Loading comparison tool...
All 21 signed or enacted US state consumer privacy laws, tracked state by state. Scan the 2026 state privacy law comparison chart, then use the free side-by-side comparison tool to compare any 2–4 states in detail — consumer rights, applicability thresholds, GPC requirements, cure periods, and per-violation penalties — or scroll to the full state privacy laws overview tracker below.
Reviewed by PrivacyLawMap editorial team · Last verified: 2026-08-04 · 21 state privacy laws tracked
Quick comparison of the dimensions that most often change a multi-state compliance plan: applicability thresholds, GPC recognition, cure periods, lawsuit exposure, threshold logic, and effective-date status.
Across the 21 enacted US state privacy laws, the consumer-count trigger ranges from 25,000 consumers in Montana to 175,000 in Tennessee — a 7× spread, and Texas and Nebraska set no numeric threshold at all. The lowest trigger of any kind is 10,000 consumers in Rhode Island, Delaware, New Hampshire, and Maryland, but only for businesses that earn a set share of revenue from selling personal data. Only California, Utah, Tennessee, and Floridastate a minimum annual revenue in the statutory test at all, so revenue is the wrong first question in most states — consumer volume is. Verified 2026-08-04.
| Comparison point | 2026 quick read | Compliance takeaway |
|---|---|---|
| Signed or enacted laws tracked | 21 laws across 21 states | Oklahoma is signed but not yet effective; treat it as a 2027 readiness item. |
| Applicability threshold (who is covered) | 25,000–175,000 consumers, depending on the state | Montana covers businesses at 25,000 consumers while Tennessee waits until 175,000, and Texas and Nebraska set no numeric threshold at all — scope every state separately rather than assuming one national trigger. |
| GPC / universal opt-out required | 12 states require automated opt-out signal recognition | California, Colorado, Connecticut, Montana, Texas, and 7 more are the operational baseline for a national GPC program. |
| No current cure period | 10 states allow immediate enforcement | California, Colorado, Connecticut, Rhode Island, Montana, and 5 more leave little room for a notice-and-fix strategy once enforcement starts. |
| Private lawsuit exposure | 1 state includes a private right of action | California is the only comprehensive-law state in this dataset with consumer lawsuit exposure, currently tied to data-breach claims. |
| Narrow AND-threshold model | 3 states use AND or special high-threshold logic | Utah, Tennessee, and Florida require revenue plus volume or special platform conditions, unlike the more common OR-threshold model. |
Primary source check date_retrieved: 2026-05-19. Spot-checked against California CPPA current CCPA text, Virginia VCDPA code, Colorado Attorney General CPA resources, Texas Attorney General TDPSA guidance, and Maryland General Assembly MODPA bill record. Applicability thresholds re-checked date_retrieved: 2026-08-02 against the Montana Legislature SB 297 bill record (which lowered the MCDPA trigger to 25,000 consumers, or 15,000 with 25%+ of revenue from data sales, effective October 1, 2025) and the Tennessee Attorney General TIPA guidance. For real-world fine amounts behind the penalty column, see the privacy enforcement and penalties tracker.
Comparing consumer rights as well as compliance duties? See how each state's data deletion rights compare with the right to be forgotten.
Processing fingerprints, face scans, or voiceprints? Run the biometric privacy laws by state checker to compare consent, retention, and enforcement requirements beyond the comprehensive-law chart.
Our free calculator analyzes your business details and tells you exactly which state privacy laws you need to comply with.
Every US state with a comprehensive consumer privacy law on the books, sortable by effective date, cure period, or maximum per-violation penalty. The “Applies When” column shows the statutory trigger for each state — the consumer counts, revenue floors, and data-sale shares that decide whether the law reaches your business at all. Last updated 2026-08-04.
Swipe the table sideways to see every column — the state stays pinned.
| Law | Applies When | GPC Required | Action | ||||
|---|---|---|---|---|---|---|---|
| CACaliforniaCalifornia data privacy law guide | CCPA/CPRA | Jan 2020 | $25M revenue, or 100,000 consumers, or 50%+ of revenue from data sales | Yes | None | $7,988 | |
| COColoradoColorado data privacy law guide | CPA | Jul 2023 | 100,000 consumers, or 25,000 consumers with 50%+ of revenue from data sales | Yes | None | $20,000 | |
| CTConnecticutConnecticut data privacy law guide | CTDPA | Jul 2023 | 35,000 consumers, or 25,000 consumers with 25%+ of revenue from data sales | Yes | None | $5,000 | |
| DEDelawareDelaware data privacy law guide | DPDPA | Jan 2025 | 35,000 consumers, or 10,000 consumers with 20%+ of revenue from data sales | Yes | None | $10,000 | |
| FLFloridaFlorida data privacy law guide | FDBR | Jul 2024 | $1B revenue AND further platform or ad conditions | No | 45 days | $50,000 | |
| INIndianaIndiana data privacy law guide | INCDPA | Jan 2026 | 100,000 consumers, or 25,000 consumers with 50%+ of revenue from data sales | No | 30 days | $7,500 | |
| IAIowaIowa data privacy law guide | ICDPA | Jan 2025 | 100,000 consumers, or 25,000 consumers with 50%+ of revenue from data sales | No | 90 days | $7,500 | |
| KYKentuckyKentucky data privacy law guide | KCDPA | Jan 2026 | 100,000 consumers, or 25,000 consumers with 50%+ of revenue from data sales | No | 30 days | $7,500 | |
| MDMarylandMaryland data privacy law guide | MODPA | Oct 2025 | 35,000 consumers, or 10,000 consumers with 20%+ of revenue from data sales | Yes | 60 days | $10,000 | |
| MNMinnesotaMinnesota data privacy law guide | MCDPA | Jul 2025 | 100,000 consumers, or 25,000 consumers with 25%+ of revenue from data sales | Yes | None | $7,500 | |
| MTMontanaMontana data privacy law guide | MCDPA | Oct 2024 | 25,000 consumers, or 15,000 consumers with 25%+ of revenue from data sales | Yes | None | $7,500 | |
| NENebraskaNebraska data privacy law guide | NDPA | Jan 2025 | No numeric threshold — see conditions | Yes | 30 days | $7,500 | |
| NHNew HampshireNew Hampshire data privacy law guide | NHPA | Jan 2025 | 35,000 consumers, or 10,000 consumers with 25%+ of revenue from data sales | Yes | None | $10,000 | |
| NJNew JerseyNew Jersey data privacy law guide | NJDPA | Jan 2025 | 100,000 consumers, or 25,000 consumers with 50%+ of revenue from data sales | Yes | None | $10,000 | |
| OKOklahomaOklahoma data privacy law guide | OKCDPA | Jan 2027 | 100,000 consumers, or 25,000 consumers with 50%+ of revenue from data sales | No | 30 days | $7,500 | |
| OROregonOregon data privacy law guide | OCPA | Jul 2024 | 100,000 consumers, or 25,000 consumers with 25%+ of revenue from data sales | Yes | None | $7,500 | |
| RIRhode IslandRhode Island data privacy law guide | RIDTPPA | Jan 2026 | 35,000 consumers, or 10,000 consumers with 20%+ of revenue from data sales | No | None | $10,000 | |
| TNTennesseeTennessee data privacy law guide | TIPA | Jul 2025 | $25M revenue AND (175,000 consumers, or 25,000 consumers with 50%+ of revenue from data sales) | No | 60 days | $7,500 | |
| TXTexasTexas data privacy law guide | TDPSA | Jul 2024 | No numeric threshold — see conditions | Yes | 30 days | $7,500 | |
| UTUtahUtah data privacy law guide | UCPA | Dec 2023 | $25M revenue AND (100,000 consumers, or 25,000 consumers with 50%+ of revenue from data sales) | No | 30 days | $7,500 | |
| VAVirginiaVirginia data privacy law guide | VCDPA | Jan 2023 | 100,000 consumers, or 25,000 consumers with 50%+ of revenue from data sales | No | 30 days | $7,500 |