Tennessee Privacy Law

The Tennessee Information Protection Act (TIPA) was signed into law on May 11, 2023, and became effective on July 1, 2025. Tennessee's law is notable for requiring both a revenue threshold and a consumer data processing threshold (using AND logic), similar to Utah's approach, making it more business-friendly in terms of applicability. The TIPA provides Tennessee consumers with comprehensive privacy rights, including access, correction, deletion, portability, and opt-out rights for data sales, targeted advertising, and profiling. The law includes an appeals process for denied requests and requires opt-in consent for processing sensitive data. Tennessee also introduced an affirmative defense for businesses that maintain a written privacy program conforming to the NIST privacy framework. The law applies to entities that conduct business in Tennessee or target Tennessee consumers, have annual revenue exceeding $25 million, AND control or process personal data of 175,000 or more consumers, or control or process personal data of 25,000 or more consumers while deriving more than 50% of gross revenue from the sale of personal data. The TIPA includes a 60-day cure period and penalties of up to $7,500 per violation, enforced by the Tennessee Attorney General.