Privacy Law by State

Three Layers of State Privacy Law

State privacy law comes in three forms, and a single state can have all three.

Comprehensive consumer privacy laws govern personal data across industries rather than regulating one sector. They define who counts as a controller, usually by the number of state residents whose data a business handles, and they give residents rights over that data. Twenty-two of the 24 grant the same seven rights: access, correction, deletion, portability, and opt-outs from sale, from targeted advertising and from profiling used for decisions with legal or similarly significant effects. Every one of the 24 is enforced by the state attorney general or an office within it. California is the only state whose comprehensive law carries a private right of action, and it is narrow: it reaches breaches of defined categories of unencrypted and unredacted personal information resulting from a failure to maintain reasonable security, and nothing else. The State Privacy Law Comparison sets all 24 side by side on thresholds, rights, sensitive data, cure periods and penalties.

Sectoral statutes regulate one kind of information or one activity. Illinois’s Biometric Information Privacy Act (740 ILCS 14) requires written notice and a written release before a private entity collects a biometric identifier, and it is the only state biometric statute with a broad private right of action, at $1,000 per negligent and $5,000 per intentional or reckless violation. Texas and Washington also regulate biometric identifiers but reserve enforcement to the state, as the biometric privacy guide describes. Washington’s My Health My Data Act and Nevada’s NRS 603A.430 regulate consumer health data held by companies HIPAA does not reach (consumer health data guide). California, Vermont, Texas and Oregon run data broker registries (data broker guide).

Breach notification laws exist in every state, and no two set the same combination of deadline, regulator and threshold. Of the 48 states charted in the breach notification guide, 21 set a fixed outer limit for notifying individuals (five at 30 days, eleven at 45 and five at 60) and 27 use a reasonableness standard with no stated number. Maryland and Massachusetts require notice to the regulator before individuals are notified, reversing the order every other state uses.

The 24 Comprehensive Laws, by Effective Date

California stood alone for three years before a second state joined it. Four statutes then took effect in 2023, four in 2024, eight in 2025 and three in the first half of 2026. The figures below are as of August 2026, from the state pages and the comparison guide.

States Without a Comprehensive Law

Twenty-six states have no comprehensive consumer privacy law: Alaska, Arizona, Arkansas, Georgia, Hawaii, Idaho, Illinois, Kansas, Maine, Massachusetts, Michigan, Mississippi, Missouri, Nevada, New Mexico, New York, North Carolina, North Dakota, Ohio, Pennsylvania, South Carolina, South Dakota, Washington, West Virginia, Wisconsin and Wyoming. Illinois is on this list despite BIPA, because BIPA governs biometric identifiers only. Washington is on it despite the My Health My Data Act for the same reason. The pages for these states describe their sectoral statutes, their breach notification law and whatever enforcement record could be found for them.

What Each State Page Contains

• The state’s comprehensive law, where it has one: its citation, effective date, who it covers and the rights it gives residents.
• Sector-specific statutes, such as biometric, health data, data broker, student data and employee privacy laws, each with its citation.
• The breach notification statute: what triggers it, the deadline for notifying individuals and when the attorney general or another regulator is notified.
• The enforcement record, where one could be found in a primary source: actions the attorney general or a court has taken under the state’s privacy laws, linked to the release or docket.
• Pending legislation where there is any, the federal laws that apply in every state, and a set of frequently asked questions.
• A numbered list of sources at the foot of the page, and the date the page was last checked.

Guides That Cover Several States

• State Privacy Law Comparison: All 24 Comprehensive Statutes Side by Side
• State Data Breach Notification Requirements, Compared Across 48 States
• Biometric Privacy Statutes Outside Illinois, and Who Gets to Enforce Them
• Health Data Laws That Reach the Companies HIPAA Never Touched
• Data Broker Registration: The Four State Registries and What They Require
• Employee Privacy Under State Law, in the Order the Statutes Arrived