Question 1

Who does the Tennessee Information Protection Act (TIPA) apply to?

Accepted Answer

The TIPA applies to controllers and processors that (1) conduct business in Tennessee or produce products/services targeted to Tennessee residents, AND (2) exceed $25 million in annual revenue, AND (3) either (a) control or process personal data of 175,000+ Tennessee consumers in a calendar year, or (b) derive more than 50% of gross revenue from sale of personal data AND process data of 25,000+ consumers. This triple-AND threshold is the narrowest among all 21 state comprehensive privacy laws — only Utah UCPA uses a similar AND structure. Entity-level exemptions apply to HIPAA-covered entities, GLBA financial institutions, nonprofits, higher education institutions, insurers, and state agencies. Most small and mid-market businesses fall below the $25M revenue threshold and are therefore outside TIPA's scope.

Question 2

What is the NIST Privacy Framework affirmative defense under the TIPA?

Accepted Answer

Tenn. Code Ann. § 47-18-3213 provides an affirmative defense to any TIPA cause of action for controllers and processors that create, maintain, and comply with a written privacy program that reasonably conforms to the NIST Privacy Framework (v1.0 when enacted, now v1.1 as of April 2024) or a successor framework designated by the AG. To invoke the defense, a business must document its NIST Core Categories (IDENTIFY-P, GOVERN-P, CONTROL-P, COMMUNICATE-P, PROTECT-P), retain the written program, maintain data inventory and processing records, and produce the documentation during enforcement. Tennessee is the only U.S. state to codify a NIST-conforming affirmative defense — Connecticut SB 1295 added a narrower AI-disclosure safe harbor but not a framework-conformance defense. The defense does not automatically defeat a claim; the business must plead and prove conformance.

Question 3

What is the cure period under the TIPA and what are the penalties?

Accepted Answer

The TIPA provides a mandatory 60-day cure period under § 47-18-3209(b) before the AG may bring an enforcement action. After AG notice of alleged violation, the business has 60 days to cure the violation and provide written notice of cure. Civil penalties are capped at $7,500 per violation. Critically, § 47-18-3209(c) permits treble damages for willful violations, raising the effective maximum to $22,500 per willful violation — the highest per-violation exposure among cure-period states. Every comprehensive-law cure period that carried a statutory sunset has now closed: CA, CT, CO, MT, RI, DE and NH lost theirs, and New Jersey's mandatory 30-day window ended July 1, 2026 (NJ Division of Consumer Affairs NJDPL FAQ, date_retrieved: 2026-07-23). Tennessee's 60-day cure period is statutorily permanent — there is no automatic sunset provision.

Question 4

What sensitive data categories require opt-in consent under the TIPA?

Accepted Answer

Eight sensitive data categories require opt-in consent: (1) racial or ethnic origin, (2) religious beliefs, (3) mental or physical health diagnosis or treatment, (4) sexual orientation, (5) citizenship or immigration status, (6) genetic or biometric data processed for unique identification, (7) precise geolocation data (within a radius of 1,750 feet / 533.4 meters), and (8) personal data collected from a known child under 13 (requiring COPPA-verifiable parental consent). The TIPA adopts a GDPR-style consent definition at § 47-18-3202(5) requiring "freely given, specific, informed, and unambiguous" consent — bundled consent, pre-ticked boxes, and inactivity-based consent are not valid. Businesses must maintain consent records with timestamps, scope, and withdrawal mechanism.

Question 5

Does Tennessee require Global Privacy Control (GPC) recognition?

Accepted Answer

No. The TIPA does not require businesses to recognize universal opt-out mechanisms such as GPC. Tennessee joins Virginia, Indiana, Iowa, Kentucky, Utah, and Rhode Island as the seven comprehensive-privacy-law states that do not mandate GPC. Instead, controllers must provide a clear and conspicuous opt-out link (e.g., "Your Privacy Choices") and at least one additional opt-out method. This contrasts with the 12 GPC-mandating states: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas. Multistate controllers generally still honor GPC uniformly because the operational cost of bifurcated processing typically exceeds the cost of universal honor — and a future TIPA amendment could add GPC.

Question 6

How does the TIPA compare to the CCPA?

Accepted Answer

Six key differences: (1) Applicability — TIPA uses AND logic ($25M revenue + consumer count + business-in-state), while CCPA uses OR logic ($25M revenue OR 100,000 consumers OR 50%+ revenue from sale), making TIPA scope much narrower; (2) Private right of action — TIPA has none, CCPA provides a breach-based PRA with statutory damages of $100-$750 per consumer; (3) Cure period — TIPA provides 60 days, CCPA sunset its cure period effective January 1, 2023; (4) Regulator — TIPA is enforced by AG Skrmetti; CCPA is enforced by both CA AG and the CPPA (first dedicated U.S. privacy regulator); (5) Affirmative defense — TIPA uniquely provides a NIST-conforming affirmative defense; CCPA does not; (6) Sensitive data — TIPA treats sensitive data as opt-in; CCPA treats it as opt-out with a "limit use" right. For multistate programs, CCPA obligations generally satisfy TIPA baseline, but TIPA-specific AND-logic scoping and NIST documentation should be layered.

Question 7

How does the TIPA compare to Virginia VCDPA?

Accepted Answer

The TIPA and VCDPA are both AG-enforced OR/AND-threshold state laws with opt-out-of-sale/ads/profiling, but key differences: (1) Threshold logic — TIPA is AND ($25M revenue + 175K consumers), VCDPA is OR (100K consumers OR 25K + 50% revenue from sale); (2) Revenue threshold — TIPA has one, VCDPA does not; (3) NIST affirmative defense — TIPA yes, VCDPA no; (4) Willful-violation enhancement — TIPA provides treble damages, VCDPA caps at $7,500 per violation with no willful multiplier; (5) Cure period — both 60 days; (6) GPC — neither mandates, though VA SB 338 (if signed April 13, 2026) adds geolocation-data sale prohibition which TIPA does not. VCDPA is the older model (2023 effective) and served as the drafting template for TIPA, but Tennessee made three intentional narrowing changes: add $25M revenue floor, add NIST defense, add treble damages for willful violations.

Question 8

Does the TIPA require data protection assessments (DPAs)?

Accepted Answer

Yes. Under § 47-18-3207, controllers must conduct and document data protection assessments for five categories of processing: (1) targeted advertising, (2) sale of personal data, (3) profiling that presents reasonably foreseeable risk of unfair or deceptive treatment, financial harm, physical harm, disparate impact, intrusion on private affairs, or similar significant injury, (4) processing of sensitive data, and (5) any processing activity involving personal data that presents a heightened risk of harm. DPAs must weigh benefits to the controller, consumer, and public against risks to consumers — mitigated by safeguards. The AG may request DPAs during investigation via civil investigative demand; DPA disclosures are confidential and not subject to public disclosure under Tennessee public-records law. DPA requirements are narrower than Colorado's (which requires broader profiling DPAs) but broader than Utah UCPA (which has no DPA requirement).

Question 9

What is AG Skrmetti's enforcement priority for the TIPA?

Accepted Answer

AG Jonathan Skrmetti has publicly signaled first-year TIPA enforcement priorities based on Consumer Protection Division statements and his broader consumer-protection agenda: (1) minors' online safety — Skrmetti joined the 14-state NetChoice v. Bonta amicus, the multistate TikTok deceptive-design investigation, and the 2025 generative-AI chatbot letter; (2) AI and generative-AI deceptive design — the January 2025 AG letter flagged chatbot risks to minors; (3) sensitive-data consent flows — particularly health, biometric, and geolocation data; (4) opt-out link clarity and friction; (5) documented privacy programs — businesses without written programs are disadvantaged in cure-period negotiation. Skrmetti has not announced a TIPA-specific enforcement action as of April 2026 (law active 10 months), but investigations are likely underway given the Consumer Protection Act's broad civil investigative demand power under § 47-18-106.

Question 10

What is the TIPA appeals process for denied consumer rights requests?

Accepted Answer

Under § 47-18-3205(c)(3), controllers must establish a written internal appeals process for consumers whose rights requests are denied. The appeals process must: (1) be clearly described in the privacy notice, (2) be free of charge, (3) respond within 60 days of receipt, (4) include a written explanation of the denial reason, and (5) inform the consumer of their right to submit a complaint to the Tennessee AG if the appeal is denied. A working AG complaint-filing link must appear in the appeal denial notice — failure to provide this link is itself a TIPA violation. Businesses should maintain an appeals log documenting receipt date, decision, rationale, and AG complaint link delivery. This appeals structure parallels VCDPA and KCDPA but differs from CCPA (which has no formal internal appeal requirement).

Tennessee Privacy Law

Overview

Applicability Thresholds

Consumer Rights

Key Changes in 2025-2026

Enforcement Details

Sensitive Data Categories

Universal Opt-Out / GPC Requirements

Minor / Child Protections

Compliance Checklist