State Privacy Law Comparison: All 24 Comprehensive Statutes Side by Side

How Many States Have a Comprehensive Privacy Law

Twenty-four states have enacted a comprehensive consumer privacy statute — a law governing personal data across sectors rather than regulating one industry or one data type. As of August 2026, twenty are in force. Four have been signed but have not reached their effective dates: Oklahoma and Louisiana on January 1, 2027, Alabama on May 1, 2027, and Vermont on January 1, 2028.

The count is worth stating precisely because it is often reported loosely. Statutes regulating a single category — biometric identifiers in Illinois, genetic data in New Mexico, consumer health data in Nevada — are not comprehensive laws and are not counted here, even though they can impose sharper duties within their scope. What follows compares only the cross-sector statutes, and compares each on the terms it states for itself.

Every figure in the tables below is taken from the statute cited in that row. The source list at the foot of this guide links a primary document for each of the twenty-four laws.

The Chronology, and What Each Statute Is Called

Ordering by effective date rather than alphabetically shows the shape of the thing. California stood alone for three years before any second state joined it. Then the pace changed sharply: four statutes took effect in 2023, four more in 2024, eight in 2025, and three in the first half of 2026. Twelve of the twenty-four became enforceable within a twenty-four-month window.

The short names matter for searching case law and enforcement records, and two of them collide: Montana and Minnesota both abbreviate to MCDPA. Colorado is the CPA, an abbreviation also used in secondary writing for the California Privacy Rights Act, though the operative California text is the CCPA as amended rather than a freestanding act.

Applicability Thresholds Compared

The threshold is the first question each statute answers and the one on which they differ most. Three patterns recur. The most common pairs a consumer-count trigger with a lower count coupled to a revenue-share-from-selling-data trigger — Virginia's 100,000 consumers, or 25,000 consumers plus more than 50% of gross revenue from the sale of personal data, is the template most later states followed. A second pattern adds an absolute revenue floor, as Utah and Tennessee do at $25 million. A third dispenses with numbers entirely, which Texas and Nebraska do.

Among the twenty-two statutes that use a consumer count at all, the primary trigger spans a factor of seven. Montana and Alabama sit lowest at 25,000 residents. Connecticut, Delaware, New Hampshire, Maryland, Rhode Island and Vermont sit at 35,000. Louisiana sits at 75,000. Eleven states — California, Virginia, Colorado, Utah, Oregon, Iowa, New Jersey, Minnesota, Indiana, Kentucky and Oklahoma — set it at 100,000, making that the modal figure. Tennessee sits highest at 175,000. Florida sits outside the pattern altogether, reaching only companies above $1 billion in global gross annual revenue that also satisfy one of three business-model tests.

The Statutes With No Numeric Threshold

Texas and Nebraska share a drafting approach that makes them the widest-reaching state privacy laws in the country measured by the number of businesses inside them. Neither states a consumer-count or revenue minimum. Each instead reaches any person that conducts business in the state or produces products or services consumed by its residents, that processes or engages in the sale of personal data, and that is not a small business as defined by the United States Small Business Administration.

Both then keep one duty on the small businesses the applicability test otherwise excludes. Texas section 541.107 and Nebraska section 87-1118 each bar a small business from engaging in the sale of sensitive data without prior consumer consent. The effect is that a company well below the thresholds excluding it in California or Virginia is inside the Texas and Nebraska statutes, and a company small enough to fall outside them is still reached on the sensitive-data question.

Rhode Island arrives at a comparable place by a different route. The section 6-48.1-3 disclosure duties apply to any commercial website or internet service provider doing business in the state or with Rhode Island customers, with no threshold at all; only the section 6-48.1-4 processing obligations are gated by the 35,000-customer count.

Consumer Rights Compared

Rights are where the statutes converge rather than diverge. Twenty-two of the twenty-four grant the same seven: access, correction, deletion, portability, and opt-outs from sale, from targeted advertising, and from profiling in furtherance of decisions producing legal or similarly significant effects.

Two states depart from the template. Iowa grants four — access, deletion, portability and an opt-out of sale — with no right of correction and no opt-out of targeted advertising or profiling, which makes it the narrowest comprehensive statute in the country on this axis. Utah grants six, omitting only the profiling opt-out.

The uniformity of this table is the most consequential single fact in the comparison. A rights-request process built to the seven-right template meets the terms of twenty-two statutes at once, and the divergence that remains sits in the mechanics — response windows, verification standards, appeal rights — rather than in which rights exist at all.

Sensitive Data, and the One Private Right of Action

Opt-in consent before processing sensitive data is the dominant rule: twenty of the twenty-four require it. Four depart. Utah and Iowa require notice and an opportunity to opt out rather than prior consent. California uses a different mechanism again, a right to limit the use and disclosure of sensitive personal information to what is necessary to provide the service. Maryland is the strictest of the twenty-four: collection and processing of sensitive data are confined to what is strictly necessary to provide the requested product or service, and the sale of sensitive data is prohibited outright rather than gated by consent.

On private enforcement the picture is simpler. California is the only state of the twenty-four whose comprehensive statute carries a private right of action, and it is narrow — reaching a breach of defined categories of unencrypted and unredacted personal information resulting from a failure to maintain reasonable security, and nothing else. An ignored access request or a missing opt-out link is a regulator's matter in all twenty-four.

Cure Periods and Their Sunset Dates

The right to cure — a window in which a controller can fix a violation before enforcement proceeds — is the fastest-moving variable in the comparison, and the one most likely to be out of date in a chart compiled a year ago. Four distinct treatments now exist across the twenty-four statutes.

Nine provide a permanent cure period with no sunset: Texas and Utah at 30 days, Iowa at 90, Tennessee at 60, and Nebraska, Indiana, Kentucky, Oklahoma and Alabama on their own terms. Four have lapsed or been repealed: Colorado was repealed for the Act generally on January 1, 2025, Montana removed its provision outright effective October 1, 2025, Oregon lapsed on January 1, 2026, and Minnesota expired on January 31, 2026. Five are discretionary rather than mandatory: Florida and Maryland by their own terms, and Connecticut, Delaware and New Hampshire, which converted from mandatory to discretionary against statutory factors. Connecticut's mandatory 60-day cure ran through December 31, 2024, and from January 1, 2025 its section 42-525(c) lets the Attorney General weigh seven factors in deciding whether to offer one; Delaware and New Hampshire converted on January 1, 2026 against seven and six factors respectively. New Jersey's window closed by its own terms in mid-2026. Rhode Island provides none at all, and California's fixed window was removed by the CPRA, leaving time to cure discretionary there. Louisiana's and Vermont's are time-limited windows that open when the statutes do and close again on stated dates.

The direction of travel is one-way. No state in the group has added a cure period or extended one after the fact; the movement has been from mandatory to discretionary, and from discretionary to none.

Enforcement Authority and Penalty Exposure

Every one of the twenty-four statutes is enforced by the state attorney general or an office within it. Two add to that. Colorado shares authority with district attorneys, and California is the only state with a dedicated regulator — the California Privacy Protection Agency, the first administrative body in the United States created solely to enforce a consumer privacy law, which exercises rulemaking and enforcement powers alongside the Attorney General rather than instead of them.

Stated penalties range from $5,000 per violation in Connecticut to $50,000 in Florida, trebled in three defined circumstances. The most common figure by a wide margin is $7,500. Several states set no privacy-specific figure at all and route violations through an existing consumer protection statute: New Jersey through the Consumer Fraud Act, Louisiana through the Unfair Trade Practices and Consumer Protection Law, Vermont through the Consumer Protection Act, and Maryland through its unfair, abusive or deceptive trade practice provisions.

Per-violation counting is what makes these figures consequential rather than nominal. Colorado states the point explicitly: penalties are counted separately per consumer or per transaction, which turns a $20,000 maximum into an aggregate that scales with the size of the affected population.

Universal Opt-Out Preference Signals

Recognition of a browser-transmitted opt-out signal, such as Global Privacy Control, is a genuine point of divergence, and it is the one axis on which this chart does not claim completeness. Of the twenty-four state records behind this comparison, eight document the treatment of opt-out preference signals against a primary source: Colorado, Connecticut, Delaware, New Hampshire, New Jersey, Indiana, Kentucky and Rhode Island. California's obligation to honour such a signal is stated on its own statute page.

The remaining states were not researched on this specific question, and no claim is made here about what their statutes provide. That gap is recorded rather than filled by inference, because the mechanism differs enough between states — some requiring recognition outright, some allowing it as one of two permitted methods — that a generalisation drawn from the eight would not reliably describe the rest.

Where the Laws Genuinely Diverge

Read across the six tables, the divergence concentrates in four places rather than being spread evenly. Thresholds differ by a factor of seven among the states that use consumer counts, and differ in kind beyond that, with Texas and Nebraska using no number at all and Florida using a revenue floor plus a business-model test. Cure periods differ in whether they exist at all, and are moving. Penalty figures differ by a factor of ten, and the counting rule beneath them differs further. Sensitive data treatment splits four ways.

Against that, consumer rights are close to uniform, the enforcer is the attorney general almost everywhere, and private enforcement is absent everywhere but California. The practical consequence is that the questions of whether a statute applies and what happens when it is broken vary far more between states than the question of what the statute grants a consumer.

What This Chart Does Not Cover

Six axes are compared here. Several others are not, and their absence is deliberate rather than an oversight. Data protection assessment requirements, controller-processor contract terms, response deadlines and appeal mechanics, children's and minors' provisions, and the exemptions for entities and data regulated under HIPAA, the Gramm-Leach-Bliley Act and the Fair Credit Reporting Act all differ between these statutes and are not charted above.

The exemption structures in particular resist tabulation: some states exempt covered entities wholesale while others exempt only the regulated data, and the difference determines whether a healthcare or financial services business is outside the statute or merely outside part of it. Each state page linked from the sources below sets out that state's exemptions against its own text.

Frequently Asked Questions