Privacy Law Cure Periods by State: Which States Still Allow Time to Fix Violations in 2026?
Termly can generate and maintain your privacy policy, consent banner, and data-request workflow as requirements change.
What Is a Cure Period in Privacy Law?
A cure period is a window of time — typically 30 to 90 days — that a state attorney general must give a business to fix an alleged privacy law violation before taking enforcement action. During this window, the business can remedy the violation, and if the AG is satisfied that the issue has been resolved, no penalty is imposed.
Think of it as a grace period. Instead of immediately facing fines and legal action, businesses get a chance to correct course. But here is the critical trend: cure periods are disappearing across the United States. States that originally included them are letting them expire, and newer privacy laws often do not include them at all.
This matters because once a cure period is gone, an attorney general can pursue enforcement — including substantial fines — immediately upon discovering a violation, with no obligation to give you a heads-up first.
The Trend: Cure Periods Are Sunsetting
When the first wave of state privacy laws passed (Virginia, Colorado, Connecticut in 2021), most included cure periods as a concession to businesses. The idea was to give companies time to adapt to brand-new compliance requirements.
But legislators built in sunset dates. The message was clear: the grace period is temporary. Here is the timeline of cure period expirations:
- January 1, 2025 — Colorado and Connecticut cure periods expired
- October 1, 2025 — Montana cure period expired
- January 1, 2026 — Oregon cure period expired; Delaware and New Hampshire moved from mandatory cure periods to case-by-case enforcement discretion
- July 2026 — New Jersey’s temporary mandatory notice-and-cure period ended
Tennessee is not on this sunset timeline: its 60-day cure period is permanent under the enacted TIPA.
Meanwhile, several states never included a cure period at all: California (CCPA), Rhode Island, and Maryland all allow immediate enforcement.
Cure Periods by State: Complete Comparison Table
| State | Cure Period (Days) | Status | Notes |
|---|---|---|---|
| California | None | No cure period | CCPA never included a mandatory cure period. The AG may consider a business’s compliance efforts as a mitigating factor. |
| Virginia | 30 days | Active (permanent) | Written into statute without a sunset date. AG must provide written notice and 30-day cure window. |
| Colorado | 0 | Expired Jan 1, 2025 | Was 60 days. AG now has full discretion on enforcement. |
| Connecticut | 0 | Expired Jan 1, 2025 | Was 60 days. AG may still consider good-faith compliance efforts. |
| Utah | 30 days | Active (permanent) | AG must provide written notice. Business-friendly enforcement approach. |
| Iowa | 90 days | Active (permanent) | Longest cure period of any state. Very business-friendly. |
| Indiana | 30 days | Active (permanent) | AG must provide written notice before enforcement. |
| Kentucky | 30 days | Active | Standard 30-day window after AG notice. |
| Rhode Island | None | No cure period | AG can enforce immediately. No mandatory notice requirement. |
| Tennessee | 60 days | Active (permanent) | The enacted TIPA contains no automatic sunset for its mandatory notice-and-cure process. |
| Montana | 0 | Expired Oct 1, 2025 | Was part of the original law. AG now has immediate enforcement authority. |
| Texas | 30 days | Active | AG must notify and allow cure. Texas AG has been active on privacy enforcement. |
| Oregon | 0 | Expired Jan 1, 2026 | Was 30 days. Oregon AG can now pursue enforcement without prior notice. |
| Delaware | 60 days if offered | Discretionary since Jan 1, 2026 | The Department of Justice may offer a cure after considering statutory factors; notice is no longer mandatory. |
| New Hampshire | 60 days if offered | Discretionary since Jan 1, 2026 | The AG may offer a cure opportunity after considering the statutory factors; notice is no longer mandatory. |
| New Jersey | None guaranteed | Mandatory period ended July 2026 | The Division of Consumer Affairs may proceed without the temporary 30-day cure opportunity. |
| Nebraska | 30 days | Active | AG must provide written notice before seeking penalties. |
| Minnesota | None | Expired Jan 31, 2026 | The initial warning-letter cure provision expired; AG may now proceed without a guaranteed cure opportunity. |
| Maryland | None | No cure period | MODPA includes no cure period. Enforcement began April 1, 2026. |
| Florida | 45 days | Active | Written notice required. Applies only to businesses meeting Florida’s high revenue threshold ($1B+). |
| Oklahoma | 30 days | Active | Newly enacted (March 2026). AG must provide written notice. |
New Hampshire source: RSA 507-H:11(II)–(III) limited the mandatory cure period to 2025 and made cure opportunities discretionary beginning January 1, 2026 (retrieved July 22, 2026).
Additional official sources (retrieved July 22, 2026): Delaware Code title 6, § 12D-111; New Jersey Division of Consumer Affairs FAQ; and the Tennessee General Assembly TIPA bill record.
What It Means When a Cure Period Expires
When a cure period expires or a state has none, the practical impact is significant:
- Immediate enforcement — The attorney general can file an enforcement action without first contacting your business. There is no mandatory warning.
- Higher financial exposure — Without the safety net of a cure period, penalties can accumulate faster. For states like California with per-violation penalties, the total can grow quickly. See our penalties and fines guide for specific amounts.
- No guaranteed second chance — Even if you discover a compliance gap, you cannot count on having time to fix it before enforcement begins.
- Discretionary consideration — Most AGs retain discretion to consider good-faith compliance efforts, but this is not guaranteed and is not a legal right.
Permanent vs. Discretionary Cure Periods in 2026
Tennessee retains a permanent mandatory 60-day cure period. Before filing an enforcement action, the Attorney General must identify the alleged violation in writing and allow 60 days to cure it; the enacted TIPA contains no automatic sunset.
That differs from Delaware, New Hampshire, and New Jersey, where temporary mandatory windows have ended. Their enforcement authorities may still offer time to cure, but a business cannot treat that opportunity as a guaranteed compliance backstop.
5-Step Action Plan for Businesses
Whether your state still has a cure period or not, proactive compliance is always better than reactive remediation. Here is what to do:
- Identify which states apply to you — Use our Privacy Law Calculator to determine which state laws your business must comply with based on your revenue, consumer count, and data practices.
- Check cure period status — For each applicable state, confirm whether a cure period exists and whether it is permanent or sunsetting. Use the table above as your reference.
- Prioritize states without guaranteed cure periods — California, Colorado, Connecticut, Oregon, Montana, Rhode Island, Maryland, Delaware, New Hampshire, and New Jersey can proceed without a mandatory warning-and-cure window. If you are subject to these laws, compliance gaps carry the highest risk.
- Run a compliance audit — Review your data practices, privacy policies, opt-out mechanisms, and DSAR processes against each applicable state law. Use our state comparison tool to identify differences in requirements.
- Document your compliance efforts — Even in states without a cure period, demonstrating good-faith compliance efforts can be a mitigating factor. Keep records of your audits, policy updates, training, and remediation steps.
Frequently Asked Questions
Does California have a cure period for CCPA violations?
No. The CCPA as amended by the CPRA does not include a mandatory cure period. The CPPA and the California AG can pursue enforcement — including fines of up to $2,500 per violation or $7,500 per intentional violation — without first giving businesses an opportunity to cure. However, enforcement authorities may consider a business’s compliance efforts when deciding whether and how to pursue an action.
What happens if I fix a violation during a cure period?
If your state has an active cure period and you receive notice from the AG, you typically have the specified number of days (usually 30) to remedy the violation. If the AG is satisfied that you have cured the violation and provided a written statement that no further violations will occur, the matter is typically closed without penalties. However, if the same violation recurs, most states allow the AG to pursue enforcement without providing another cure opportunity.
Can a state attorney general still pursue enforcement even if a cure period exists?
In states with active cure periods, the AG generally must provide notice and allow the cure window before seeking penalties. However, if the business fails to cure within the window, or if the AG determines the violation was intentional, enforcement can proceed. The cure period protects against immediate penalties — it does not provide immunity.
Which state has the longest cure period?
Iowa has the longest cure period at 90 days. This is three times the standard 30-day window used by most states. Iowa’s privacy law is generally considered one of the most business-friendly comprehensive state privacy laws.
Are more states expected to eliminate their cure periods?
The clear trend is toward elimination or enforcement discretion. New Hampshire and Delaware ended their mandatory periods on December 31, 2025, and New Jersey’s temporary period ended in July 2026. Tennessee remains an exception with a permanent 60-day cure period. While we cannot predict legislative changes, businesses should not rely on cure periods as a long-term compliance strategy.
Last updated: July 22, 2026.Termly can turn the requirements above into a maintained privacy policy, consent banner, and data-request workflow.