Tennessee Privacy Compliance Checklist

Tennessee Information Protection Act — Step-by-step guide to compliance

Reviewed by PrivacyLawMap editorial teamLast verified: July 28, 2026

What is the TIPA compliance checklist?

The TIPA compliance checklist is a 12-step plan for meeting the Tennessee Information Protection Act (TIPA), Tennessee's consumer privacy law, which took effect July 1, 2025. It is enforced by the Tennessee Attorney General (Consumer Protection Division) under the Tennessee Consumer Protection Act of 1977 (Tenn. Code Ann. § 47-18-101 et seq.), with civil penalties up to $7,500 per violation and a 60-day cure period to fix violations before a fine. Work through every step below, then confirm your specific obligations with the free applicability calculator.

Compliance Steps

Effective: July 1, 2025 | Cure period: 60 days

1
Applicability — confirm ALL three AND-logic thresholds: (1) business activity directed to Tennessee consumers, (2) $25M+ annual revenue, AND (3) either 175,000+ TN consumers in a calendar year OR (25,000+ consumers with 50%+ revenue from data sale). Document the threshold calculation. Confirm no entity-level exemption applies (HIPAA covered entity, GLBA financial institution, nonprofit, higher ed, insurer, state agency)
2
Consider the NIST Privacy Framework affirmative defense — § 47-18-3213 provides an affirmative defense to any TIPA cause of action if the controller maintains a written privacy program that reasonably conforms to the NIST Privacy Framework (now v1.1, April 2024). Document NIST Core Categories: IDENTIFY-P, GOVERN-P, CONTROL-P, COMMUNICATE-P, PROTECT-P. Retain written program, policies, data maps, and governance artifacts. This is a documentary-compliance opportunity not available in any other state
3
Privacy notice — update under § 47-18-3206 to include: (a) categories of personal data processed, (b) purposes of processing, (c) categories of personal data shared with third parties and categories of third parties, (d) consumer rights description, (e) how to exercise each right and appeal a denial, (f) how to opt out of sale, targeted ads, and profiling. Include the AG complaint-filing link for appeals denials
4
Consumer rights request processing — establish verified-request intake, 45-day response timeline, one 45-day extension clause, and a written appeals process under § 47-18-3205(c)(3). Respond to free-of-charge first request within any 12-month period; subsequent requests may be charged a reasonable fee or declined as unfounded/excessive
5
Sensitive data opt-in consent — implement opt-in consent flows for all 8 sensitive data categories. Ensure consent is freely given, specific, informed, and unambiguous (TIPA adopts this GDPR-style consent definition at § 47-18-3202(5)). Maintain consent records with timestamp, scope, and withdrawal method
6
Children's data — implement COPPA-verifiable parental consent for under-13 processing. For teens 13-17, require opt-in consent for targeted advertising or sale. Audit age-gating logic and document the assumption basis (account registration date-of-birth, parental verification method)
7
Opt-out mechanisms — implement a clear and conspicuous "Your Privacy Choices" link in the site footer and at least one additional opt-out method (email, web form, or toll-free number). While Tennessee does not mandate GPC, operationally recommend GPC honor for uniform multistate processing
8
Data protection assessments — conduct and document DPAs under § 47-18-3207 for: (1) targeted advertising, (2) sale of personal data, (3) profiling with legal or similarly significant effect, (4) sensitive data processing, and (5) heightened risk of harm. DPAs must weigh benefits to controller, consumer, and public against risks. AG may request DPAs during investigation; document confidentiality protections
9
Processor contracts — update under § 47-18-3208 to include: purpose and nature of processing, type of data, duration, obligations, processor confidentiality duties, data deletion/return at contract end, audit rights, and subprocessor cascade. Review all vendor agreements predating TIPA effective date (July 1, 2025) for compliance
10
AG inquiry response playbook — prepare for § 47-18-3209 enforcement. Document: receipt of AG notice of alleged violation, internal forensic review, remediation within 60-day cure window, written notice of cure to AG, and documentation retention. Train legal and privacy-operations teams on the cure timeline
11
Multistate mapping — if operating in multiple states, map TIPA obligations against UT (AND-logic peer), VA/IN (OR-logic but similar rights), CO (strictest enforcement), and CA (most comprehensive). Create a control matrix identifying TIPA-unique requirements (NIST affirmative defense, AND threshold) and shared obligations (sensitive data consent, DPA, rights response)
12
Monitor 2026 amendments — Tennessee General Assembly adjourns sine die late April/early May 2026. Track HB/SB bills referencing Tenn. Code Ann. § 47-18-32 (Part 32). AG Skrmetti's 2025 generative-AI chatbot letter and 2026 minors-data priorities may drive amendments to expand TIPA scope or add AI-specific provisions

Key Enforcement Details

Enforced By

Tennessee Attorney General (Consumer Protection Division) under the Tennessee Consumer Protection Act of 1977 (Tenn. Code Ann. § 47-18-101 et seq.)

Penalty / Violation

$7,500

Cure Period

60 days

Private Right of Action

Related Resources

Tennessee Privacy Law — Full Guide
Compare Tennessee with Other States
Tennessee Enforcement Actions & Privacy Fines
2026-2027 Privacy Law Compliance Deadlines
All State Privacy Laws

TIPA Compliance Checklist FAQ

What is the TIPA compliance checklist?

It is a 12-step plan organizations use to meet the Tennessee Information Protection Act (TIPA), which took effect July 1, 2025. The steps below cover consumer-rights request handling, privacy-notice disclosures, opt-out mechanisms, data-processing agreements, and security safeguards required under Tennessee law.

Who has to comply with the Tennessee Information Protection Act?

The TIPA generally applies to organizations that handle Tennessee residents' personal data above the law's revenue and data-volume thresholds. Whether it applies to you depends on the specifics — check your exact obligations with the free applicability calculator at /calculator rather than assuming.

What is the penalty for TIPA non-compliance?

The Tennessee Attorney General (Consumer Protection Division) under the Tennessee Consumer Protection Act of 1977 (Tenn. Code Ann. § 47-18-101 et seq.) can impose civil penalties of up to $7,500 per violation and a 60-day cure period to fix violations before a fine. There is no private right of action, so enforcement comes from the state, not individual lawsuits. Figures verified July 28, 2026.

Put TIPA Into Practice on Your SiteSponsored

Termly builds and maintains a Tennessee-ready privacy policy, a cookie consent banner, opt-in consent capture for sensitive data, and a workflow for the access, deletion and correction requests TIPA grants.

Start Free with Termly

Does this law apply to you?

Use our free calculator to check if Tennessee Information Protection Act applies to your business.

Check Applicability

Official Resources

TIPA Full Text — Tenn. Code Ann. §§ 47-18-3201 et seq. (Tennessee Code)
HB 1181 / SB 73 Bill Text (2023 Session, Tennessee General Assembly)
Tennessee Attorney General Consumer Protection Division
File a Consumer Complaint (Tennessee AG)
NIST Privacy Framework v1.1 (National Institute of Standards and Technology)
FTC COPPA Rule Amendments — Federal Register (90 FR 16918)
Tennessee Consumer Protection Act (§ 47-18-101 et seq.) — Enforcement Framework