Loading comparison tool...
All 24 signed or enacted US state consumer privacy laws, tracked state by state. Scan the 2026 state privacy law comparison chart, then use the free side-by-side comparison tool to compare any 2–4 states in detail — consumer rights, applicability thresholds, GPC requirements, cure periods, and per-violation penalties — or scroll to the full state privacy laws overview tracker below.
Reviewed by PrivacyLawMap editorial team · Last verified: 2026-10-12 · 24 state privacy laws tracked
Quick comparison of the dimensions that most often change a multi-state compliance plan: applicability thresholds, GPC recognition, cure periods, lawsuit exposure, threshold logic, and effective-date status.
Across the 24 enacted US state privacy laws, the consumer-count trigger ranges from 25,000 consumers in Montana to 175,000 in Tennessee — a 7× spread, and Texas and Nebraska set no numeric threshold at all. The lowest numeric trigger of any kind is 3,000 consumers in Vermont, but only for businesses that process those consumers’ sensitive data or sell their personal data. Connecticut sets no minimum at all for a business that processes sensitive data or offers personal data for sale. Only California, Utah, Tennessee, Florida, and Louisianastate a minimum annual revenue in the statutory test at all, so revenue is the wrong first question in most states — consumer volume is. Verified 2026-10-12.
| Comparison point | 2026 quick read | Compliance takeaway |
|---|---|---|
| Signed or enacted laws tracked | 24 laws across 24 states | Oklahoma, Alabama, Louisiana, and Vermont is signed but not yet effective; treat it as a 2027 readiness item. |
| Applicability threshold (who is covered) | 25,000–175,000 consumers, depending on the state | Montana covers businesses at 25,000 consumers while Tennessee waits until 175,000, and Texas and Nebraska set no numeric threshold at all — scope every state separately rather than assuming one national trigger. |
| GPC / universal opt-out required | 14 states require automated opt-out signal recognition | California, Colorado, Connecticut, Montana, Texas, and 9 more are the operational baseline for a national GPC program. |
| No current cure period | 10 states allow immediate enforcement | California, Colorado, Connecticut, Rhode Island, Montana, and 5 more leave little room for a notice-and-fix strategy once enforcement starts. |
| Private lawsuit exposure | 1 state includes a private right of action | California is the only comprehensive-law state in this dataset with consumer lawsuit exposure, currently tied to data-breach claims. |
| Narrow AND-threshold model | 3 states use AND or special high-threshold logic | Utah, Tennessee, and Florida require revenue plus volume or special platform conditions, unlike the more common OR-threshold model. |
Primary source check date_retrieved: 2026-05-19. Spot-checked against California CPPA current CCPA text, Virginia VCDPA code, Colorado Attorney General CPA resources, Texas Attorney General TDPSA guidance, and Maryland General Assembly MODPA bill record. Applicability thresholds re-checked date_retrieved: 2026-08-02 against the Montana Legislature SB 297 bill record (which lowered the MCDPA trigger to 25,000 consumers, or 15,000 with 25%+ of revenue from data sales, effective October 1, 2025) and the Tennessee Attorney General TIPA guidance. For real-world fine amounts behind the penalty column, see the privacy enforcement and penalties tracker.
Comparing consumer rights as well as compliance duties? See how each state's data deletion rights compare with the right to be forgotten.
Processing fingerprints, face scans, or voiceprints? Run the biometric privacy laws by state checker to compare consent, retention, and enforcement requirements beyond the comprehensive-law chart.
Our free calculator analyzes your business details and tells you exactly which state privacy laws you need to comply with.
Every US state with a comprehensive consumer privacy law on the books, sortable by effective date, cure period, or maximum per-violation penalty. The “Applies When” column shows the statutory trigger for each state — the consumer counts, revenue floors, and data-sale shares that decide whether the law reaches your business at all. Last updated 2026-10-12.
Swipe the table sideways to see every column — the state stays pinned.
| Law | Applies When | GPC Required | Action | ||||
|---|---|---|---|---|---|---|---|
| ALAlabamaAlabama data privacy law guide | APDPA | May 2027 | 25,000 consumers, or 25%+ of revenue from data sales | No | 45 days | $15,000 | |
| CACaliforniaCalifornia data privacy law guide | CCPA/CPRA | Jan 2020 | $26.625M revenue, or 100,000 consumers, or 50%+ of revenue from data sales | Yes | None | $7,988 | |
| COColoradoColorado data privacy law guide | CPA | Jul 2023 | 100,000 consumers, or 25,000 consumers with 50%+ of revenue from data sales | Yes | None | $20,000 | |
| CTConnecticutConnecticut data privacy law guide | CTDPA | Jul 2023 | 35,000 consumers, or any processing of sensitive data or any sale of personal data | Yes | None | $5,000 | |
| DEDelawareDelaware data privacy law guide | DPDPA | Jan 2025 | 35,000 consumers, or 10,000 consumers with 20%+ of revenue from data sales | Yes | None | $10,000 | |
| FLFloridaFlorida data privacy law guide | FDBR | Jul 2024 | $1B revenue AND further platform or ad conditions | No | 45 days | $50,000 | |
| INIndianaIndiana data privacy law guide | INCDPA | Jan 2026 | 100,000 consumers, or 25,000 consumers with 50%+ of revenue from data sales | No | 30 days | $7,500 | |
| IAIowaIowa data privacy law guide | ICDPA | Jan 2025 | 100,000 consumers, or 25,000 consumers with 50%+ of revenue from data sales | No | 90 days | $7,500 | |
| KYKentuckyKentucky data privacy law guide | KCDPA | Jan 2026 | 100,000 consumers, or 25,000 consumers with 50%+ of revenue from data sales | No | 30 days | $7,500 | |
| LALouisianaLouisiana data privacy law guide | LDPA | Jan 2027 | $25M revenue, or 75,000 consumers, or 50%+ of revenue from data sales | Yes | 30 days | $5,000 | |
| MDMarylandMaryland data privacy law guide | MODPA | Oct 2025 | 35,000 consumers, or 10,000 consumers with 20%+ of revenue from data sales | Yes | 60 days | $10,000 | |
| MNMinnesotaMinnesota data privacy law guide | MCDPA | Jul 2025 | 100,000 consumers, or 25,000 consumers with 25%+ of revenue from data sales | Yes | None | $7,500 | |
| MTMontanaMontana data privacy law guide | MCDPA | Oct 2024 | 25,000 consumers, or 15,000 consumers with 25%+ of revenue from data sales | Yes | None | $7,500 | |
| NENebraskaNebraska data privacy law guide | NDPA | Jan 2025 | No numeric threshold — see conditions | Yes | 30 days | $7,500 | |
| NHNew HampshireNew Hampshire data privacy law guide | NHPA | Jan 2025 | 35,000 consumers, or 10,000 consumers with 25%+ of revenue from data sales | Yes | None | $10,000 | |
| NJNew JerseyNew Jersey data privacy law guide | NJDPA | Jan 2025 | 100,000 consumers, or 25,000 consumers with any revenue or discount from selling personal data | Yes | None | $10,000 | |
| OKOklahomaOklahoma data privacy law guide | OKCDPA | Jan 2027 | 100,000 consumers, or 25,000 consumers with 50%+ of revenue from data sales | No | 30 days | $7,500 | |
| OROregonOregon data privacy law guide | OCPA | Jul 2024 | 100,000 consumers, or 25,000 consumers with 25%+ of revenue from data sales | Yes | None | $7,500 | |
| RIRhode IslandRhode Island data privacy law guide | RIDTPPA | Jan 2026 | 35,000 consumers, or 10,000 consumers with 20%+ of revenue from data sales | No | None | $10,000 | |
| TNTennesseeTennessee data privacy law guide | TIPA | Jul 2025 | $25M revenue AND (175,000 consumers, or 25,000 consumers with 50%+ of revenue from data sales) | No | 60 days | $7,500 | |
| TXTexasTexas data privacy law guide | TDPSA | Jul 2024 | No numeric threshold — see conditions | Yes | 30 days | $7,500 | |
| UTUtahUtah data privacy law guide | UCPA | Dec 2023 | $25M revenue AND (100,000 consumers, or 25,000 consumers with 50%+ of revenue from data sales) | No | 30 days | $7,500 | |
| VTVermontVermont data privacy law guide | VDPOSA | Jan 2028 | 35,000 consumers, or 3,000 consumers whose sensitive data is processed or whose personal data is sold | Yes | 60 days | $10,000 | |
| VAVirginiaVirginia data privacy law guide | VCDPA | Jan 2023 | 100,000 consumers, or 25,000 consumers with 50%+ of revenue from data sales | No | 30 days | $7,500 |