US State Privacy Laws Comparison Chart & Tracker (2026)

As of August 2026, 24 US states have enacted comprehensive consumer data privacy laws, with California's CCPA/CPRA leading the way. All 24 laws grant residents rights to access, delete, and opt out of data sales, though applicability thresholds, sensitive data rules, and enforcement penalties vary significantly by state. Four of the 24 (Oklahoma, Alabama, Louisiana, and Vermont) were enacted in 2026 and are not yet effective.

The US has no single federal comprehensive data privacy law. Instead, a growing patchwork of state legislation governs how businesses collect, use, and share consumers' personal data. Each state law differs in scope, consumer rights, enforcement mechanisms, and business obligations.

This guide provides a side-by-side comparison of every US state that has enacted a comprehensive consumer data privacy law as of August 2026, covering applicability thresholds, consumer rights, sensitive data rules, enforcement provisions, and key distinguishing features.

Overview of Enacted State Privacy Laws

The following states have enacted comprehensive consumer data privacy statutes (listed in order of enactment/signing):

1. California - CCPA (2018) / CPRA (2020, effective 2023)
2. Virginia - VCDPA (2021, effective Jan 2023)
3. Colorado - CPA (2021, effective Jul 2023)
4. Connecticut - CTDPA (2022, effective Jul 2023)
5. Utah - UCPA (2022, effective Dec 2023)
6. Iowa - ICDPA (2023, effective Jan 2025)
7. Indiana - ICDPA (2023, effective Jan 2026)
8. Tennessee - TIPA (2023, effective Jul 2025)
9. Montana - MCDPA (2023, effective Oct 2024)
10. Oregon - OCPA (2023, effective Jul 2024)
11. Texas - TDPSA (2023, effective Jul 2024)
12. Florida - FDBR (2023, effective Jul 2024)
13. Delaware - DPDPA (2023, effective Jan 2025)
14. New Hampshire - (2024, effective Jan 2025)
15. New Jersey - NJDPA (2024, effective Jan 2025)
16. Kentucky - KCDPA (2024, effective Jan 2026)
17. Nebraska - NDPA (2024, effective Jan 2025)
18. Minnesota - MCDPA (2024, effective Jul 2025)
19. Maryland - MODPA (2024, effective Oct 2025)
20. Rhode Island - RIDTPPA (2024, effective Jan 2026)
21. Oklahoma - OKCDPA (2026, effective Jan 2027)
22. Alabama - ALDPA (2026, effective May 2027)
23. Louisiana - Act 502 (2026, effective Jan 2027)
24. Vermont - Act 145 (2026, effective Jan 2028)

Several additional states have active privacy legislation in progress, and this list may expand through 2026 and 2027 legislative sessions.

Applicability Thresholds

One of the most important practical questions for any business: does this law apply to me? The thresholds vary significantly.

Notable outliers: Florida's $1 billion revenue threshold limits the law to major corporations and large tech platforms. Texas and Nebraska apply broadly to all businesses processing personal data (with small business exemptions). Montana's current code sets a 25,000-consumer threshold (down from its original 50,000), which matches the 25,000-consumer floor in Alabama's 2026 law (Alabama also has a 25%-of-revenue alternative test with no consumer minimum at all). Delaware goes lower still on January 1, 2027, when HB 380 drops its primary threshold to 10,000 consumers. Louisiana breaks from the Virginia-style volume model entirely, adopting California's CCPA approach: a $25 million revenue threshold, a 75,000-consumer/household/device threshold, or a 50%-of-revenue-from-data-sales threshold.

Consumer Rights Comparison

All enacted state privacy laws provide a core set of consumer rights, but the specific rights and their scope vary.

California stands alone in providing the right to know what specific pieces of personal information a business has collected (not just categories) and the right to limit the use of sensitive personal information. Oregon is notable for granting consumers the right to obtain a list of specific third parties to whom their data has been disclosed; Connecticut added a comparable right on October 1, 2026, along with a right of access to inferences and to profiling information and a right to delete certain collated public-profile data (Public Act 26-64, Sec. 13).

Florida adds two rights the Virginia-model states do not: the right to opt out of the collection of sensitive data, including precise geolocation data, or the processing of sensitive data (Fla. Stat. 501.705(2)(f)), and the right to opt out of the collection of personal data through a voice recognition or facial recognition feature (s. 501.705(2)(g)). Section 501.705(3) goes further, barring a controller from using a device's voice, facial, video, audio, thermal, or olfactory collection features for surveillance when the consumer is not actively using them, unless the consumer expressly authorizes it.

Minnesota's law is distinctive in providing consumers the right to question the results of profiling and to be informed about the types of profiling a controller engages in. Maryland's MODPA takes a restrictive approach by requiring businesses to limit data collection to what is reasonably necessary for the purpose disclosed to the consumer, a data minimization standard stronger than most other state laws.

Sensitive Data Treatment

How each state handles sensitive personal data reveals important differences in privacy philosophy.

Oregon and Vermont are notable for explicitly including transgender and nonbinary status as sensitive data. Vermont's definition is the broadest among enacted state laws, also treating neural data, financial account login credentials, and government-issued ID numbers as sensitive. Maryland's MODPA goes further than any other state by prohibiting the sale of sensitive personal data entirely, not just requiring opt-in consent. Florida layers a standalone opt-out on top of the opt-in model: s. 501.71(2)(d) already bars processing sensitive data without consent, yet s. 501.705(2)(f) separately lets a consumer opt out of that collection or processing.

Most state laws treat children's data as sensitive personal information. The age threshold is typically 13 (aligning with COPPA), though Connecticut goes further: since October 1, 2026 a controller may not process personal data for targeted advertising, or sell it, where it has actual knowledge of, or wilfully disregards, that the consumer is at least 13 and younger than 18 (Public Act 26-64, Sec. 14).

Enforcement and Penalties

California remains the only state with a private right of action (limited to data breaches involving unencrypted personal information), with statutory damages of $107-$799 per consumer per incident (CPI-adjusted since Jan. 1, 2025). No other state comprehensive privacy law currently includes a private right of action.

Florida's $50,000 per-violation maximum is the highest among state privacy laws, though the law's narrow applicability (limited to businesses with over $1 billion in revenue) means it affects relatively few companies.

The trend toward eliminating or sunsetting cure periods reflects a maturation of the enforcement landscape. Early laws like Virginia and Utah have permanent cure periods, while newer laws like Colorado, Connecticut, Oregon, and Delaware included cure periods that expire, shifting from a collaborative to a punitive enforcement model over time.

Effective Dates Timeline

Recent and upcoming amendments: Connecticut's Public Act 26-64 (SB 4, signed May 27, 2026) took effect October 1, 2026 and is now in force. Its CTDPA amendments bar a controller, and separately a third party, from selling any consumer's precise geolocation data (subject to exceptions for the content of communications and for data generated by advanced utility metering infrastructure), bar targeted advertising to and the sale of personal data of consumers known to be 13 to 17, require consent before any sale of sensitive data, change the consent trigger for a "material" new processing purpose to any "new purpose", and add the access, deletion and third-party-list rights described above. Delaware's House Bill 380 (signed September 2, 2026, 85 Del. Laws ch. 463) amends the DPDPA effective January 1, 2027, lowering the applicability thresholds to 10,000 consumers and to 5,000 consumers under the data-sales revenue prong, extending the law to third parties who acquire personal data from a controller, and expanding the sensitive data definition.

Watching (verified August 20, 2026): Massachusetts's Consumer Data Privacy Act passed the House 146-0 on June 4, 2026 but remains in conference committee. It is not yet law, and no other state has enacted a comprehensive privacy law since Vermont in June 2026.

Key Distinctions by State

Several states have provisions that set them apart from the majority model:

California (CCPA/CPRA): Only state with a dedicated privacy enforcement agency (CPPA). Only state with a private right of action. Only state whose revenue threshold is indexed to inflation ($26,625,000 since January 1, 2025, up from the statutory $25M). Broadest definition of "sale" (any exchange for valuable consideration). Right to limit use of sensitive personal information rather than opt-in consent model.

Oregon (OCPA): Only state that applies to nonprofit organizations. Includes transgender/nonbinary status as sensitive data. Grants consumers the right to obtain a list of specific third parties receiving their data.

Texas (TDPSA): No data-processing volume threshold, applying to all businesses processing personal data (excluding SBA-defined small businesses). Combined with no revenue threshold, this gives Texas one of the broadest applicability scopes.

Maryland (MODPA): Prohibits the sale of sensitive personal data entirely. Imposes a data minimization standard requiring collection to be "reasonably necessary" for the disclosed purpose. Among the most protective state privacy laws enacted.

Minnesota (MCDPA): Grants profiling-related rights including the right to question profiling results. Requires privacy impact assessments. Includes a data minimization requirement.

Florida (FDBR): Narrowest applicability ($1B revenue threshold). Targets large technology companies and digital platforms. Includes specific provisions for children's online protections.

Montana (MCDPA): A 25,000-consumer threshold (lowered from the original 50,000), among the lowest in the volume-based model and reflecting Montana's smaller population; Alabama's 2026 law uses the same 25,000-consumer trigger once it takes effect in 2027.

Connecticut (CTDPA plus Public Act 26-64): Bans the sale of any consumer's precise geolocation data outright, in force since October 1, 2026, and extends that ban to third parties as well as controllers. The same act added three regimes that sit outside the CTDPA. Data brokers must register with the Department of Consumer Protection to sell or license brokered personal data in the state on or after January 1, 2027, at $2,500 for an initial registration and $2,500 to renew, with a published registry, an accessible deletion mechanism due by July 1, 2028, deletion statistics from July 1, 2029, and civil penalties, as amended by Public Act 26-100, Section 43, of up to $200 per day per consumer for each violation, imposed by the Commissioner after notice and a hearing. A surveillance pricing ban was enacted in the same act but never took effect: Public Act 26-100, Section 66 repealed it on June 2, 2026, its replacement at Public Act 26-100, Section 44 was itself repealed by Public Act 26-130, Section 19 on June 4, 2026, and the surviving version, Public Act 26-130, Section 11, does not bind retail sellers and third-party delivery services until July 1, 2027. That version bars customized pricing set using personal data collected through tracking technology or acquired from third parties, with exceptions for loyalty-retention discounts, cost- or time-justified differences and publicly posted uniform terms, and it is enforced solely by the Attorney General with no private right of action. Direct-to-consumer genetic testing is governed by a consumer property right and exclusive control over the biological sample and results, built on express consent rather than a ban on sale.

How These Laws Interact with Federal Law

No comprehensive federal privacy law exists as of August 2026, though the American Data Privacy and Protection Act (ADPPA) has been introduced in multiple Congressional sessions. The relationship between state and federal privacy law involves several layers:

• HIPAA preempts state laws for covered health data but only applies to healthcare providers, insurers, and their business associates. State privacy laws cover health data held by other businesses (health apps, fitness trackers, etc.).
• GLBA preempts state laws for financial institutions regarding customer financial information, though state laws may impose additional requirements.
• COPPA provides a federal floor for children's data (under 13), but state laws can provide additional protections.
• FCRA governs consumer reporting agencies and is not preempted by state privacy laws.

Most state privacy laws explicitly exclude data that is already regulated by these federal frameworks, avoiding direct conflict.

For detailed analysis of individual state laws, see our state-by-state guides:

• California (CCPA/CPRA)
• Virginia (VCDPA)
• Colorado (CPA)
• Connecticut (CTDPA)
• Texas (TDPSA)
• Oregon (OCPA)
• Maryland (MODPA)
• Minnesota

For a comparison of these laws against international frameworks, see our GDPR vs CCPA analysis.

This information reflects the law as of October 2026, last reviewed October 8, 2026 against the enacted text of Connecticut's Public Act 26-64, which took effect October 1, 2026, and the enacted text of New Jersey's P.L.2023, c.266, whose mandatory cure period has now expired; Delaware's enacted HB 380 amendments were added September 5, 2026, and the cure-period, Montana threshold, Rhode Island, California penalty and Utah correction-right entries were rechecked against primary sources on September 28, 2026. State privacy legislation is an active area, with new bills introduced in multiple states each legislative session. Consult an attorney for advice specific to your situation.

Frequently Asked Questions

How many US states have comprehensive data privacy laws?

As of August 2026, 24 states have enacted comprehensive consumer data privacy laws: California, Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Oregon, Texas, Florida, Delaware, New Hampshire, New Jersey, Kentucky, Nebraska, Minnesota, Maryland, Rhode Island, Oklahoma (effective Jan. 1, 2027), Alabama (effective May 1, 2027), Louisiana (effective Jan. 1, 2027), and Vermont (effective Jan. 1, 2028). Additional states have active legislation in progress.

Which state has the strictest data privacy law?

California's CCPA/CPRA is generally considered the most protective overall, with a dedicated enforcement agency, an inflation-adjusted revenue threshold of $26,625,000 (raised from the statutory $25 million on January 1, 2025), and the only private right of action among state privacy laws. However, Maryland's MODPA is stricter in certain respects, prohibiting the sale of sensitive data entirely and imposing data minimization requirements that go beyond California's approach.

Do businesses need to comply with every state privacy law separately?

Businesses that process personal data of residents in multiple states must comply with each applicable state law. In practice, many businesses adopt a baseline privacy program that meets the requirements of the strictest applicable laws (typically California) and then add state-specific provisions where laws diverge, such as Oregon's nonprofit coverage or Maryland's data minimization requirement.

Can consumers sue businesses under state privacy laws?

Only California provides a private right of action, and it is limited to data breaches involving certain categories of unencrypted personal information. Under all other state privacy laws, enforcement is handled exclusively by the state Attorney General (or designated agency). Consumers in those states cannot file individual lawsuits for privacy violations under the comprehensive privacy statute.

Will a federal privacy law replace state privacy laws?

As of August 2026, there is no comprehensive federal data privacy law, though bills like the American Data Privacy and Protection Act have been introduced. Whether a federal law would preempt state laws depends on its specific preemption provisions. California and other states with strong privacy protections have historically opposed preemption, making this a significant political obstacle to federal legislation.