
Healthcare
Navigating HIPAA + state law overlap
Marketing
Ad targeting and data sharing compliance
Frequently Asked Questions
- How many US states have comprehensive privacy laws?
- As of 2026, over 20 US states have enacted comprehensive consumer privacy laws. California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Utah (UCPA) were among the first, with Texas, Oregon, Montana, Delaware, Iowa, Tennessee, Indiana, and others following. Six new state privacy laws took effect in 2025-2026.
- How do I know which state privacy laws apply to my business?
- Each state privacy law has its own applicability thresholds based on factors like annual revenue, number of consumers whose data you process, and percentage of revenue from selling personal data. Use our free Privacy Law Calculator to answer 4 questions and instantly see which laws apply to your business.
- What are the penalties for violating state privacy laws?
- Penalties vary by state but typically range from $2,500 to $7,500 per violation. California's CCPA allows fines up to $7,500 per intentional violation. Some states offer a cure period (30-60 days) to fix violations before penalties apply. Our Enforcement Tracker shows real fines and actions taken across all states.
- What is the Global Privacy Control (GPC) and do I need to support it?
- Global Privacy Control (GPC) is a browser signal that lets consumers opt out of the sale or sharing of their personal data. California, Colorado, Connecticut, Montana, and Texas require businesses to honor GPC signals. Use our GPC Compliance Checker to determine your obligations.
- What consumer rights do state privacy laws grant?
- Most state privacy laws grant consumers the right to know what personal data is collected, the right to delete their data, the right to opt out of data sales, and the right to correct inaccurate data. Some states also grant the right to data portability and the right to opt out of targeted advertising and profiling.
- Do I need a privacy policy for each state?
- You don't need separate policies for each state, but your privacy policy must address the specific requirements of every state law that applies to your business. This includes disclosing categories of data collected, purposes of processing, consumer rights, and opt-out mechanisms. Our Privacy Policy Generator creates a compliant policy covering all applicable states.
Don't Wait for an Enforcement Action
States are actively enforcing privacy laws. California alone has issued millions in CCPA fines and penalties. Check your compliance status today — it's free and takes under 2 minutes.
Check Your Compliance Now. Tracking 20+ state privacy laws including 6 new laws effective in 2025-2026.