The Tennessee Information Protection Act: Thresholds, Rights, the NIST Defense and AG Enforcement

The Enacted Text and What Was Read for This Post

The Tennessee Information Protection Act was House Bill 1181 of the 113th General Assembly, substituted for Senate Bill 73. The legislature's bill page records that it passed, was signed by the governor on May 11, 2023, and became Public Chapter No. 408, effective July 1, 2025. The bill page's amendment summary notes that one adopted amendment changed the effective date from July 1, 2024 to July 1, 2025. Section 2 of the chapter adds a new part to Title 47, Chapter 18 (the Consumer Protection Act), numbered sections 47-18-3201 to 47-18-3213.

The Tennessee Code Annotated is published by a commercial vendor and the codified sections could not be retrieved for this post. Everything below is reported from the enrolled public chapter. Section 5 of the chapter asks the Tennessee Code Commission to include the section headings in any compilation, and the codified text may reflect editorial changes not visible in the chapter. One such candidate is noted below.

Thresholds, Including the Revenue Test

Section 47-18-3202 applies the part to persons that "conduct business in this state producing products or services that target residents of this state" and that satisfy both of the following:

1. "Exceed twenty-five million dollars ($25,000,000) in revenue"; and
2. Either control or process personal information of at least 25,000 consumers and derive more than 50 percent of gross revenue from the sale of personal information, or, during a calendar year, control or process personal information of at least 175,000 consumers.

The revenue condition is conjunctive with the data condition, so a business that processes data on millions of Tennesseans but does not exceed $25 million in revenue is outside the part. The statute states no period over which the $25 million is measured; the Attorney General's April 30, 2025 guidance describes it as "more than $25 million in annual revenue" and the 50 percent figure as "gross annual revenue."

Several definitions in section 47-18-3201 narrow the count further. A consumer is "a natural person who is a resident of this state acting only in a personal context," excluding commercial and employment contexts. A sale is "the exchange of personal information for valuable monetary consideration," which does not include non-monetary consideration, and excludes transfers to processors, to affiliates, for a product the consumer requested, of information the consumer made public, and in a merger or bankruptcy. Precise geolocation data is information locating a person "within a radius of one thousand seven hundred fifty feet."

Section 47-18-3210 lists 23 exclusions. Unlike the Minnesota statute (see the post on the MCDPA), Tennessee removes several categories of organization from the part entirely:

• State and local government bodies
• A financial institution, an affiliate of a financial institution, or data subject to Title V of the Gramm-Leach-Bliley Act
• Entities licensed in Tennessee under title 56 as insurance companies, and insurance producers licensed under title 56
• HIPAA covered entities and business associates
• Nonprofit organizations
• Institutions of higher education

The remaining exclusions are data-based: protected health information and other health and research data, FCRA-regulated consumer report activity, Driver's Privacy Protection Act and FERPA data, Farm Credit Act data, employment and benefits data, and information maintained to comply with federal listed-chemical regulation. Controllers that comply with COPPA's verifiable parental consent requirements are deemed compliant with any parental consent obligation in the part.

Consumer Rights and Response Deadlines

Section 47-18-3203(a)(2) requires a controller to comply with an authenticated request to confirm processing and access personal information, correct inaccuracies, delete personal information "provided by or obtained about the consumer," obtain a portable copy of data the consumer provided, and opt out of processing for sale, targeted advertising, or "profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer." A known child's parent or legal guardian may invoke the rights for the child.

Profiling is defined in section 47-18-3201 as "a form of solely automated processing," a narrower formulation than Minnesota's "any form of automated processing"; the difference is examined in the post on Minnesota's profiling right. The decisions covered include "access to basic necessities, such as food and water," an example not found in the Minnesota definition.

Subsection (b) sets the timetable. A controller must respond "without undue delay, but in all cases within forty-five (45) days," with one 45-day extension if it tells the consumer within the first period. A refusal must give a justification and appeal instructions within 45 days. Responses are free up to twice a year; for requests that are "manifestly unfounded, technically infeasible, excessive, or repetitive," the controller may charge a reasonable fee or decline, bearing the burden of showing that character. "Technically infeasible" is a ground that the Minnesota and Colorado provisions do not list.

Subsection (c) requires a conspicuous, free appeal process. The controller must decide an appeal "within sixty (60) days" with a written explanation and, if it denies the appeal, must provide "an online mechanism, if available, or other method through which the consumer may contact the attorney general and reporter to submit a complaint."

Section 47-18-3204 sets controller duties: data minimization and purpose limitation, reasonable security practices, consent before processing sensitive data, COPPA-compliant processing of a known child's sensitive data, a privacy notice listing categories processed, purposes, rights and appeals, and categories sold and buyers, and a clear disclosure of sales or targeted advertising with the means to opt out. Consumers may not be required to create a new account to exercise rights. Contract terms that waive the rights are void under both section 47-18-3204(b) and section 47-18-3211(a).

Two cross-references in the enacted section read oddly against the rest of the chapter. Section 47-18-3204(a)(3) requires data security practices "as described in § 47-18-3213," which is the affirmative defense section. Section 47-18-3204(a)(5) permits differential pricing where the consumer "has exercised the right to opt out pursuant to § 47-18-3203(a)(2)(F)," but the enacted list of rights ends at subdivision (a)(2)(E). Whether the Code Commission conformed either reference in the codified text could not be checked.

Data Protection Assessments

Section 47-18-3206(a) requires a controller to "conduct and document a data protection assessment" of five activities: targeted advertising, sale, profiling presenting a reasonably foreseeable risk of unfair or deceptive treatment or "unlawful disparate impact," financial, physical or reputational injury, offensive intrusion, or other substantial injury, processing of sensitive data, and processing that presents a heightened risk of harm. The assessment must weigh benefits to the controller, consumer, other stakeholders and the public against risks as mitigated by safeguards, factoring in de-identified data, consumer expectations and context.

The Attorney General and Reporter may obtain a relevant assessment by civil investigative demand under subsection (c); assessments "are confidential and not open to public inspection and copying," and disclosure does not waive privilege. Subsection (f) contains a date that predates the Act's own effective date: assessment requirements "apply to processing activities created or generated on or after July 1, 2024, and are not retroactive." The Attorney General's guidance repeats that the requirement reaches activities created on or after July 1, 2024. Section 47-18-3209 separately authorizes a civil investigative demand whenever the office has reasonable cause to believe a violation has occurred or is about to occur.

The NIST Privacy Framework Affirmative Defense

Section 47-18-3213(a) gives a controller or processor "an affirmative defense to a cause of action for a violation of this part" if it "creates, maintains, and complies with a written privacy policy" that meets three conditions:

• It reasonably conforms to the NIST privacy framework "A Tool for Improving Privacy through Enterprise Risk Management Version 1.0." or "other documented policies, standards, and procedures designed to safeguard consumer privacy"
• It is updated to reasonably conform with a subsequent revision of the NIST or comparable framework "within two (2) years of the publication date stated in the most recent revision"
• It "provides a person with the substantive rights required by this part"

Subsection (b) makes the scale and scope of a program appropriate if based on five factors: business size and complexity, the nature and scope of activities, sensitivity of the data, the cost and availability of privacy tools, and compliance with a comparable state or federal law. Subsection (c) adds that certification under the APEC Cross Border Privacy Rules system (for controllers) or Privacy Recognition for Processors system (for processors) may be considered in addition to those factors.

The two-year update clause depends on what NIST publishes. The NIST Computer Security Resource Center page for Privacy Framework 1.1, retrieved October 19, 2026, lists it as an "Initial Public Draft" published April 14, 2025, with comments closed June 13, 2025, and its document history shows only the draft. The statute does not say whether a draft counts as a "revision" with a "publication date." The NIST Privacy Framework page continues to offer version 1.0 alongside the 1.1 materials.

Attorney General Enforcement and Treble Damages

Section 47-18-3212(a) gives the attorney general and reporter "exclusive authority to enforce this part." Subsection (b) requires 60 days' written notice identifying the provisions allegedly violated before any action. If the controller or processor cures within that period and provides "an express written statement that the alleged violations have been cured and that no such further violations shall occur," the office "shall not initiate an action." The cure period has no sunset in the enacted text.

Under subsection (c), the office may sue if violations continue after the cure period or the written statement is breached, seeking a declaratory judgment, preliminary and permanent injunctions, civil penalties, attorney's fees and investigative costs, and other relief. Subsection (d)(1) authorizes "a civil penalty of up to seven thousand five hundred dollars ($7,500) for each violation." Subsection (d)(2) provides that if the court finds the violation willful or knowing, it "may, in its discretion, award treble damages"; the text does not specify the base amount to be trebled. Subsection (f) allows recovery of investigation and preparation expenses, including attorney fees.

Subsection (e) bars private enforcement in terms that reach beyond the part: a violation "shall not serve as the basis for, or be subject to, a private right of action, including a class action lawsuit, under this part or other law." Section 4 of the public chapter preempts conflicting local ordinances and regulations on processing personal data.

The Attorney General's April 30, 2025 guidance summarized the Act for consumers and businesses and directed complaints to the Division of Consumer Affairs complaint portal. No lawsuit, notice of violation or settlement under part 32 was located on the office's site or in searches for this post, so the enforcement record under the Act stands at zero as of October 19, 2026. The office's earlier multistate data-security recoveries are listed on the Tennessee state page. Tennessee's separate breach statute, which takes the opposite position on private suits, is covered in the post on § 47-18-2107.

Frequently Asked Questions