More than twenty states now have comprehensive consumer privacy statutes, and no two impose quite the same duties. This hub follows new enactments, amendments, and effective dates, with attention to where the laws actually diverge rather than where they merely look similar.
State Comprehensive Privacy Laws
November 2, 2026
Montana enacted its Consumer Data Privacy Act in 2023 and rewrote much of it two years later. Senate Bill 297, in force since October 1, 2025, halved the main threshold, ended the nonprofit exemption, added a duty of care toward minors that reaches businesses of any size, and struck the notice-and-cure step before an Attorney General action.
Read more →
State Comprehensive Privacy Laws
October 26, 2026
Iowa's chapter 715D, enacted as Senate File 262 and in force since January 1, 2025, is built from fewer parts than its neighbors. It has nine sections, four consumer rights, a 90-day response window, notice and opt-out in place of consent for sensitive data, no assessment requirement, and a 90-day cure with no end date.
Read more →
State Comprehensive Privacy Laws
October 26, 2026
Kentucky's privacy statute, House Bill 15 of 2024, took effect January 1, 2026 at KRS 367.3611 to 367.3629. A 2025 act widened its health-data exemptions before it ever applied, its 30-day cure has no expiry, penalties flow to a dedicated fund, and the Attorney General invoked it eight days after it began.
Read more →
State Comprehensive Privacy Laws
October 26, 2026
Nebraska's design code, LB 504, was approved May 30, 2025 and became operative January 1, 2026. LB 838 rewrote its coverage test, more than doubled its list of engagement features and added two sections, effective July 18, 2026. Penalties of up to $50,000 became available July 1, 2026, and the Attorney General first pleaded the Act in October 2026.
Read more →
State Comprehensive Privacy Laws
October 26, 2026
Nebraska's Data Privacy Act, sections 1 to 30 of LB 1074 (2024), took effect January 1, 2025 at sections 87-1101 to 87-1130. It counts no consumers, reaching any business outside the federal small-business definition, and it still binds small businesses on selling sensitive data. Its cure demands proof, and no enforcement under it was found.
Read more →
State Comprehensive Privacy Laws
October 26, 2026
RSA chapter 507-H, in force since January 1, 2025, reaches businesses at 35,000 consumers, requires opt-out signals, conditions teen targeting on consent, and from 2027 bars selling a child's data. Violations are prosecuted under the consumer protection act at up to $10,000 each, and the chapter grants no rulemaking power.
Read more →
State Comprehensive Privacy Laws
October 19, 2026
Minnesota's Consumer Data Privacy Act, Minn. Stat. 325M.10 to 325M.21, has applied since July 31, 2025 to entities that control or process data on 100,000 Minnesotans, or 25,000 with a sale-revenue test. It adds a third-party list right and a written policy inventory to the familiar model, and since January 31, 2026 the Attorney General may sue without a warning letter.
Read more →
State Comprehensive Privacy Laws
October 19, 2026
Tennessee's privacy statute, enacted as Public Chapter 408 of 2023 and in force since July 1, 2025, combines a $25 million revenue floor with high consumer counts, broad entity exemptions, a permanent 60-day cure, an affirmative defense for programs aligned to the NIST Privacy Framework, and court-awarded treble damages for willful violations.
Read more →
State Comprehensive Privacy Laws
October 5, 2026
Florida's Digital Bill of Rights, enacted by SB 262 in 2023, assigns most of its duties to a controller defined so narrowly that a $1 billion revenue floor and one of three business-model tests must both be met. One section, 501.715, reaches any for-profit business collecting Floridians' data that sells sensitive data, and 2024 rules fill in the enforcement detail.
Read more →
State Comprehensive Privacy Laws
October 5, 2026
Virginia has amended its Consumer Data Protection Act twice for minors. Chapters 840 and 844 of 2024 restricted processing of a known child's data and required parental consent under COPPA from January 1, 2025. Chapter 703 of 2025 capped social media use by users under 16 at one hour a day, a rule a federal court preliminarily enjoined as to NetChoice members in February 2026.
Read more →
State Comprehensive Privacy Laws
September 21, 2026
Substitute Senate Bill 1295 became Public Act 25-113 on June 24, 2025. Its Data Privacy Act sections took effect together on July 1, 2026: a lower threshold, two no-threshold triggers, more sensitive data, profiling rights, impact assessments and a ban on selling teenagers' data. Public Act 26-64 amends several of the same sections again from October 1, 2026.
Read more →
State Comprehensive Privacy Laws
September 21, 2026
Chapter 121 of the Laws of 2024 added article 39-FF, sections 899-ee to 899-mm, to New York's General Business Law. It has applied since June 20, 2025 to operators whose users are known minors or whose services are primarily directed to minors. The Attorney General issued an advance notice in 2024 and implementation guidance in May 2025, but has not published proposed rules.
Read more →
State Comprehensive Privacy Laws
September 14, 2026
The Maryland Online Data Privacy Act has applied since October 1, 2025, but not at the section numbers its bill record gives, or in the form its chapter law's plain text suggests. This post sets out the statute as the General Assembly now publishes it, the Attorney General's reading of its minimization rule, and the immigration-enforcement amendments effective July 1, 2026.
Read more →
State Comprehensive Privacy Laws
September 14, 2026
Vermont enacted its Age-Appropriate Design Code as Act 63 of 2025, signed June 12, 2025. The substantive duties begin on January 1, 2027, but the Attorney General's rulemaking powers took effect in July 2025 and proposed rules are open for comment until October 2, 2026. This post covers its definitions and duties and compares them with the California provisions the Ninth Circuit has ruled on.
Read more →
State Comprehensive Privacy Laws
August 24, 2026
Twenty-four states have enacted a comprehensive consumer privacy statute. Twenty are in force as of August 2026 and four take effect between 2027 and 2028. This guide charts every one against the same questions, with each cell drawn from the statute cited in its row.
Read more →
CCPA / CPRA
August 12, 2026
The CCPA gives California residents seven rights over their personal information, each with its own mechanics, exceptions and deadlines. This guide sets out what each right requires of a covered business, how verification works, when a request can be refused, and what the statute permits by way of charging for data.
Read more →
CCPA / CPRA
August 12, 2026
The California Consumer Privacy Act does not apply to every company that touches Californian data. It applies to for-profit entities that do business in California and meet one of three thresholds. This explains what each threshold counts, how the definitions of business, service provider and third party divide responsibility, and which categories of data fall outside the statute.
Read more →
Consumer Health Data
August 12, 2026
Most health data collected by apps, wearables and websites falls outside HIPAA, which reaches only covered entities and their business associates. Washington's My Health My Data Act was the first US statute written specifically to close that gap, and it is enforceable by individuals rather than only by the state.
Read more →