Data Privacy Laws by State: A Complete US Guide

The US Data Privacy Landscape

Unlike the European Union, which adopted a single regulation (the GDPR) covering all member states, the United States has no equivalent omnibus privacy statute. Instead, American data privacy operates on two tracks: federal laws that regulate specific industries, and state laws that fill the gaps with varying levels of ambition.

The federal track includes HIPAA for healthcare data, GLBA for financial data, COPPA for children under 13, and the FTC Act for unfair or deceptive data practices. These laws are powerful within their scope but leave vast categories of personal data unregulated at the federal level.

The state track has accelerated dramatically since California enacted the CCPA in 2018. As of 2026, twenty states have comprehensive privacy laws in effect, covering consumer rights like the ability to access, delete, and opt out of the sale of personal data. The remaining 30 states rely primarily on data breach notification laws and consumer protection statutes to address privacy concerns.

States With Comprehensive Privacy Laws

These 20 states have enacted omnibus consumer data privacy laws granting residents specific rights over their personal data. Click any state for the full guide including statute citations, consumer rights, penalties, and compliance requirements.

Federal Privacy Framework

While there is no comprehensive federal data privacy law, several sector-specific statutes provide strong protections within their domains.

The American Privacy Rights Act (APRA) was the most recent attempt at a comprehensive federal privacy law. It passed a House subcommittee in May 2024 but was never brought to a full committee vote. The bill expired when the 118th Congress adjourned and has not been reintroduced in the 119th Congress.

Data Breach Notification Laws

All 50 states and the District of Columbia require businesses to notify individuals when their personal information is compromised in a data breach. Alabama was the last state to enact a breach notification law in 2018. While every state has one, the specific requirements vary significantly.

Notification timelines range from 30 days (California, Colorado, New York, and Florida) to 45 days (North Carolina, Ohio) to no specific deadline at all (many states use "without unreasonable delay" or "most expedient time possible"). Iowa gives businesses the longest cure period at 90 days. Most states require attorney general notification when breaches exceed a threshold, typically 250 to 1,000 affected residents.

Penalties for failing to notify range from minimal in some states to substantial in others. Texas can impose $100 to $250,000 per breach plus $50,000 per day for delayed notification. Florida assesses $1,000 per day for the first 30 days, escalating to $50,000 per 30-day period, with a $500,000 cap. Massachusetts allows private treble-damages suits under Chapter 93A.

Biometric Privacy Laws

Three states have standalone biometric privacy statutes. Illinois BIPA (740 ILCS 14) is the most consequential, providing a private right of action with damages of $1,000 per negligent violation and $5,000 per intentional violation. Major settlements include Facebook ($650 million), BNSF Railway ($228 million jury verdict), Google ($100 million), and TikTok ($92 million).

Texas CUBI (Bus. & Com. Code Ch. 503) carries penalties up to $25,000 per violation but is enforced only by the attorney general. The Texas AG secured a $1.4 billion settlement with Meta for biometric data violations in 2024. Washington HB 1493 covers biometric identifiers except facial geometry and is enforced under the Consumer Protection Act.

Beyond these standalone laws, most comprehensive state privacy statutes classify biometric data as "sensitive data" requiring opt-in consent before collection, including California, Colorado, Connecticut, Virginia, Oregon, Delaware, Maryland, and Minnesota.

Consumer Rights Under State Law

Comprehensive state privacy laws grant consumers a set of rights over their personal data. While the specifics vary, most states provide these core protections:

• Right to know/access: Request what personal data a business has collected about you. Available in all 20 comprehensive law states.
• Right to delete: Request that a business delete your personal data. Available in all 20 states, though some limit this to data you provided directly.
• Right to opt out of sale: Tell businesses not to sell your personal data or use it for targeted advertising. Available in all 20 states.
• Right to correct: Request that a business fix inaccurate personal data. Available in 18 states (not Iowa or Utah, though Utah adds this in 2026).
• Right to portability: Receive a copy of your data in a portable, machine-readable format. Available in all 20 states.
• Right to non-discrimination: Businesses cannot penalize you for exercising your privacy rights. Explicit in most states.

Minnesota stands out with the broadest consumer rights, including the right to question automated profiling decisions and obtain explanations of the reasoning behind them. Maryland has the strongest data minimization requirements, limiting what businesses can collect regardless of consumer consent. Rhode Island uniquely requires businesses to disclose not just current data recipients but potential future recipients as well.

Enforcement and Penalties

State data privacy laws are enforced almost exclusively by state attorneys general. California is the only state with a dedicated privacy enforcement agency (the California Privacy Protection Agency, or CPPA). No state other than California provides a general private right of action for privacy violations, though California's is limited to data breach scenarios.

Penalties vary significantly. Texas has led enforcement with its $1.375 billion settlement with Google and $1.4 billion settlement with Meta in 2024. California's CPPA issued its largest fine of $1.35 million against Tractor Supply Company in October 2025. Connecticut secured the first CTDPA monetary penalty of $85,000 against TicketNetwork in July 2025.

Cure periods are another key distinction. Several states (New Jersey, Minnesota, Rhode Island) have no cure period, allowing enforcement immediately. Others maintain permanent cure periods (Virginia, Utah, Iowa, Kentucky, Indiana) that require the attorney general to give businesses time to fix violations before imposing penalties.

Find Your State

Select your state below for a detailed guide to its data privacy laws, including breach notification requirements, consumer rights, penalties, and relevant federal protections. States with comprehensive privacy laws are highlighted.