US State Privacy Compliance Deadlines & Timeline
Every 2026 and 2027 US state privacy deadline we have verified against primary sources — effective dates, enforcement starts, cure-period sunsets, data-broker registration dates, cybersecurity-audit milestones, and geolocation restrictions.
8 upcoming deadlines · 48 total events tracked
Reviewed by PrivacyLawMap editorial team · Last verified: 2026-08-02
Need enforcement context for a missed date? The CCPA, CPRA, and state privacy penalties tracker shows the fines and settlement patterns regulators have already announced.
2023
CPRA Amendments Take Effect
The California Privacy Rights Act (CPRA) amendments to the CCPA became operative, expanding consumer rights and creating the California Privacy Protection Agency (CPPA).
PastVCDPA Effective Date
The Virginia Consumer Data Protection Act (VCDPA) became effective, making Virginia the second state with a comprehensive privacy law.
PastCPRA Enforcement Begins
The California Privacy Protection Agency (CPPA) began enforcing the CPRA amendments. Enforcement is retroactive to January 1, 2023.
PastCTDPA Effective Date
The Connecticut Data Privacy Act (CTDPA) became effective, introducing comprehensive data privacy rights for Connecticut residents.
PastCPA Effective Date
The Colorado Privacy Act (CPA) became effective, requiring businesses to honor universal opt-out mechanisms by July 1, 2024.
PastUCPA Effective Date
The Utah Consumer Privacy Act (UCPA) became effective. Notable for its more business-friendly approach with no private right of action.
Past2024
California Data Broker Registration Deadline
Data brokers that operated in the prior calendar year must register with the California Privacy Protection Agency by January 31. Missing the annual deadline can trigger a separate $200-per-day registration fine under the Delete Act (SB 362).
PastColorado Universal Opt-Out Mechanism Required
Colorado began requiring businesses to honor universal opt-out mechanisms, including Global Privacy Control (GPC).
PastTDPSA Effective Date
The Texas Data Privacy and Security Act (TDPSA) became effective. Applies to businesses operating in Texas with no revenue or data processing threshold.
PastOCDPA Effective Date
The Oregon Consumer Data Privacy Act (OCDPA) became effective, with a 30-day cure period that sunsets on January 1, 2026.
PastFlorida Digital Bill of Rights Effective Date
The Florida Digital Bill of Rights (FDBR) became effective, with a high applicability threshold of $1 billion in global revenue.
PastMTCDPA Effective Date
The Montana Consumer Data Privacy Act (MTCDPA) became effective, applying to businesses that process data of 50,000+ Montana consumers.
Past2025
Delaware DPDPA Effective Date
The Delaware Personal Data Privacy Act (DPDPA) became effective. Notable for including nonprofit organizations in its scope.
PastIowa ICDPA Effective Date
The Iowa Consumer Data Protection Act (ICDPA) became effective. More business-friendly with permanent 90-day cure period.
PastNew Hampshire NHDPA Effective Date
The New Hampshire Data Privacy Act became effective, closely modeled after the Connecticut CTDPA.
PastConnecticut CTDPA Cure Period Sunsets
The 60-day cure period under the Connecticut Data Privacy Act (CTDPA) sunsets, removing the automatic opportunity to cure violations before enforcement.
PastConnecticut Universal Opt-Out Mechanism Required
Connecticut begins requiring businesses to honor universal opt-out mechanisms such as Global Privacy Control (GPC).
PastNew Jersey NJDPA Effective Date
The New Jersey Data Privacy Act (NJDPA) became effective, with broad applicability and protections for sensitive data including financial data.
PastCalifornia Data Broker Registration Deadline (2025)
Annual data broker registration deadline with the CPPA. Failure to register may result in penalties of $200 per day.
PastTexas TDPSA Cure Period Consideration
The Texas Attorney General will begin considering cure period requests as a factor, rather than granting automatic cure periods.
PastTennessee TIPA Effective Date
The Tennessee Information Protection Act (TIPA) becomes effective, with an affirmative defense for businesses following NIST privacy framework.
PastMinnesota MCDPA Effective Date
The Minnesota Consumer Data Privacy Act (MCDPA) became effective for most covered controllers. It includes GPC/universal opt-out support, profiling transparency rights, data privacy and protection assessments, and AG enforcement with no private right of action.
PastNebraska NDPA Effective Date
The Nebraska Data Privacy Act becomes effective, applying broadly to businesses operating in Nebraska without revenue thresholds.
PastOregon HB 3875 Amendments Effective
Oregon HB 3875 takes effect, requiring motor vehicle manufacturers and their affiliates to comply with the Oregon Consumer Privacy Act for personal data obtained from a consumer's use of a motor vehicle, regardless of the law's usual consumer-count thresholds.
PastMaryland MODPA Effective Date
The Maryland Online Data Privacy Act (MODPA) becomes effective. One of the strongest state privacy laws with data minimization requirements, a 60-day cure period until April 1, 2027, and strong minor protections.
PastMontana SB 297 Amendments Effective
Montana SB 297 amends the Montana Consumer Data Privacy Act with new thresholds (25,000 consumers or 15,000 if 25%+ revenue from data sales), adds a duty of care and assessment requirements for minors, removes the 60-day notice-and-cure provision, and authorizes the Attorney General to issue civil investigative demands and request relevant data protection assessments.
Past2026
California DROP Launches for Consumer Requests
CalPrivacy launched the Delete Request and Opt-out Platform (DROP), allowing California residents to submit one deletion request to all active registered data brokers. Broker processing obligations begin separately on August 1, 2026.
PastOregon OCDPA Cure Period Sunsets
The 30-day cure period under the Oregon Consumer Data Privacy Act sunsets on January 1, 2026.
PastIndiana ICDPA Effective Date
The Indiana Consumer Data Protection Act becomes effective, closely modeled after Virginia's VCDPA.
PastKentucky KCDPA Effective Date
The Kentucky Consumer Data Privacy Act becomes effective, providing standard consumer rights including access, deletion, and opt-out of sale.
PastRhode Island RIDPPA Effective Date
The Rhode Island Data Privacy and Protection Act becomes effective, establishing comprehensive privacy protections for Rhode Island consumers.
PastTexas Responsible AI Governance Act (TRAIGA) Effective
The Texas Responsible AI Governance Act (HB 149) takes effect, imposing obligations on AI developers and deployers, amending the TDPSA to require processors to protect personal data processed by AI systems, and requiring government entities to disclose AI interactions.
PastNebraska Age-Appropriate Design Code (LB 504) Effective
Nebraska's Age-Appropriate Online Design Code Act (LB 504) takes effect, requiring covered online services to implement privacy-by-design for users under 18, prohibiting dark patterns, and mandating parental control tools enabled by default for children under 13.
PastCCPA Cybersecurity Audit & Risk Assessment Regulations Effective
New CCPA regulations requiring cybersecurity audits and risk assessments take effect. Businesses with $25M+ revenue processing data of 250,000+ consumers or sensitive data of 50,000+ consumers must begin conducting risk assessments for high-risk processing activities. Note: ADMT consumer opt-out rights under these regulations have a separate compliance date of January 1, 2027.
PastMaryland MODPA Enforcement Begins
The Maryland Attorney General begins enforcement of the Maryland Online Data Privacy Act (MODPA). Regulatory actions apply only to collection and processing activities occurring after this date. Organizations receive 60 days to cure violations once notified during the initial enforcement period.
PastCOPPA Rule Amendments Compliance Deadline
The deadline for operators to comply with the FTC's 2025 COPPA Rule amendments. Key changes include expanded personal information definition (biometric identifiers, government-issued IDs, phone numbers), mandatory written information security programs, written data retention policies, and separate parental consent for third-party data disclosures.
PastVirginia SB 338 Geolocation Data Sale Ban Effective
Virginia SB 338, signed by Governor Spanberger on April 13, 2026, takes effect. Controllers are prohibited from selling precise geolocation data concerning Virginia consumers. Violations carry penalties up to $7,500 per violation under the VCDPA enforcement framework.
PastConnecticut SB 1295 Major Amendments Effective
Connecticut SB 1295 overhauls the CTDPA: lowers the base applicability threshold from 100,000 to 35,000 consumers; removes processing thresholds for sensitive data and data sales; eliminates the entity-level GLBA exemption for financial institutions; requires disclosure of personal data use for LLM training; adds consumer right to contest profiling results; expands sensitive data definition to include neural data and transgender/nonbinary status; and strengthens minor protections with a ban on targeted advertising and data sale for minors.
PastNebraska LB 504 Enforcement Begins
The Nebraska Attorney General begins enforcement of the Age-Appropriate Online Design Code Act (LB 504). Violations constitute deceptive trade practices with penalties up to $50,000 per violation.
PastCalifornia DROP Deletion Processing Begins
Registered data brokers must begin processing consumer deletion requests through the California Delete Act's Delete Request and Opt-out Platform (DROP). Brokers must download requests at least once every 45 days and report each request's status within 45 days of download. Failure to delete information as required can incur a $200-per-request fine for each day of noncompliance.
Past2027
Utah HB 357 Motor Vehicle Data Privacy Effective
Utah HB 357 takes effect, extending the UCPA to motor vehicle manufacturers regardless of standard applicability thresholds. Except for models that are not technologically capable, manufacturers must provide in-vehicle privacy controls starting with 2030 model year vehicles.
Oklahoma OKCDPA Effective Date
The Oklahoma Consumer Data Privacy Act (OKCDPA/SB 546), signed by Governor Kevin Stitt on March 20, 2026, becomes effective. Oklahoma is the 20th state with a comprehensive consumer data privacy law.
CCPA ADMT Consumer Opt-Out Rights Effective
Businesses must comply with new automated decision-making technology (ADMT) consumer rights under CCPA regulations finalized in September 2025. Consumers gain the right to opt out of ADMT processing used for significant decisions affecting financial services, housing, education, employment, or healthcare. Businesses must provide pre-use notices explaining ADMT logic and allow consumers to request human review of ADMT-driven decisions.
2028
California Delete Act Data Broker Audit Cycle Begins
Beginning January 1, 2028, data brokers must undergo an independent third-party audit of Delete Act compliance every three years. Brokers must retain each audit report for at least six years and provide it to CalPrivacy upon written request.
CCPA Cybersecurity Audit Certification Due (Tier 1: >$100M Revenue)
First cybersecurity audit certification of completion is due to the California Privacy Protection Agency (CPPA) for Tier 1 businesses with annual gross revenue greater than $100 million. The audit must cover calendar year 2027. Per CCPA regulations finalized September 23, 2025 (Title 11, Div. 6, Ch. 1, §§ 7120-7124), audits must be conducted by an independent auditor and assess each cybersecurity safeguard. Tier 2 ($50M-$100M) certifications are due April 1, 2029; Tier 3 (<$50M) are due April 1, 2030.
California Risk Assessment Attestation & Summary Due
First risk-assessment attestation and summary submission is due to the CPPA. Risk assessments themselves must be conducted on an ongoing basis from January 1, 2026 onward for processing activities that present a significant risk to consumer privacy (selling/sharing personal information, processing sensitive personal information, using ADMT for significant decisions, training ADMT/AI on personal information, or extensive profiling). The 2028-04-01 deadline is the first attestation submission window covering pre-existing high-risk processing.
2029
CCPA Cybersecurity Audit Certification Due (Tier 2: $50M-$100M Revenue)
Cybersecurity audit certification of completion is due to the CPPA for Tier 2 businesses with annual gross revenue between $50 million and $100 million. The audit must cover calendar year 2028. Same independent-auditor and substantive scope requirements apply as Tier 1.
2030
CCPA Cybersecurity Audit Certification Due (Tier 3: <$50M Revenue)
Cybersecurity audit certification of completion is due to the CPPA for Tier 3 businesses with annual gross revenue under $50 million that meet the audit applicability threshold (e.g., 50%+ revenue from selling/sharing personal information, or processing of 250,000+ consumers or 50,000+ sensitive records). The audit must cover calendar year 2029.