Updated October 5, 2026. Summaries are for general information, not legal advice.
See which states have laws in effect on the US privacy law map, check any country on the global privacy laws map, or estimate exposure with the privacy fine calculators.
24 laws
US State Privacy Laws
Comprehensive consumer privacy laws in 24 states. Most give residents the right to opt out of targeted advertising and the sale of their data, and a growing number require businesses to honor Global Privacy Control and other opt-out signals.
Alabama PDPA
Alabama's privacy law, effective May 1, 2027. 25,000-consumer threshold, opt-outs, consent for sensitive data, 45-day cure, $15,000 per violation.
CaliforniaCCPA / CPRA
California's privacy law, enforced by the CPPA and AG. Opt-outs and GPC must actually work; fines run to $7,988 per intentional violation.
ColoradoCPA
Colorado's privacy law. Universal opt-out signals like GPC must be honored since July 2024; cure period ended in 2025. AG enforced.
ConnecticutCTDPA
Connecticut's privacy law (July 2023). 35,000 threshold and no-threshold triggers since July 2026; opt-out signals required; AG enforced.
DelawareDPDPA
Delaware's privacy law (Jan 2025). Opt-out signals required since 2026; the threshold drops to 10,000 consumers in 2027. DOJ enforces.
FloridaFDBR
Florida's Digital Bill of Rights (July 2024) applies to $1B+ companies. $50,000 per violation, tripled for known children.
IndianaIndiana CDPA
Indiana's Virginia-model privacy law, effective Jan 1, 2026. Opt-outs, opt-in for sensitive data, AG enforcement, permanent 30-day cure.
IowaICDPA
Iowa's light-touch privacy law (Jan 2025). Opt-out of sale, notice-based sensitive data rules, 90-day cure, $7,500 per violation.
KentuckyKentucky CDPA
Kentucky's Virginia-model privacy law, effective Jan 1, 2026. Opt-outs of targeted ads and sale, AG enforcement, 30-day cure.
LouisianaEffective 2027Louisiana DPA
Louisiana's privacy law, effective Jan 1, 2027. $25M revenue or 75,000-consumer threshold, opt-outs, consent for sensitive data, AG enforces.
MarylandMODPA
Maryland's strict privacy law (Oct 2025). Data minimization standard, outright ban on selling sensitive data, no targeted ads to under-18s.
MinnesotaMinnesota CDPA
Minnesota's privacy law (July 2025). Right to a list of specific third parties, universal opt-out required, AG enforced, $7,500 per violation.
MontanaMontana CDPA
Montana's privacy law (Oct 2024). 2025 amendments cut the threshold to 25,000 consumers and removed the cure period. Universal opt-out required.
NebraskaNDPA
Nebraska's privacy law (Jan 2025), Texas-style scope with no consumer threshold. Universal opt-out required, 30-day cure, $7,500 per violation.
New HampshireNHDPA
New Hampshire's privacy law (Jan 2025). 35,000-consumer threshold, opt-out signals honored from day one, AG enforcement.
New JerseyNJDPA
New Jersey's privacy law (Jan 2025). Universal opt-out required since July 2025; cure period ended July 2026; financial data is sensitive.
OklahomaEffective 2027OKCDPA
Oklahoma's privacy law, effective Jan 1, 2027. Virginia model, 100,000-consumer threshold, AG enforcement, 30-day cure, $7,500 per violation.
OregonOCPA
Oregon's privacy law (July 2024). Broad sensitive-data rules, geolocation sale ban from 2026, universal opt-out required, DOJ enforced.
Rhode IslandRI Data
Rhode Island's privacy law (Jan 2026) requires naming every third party you sell data to. No cure period, up to $10,000 per violation.
TennesseeTIPA
Tennessee's privacy law (July 2025) with the highest thresholds and a NIST Privacy Framework affirmative defense. Treble damages if willful.
TexasTDPSA
Texas privacy law (July 2024) covering nearly every non-small business. Universal opt-out required; the Texas AG is an active enforcer.
UtahUCPA
Utah's business-friendly privacy law (Dec 2023). Opt-outs of targeted ads and sale, $25M revenue threshold, permanent 30-day cure.
VermontEffective 2028Vermont DPOSA
Vermont's privacy law, effective Jan 1, 2028. Data minimization, universal opt-out signals, health-data geofencing ban, AG enforcement.
VirginiaVCDPA
Virginia's consumer data law (Jan 2023). Opt-outs of targeted ads and sale, opt-in for sensitive data, AG enforcement, $7,500 per violation.
| Law | Official name | In effect | Who enforces | Private suits | Maximum penalty |
|---|---|---|---|---|---|
| CCPA / CPRA | California Consumer Privacy Act of 2018, Cal. Civ. Code… | 2020-01-01 | California Privacy Protection Agency… | Limited (data breaches only) | Up to $2,663 per violation, $7,988 per intentional violation or one… |
| VCDPA | Virginia Consumer Data Protection Act (Va. Code §59.1-575… | 2023-01-01 | Attorney General | No | Up to $7,500 per violation |
| CPA | Colorado Privacy Act (C.R.S. §6-1-1301 et seq.) | 2023-07-01 | Attorney General and district attorneys | No | Up to $20,000 per violation, each consumer or transaction counted… |
| CTDPA | Connecticut Data Privacy Act (Conn. Gen. Stat. §42-515 et… | 2023-07-01 | Attorney General | No | Up to $5,000 per willful violation (CUTPA) |
| UCPA | Utah Consumer Privacy Act (Utah Code §13-61-101 et seq.) | 2023-12-31 | Attorney General (Division of Consumer… | No | Up to $7,500 per violation, plus actual damages |
| TDPSA | Texas Data Privacy and Security Act (Tex. Bus. & Com. Code… | 2024-07-01 | Attorney General | No | Up to $7,500 per violation |
| OCPA | Oregon Consumer Privacy Act (ORS 646A.570 et seq.) | 2024-07-01 | Attorney General | No | Up to $7,500 per violation |
| Montana CDPA | Montana Consumer Data Privacy Act (Mont. Code §30-14-2801… | 2024-10-01 | Attorney General | No | Up to $7,500 per violation (MCA §30-14-2820(2), added by SB 297,… |
| Minnesota CDPA | Minnesota Consumer Data Privacy Act, Minn. Stat. §§… | 2025-07-31 | Attorney General | No | Up to $7,500 per violation |
| MODPA | Maryland Online Data Privacy Act (Md. Code, Com. Law… | 2025-10-01 | Attorney General (Consumer Protection… | No | Up to $10,000 per violation; $25,000 for repeat violations |
| NDPA | Nebraska Data Privacy Act (Neb. Rev. Stat. §87-1101 et seq.) | 2025-01-01 | Attorney General | No | Up to $7,500 per violation |
| NHDPA | New Hampshire Data Privacy Act (N.H. RSA 507-H) | 2025-01-01 | Attorney General | No | Up to $10,000 per violation |
| NJDPA | New Jersey Data Privacy Act (N.J.S.A. 56:8-166.4 et seq.) | 2025-01-15 | Attorney General (Division of Consumer… | No | Up to $10,000 for a first violation, $20,000 for later ones |
| TIPA | Tennessee Information Protection Act (Tenn. Code… | 2025-07-01 | Attorney General | No | Up to $7,500 per violation; treble damages for willful violations |
| Indiana CDPA | Indiana Consumer Data Protection Act (Ind. Code §24-15) | 2026-01-01 | Attorney General | No | Up to $7,500 per violation |
| Kentucky CDPA | Kentucky Consumer Data Protection Act (KRS 367.3611 et seq.) | 2026-01-01 | Attorney General | No | Up to $7,500 per violation |
| RI Data | Rhode Island Data Transparency and Privacy Protection Act… | 2026-01-01 | Attorney General | No | Up to $10,000 per violation (UDAP); separately $100 to $500 per… |
| OKCDPA | Oklahoma Data Privacy Act, SB 546 (2026), to be codified… | 2027-01-01 | Attorney General | No | Up to $7,500 per violation |
| DPDPA | Delaware Personal Data Privacy Act (6 Del. C. §12D-101 et… | 2025-01-01 | Department of Justice | No | Up to $10,000 per violation |
| FDBR | Florida Digital Bill of Rights (Fla. Stat. §501.701 et seq.) | 2024-07-01 | Attorney General (Department of Legal… | No | Up to $50,000 per violation, trebled for intentional cases involving… |
| ICDPA | Iowa Consumer Data Protection Act (Iowa Code ch. 715D) | 2025-01-01 | Attorney General | No | Up to $7,500 per violation |
| Alabama PDPA | Alabama Personal Data Protection Act, HB 351 (2026 Regular… | 2027-05-01 | Attorney General (exclusive) | No | Up to $15,000 per violation, assessed by a court after a failure to… |
| Louisiana DPA | Louisiana Data Privacy Act, SB 386 (2026), Act No. 502,… | 2027-01-01 | Attorney General (exclusive), under the… | No | LUTPA civil penalties: up to $5,000 per violation (La. R.S. 51:1407) |
| Vermont DPOSA | Vermont Data Privacy and Online Surveillance Act, S.71… | 2028-01-01 | Attorney General, under the Vermont… | No (the Act says the… | Vermont Consumer Protection Act civil penalties: up to $10,000 per… |
11 laws
US Federal and Sector Laws
Laws that apply because of the type of data or the way it is collected. Wiretap statutes like CIPA drive most pixel and session replay lawsuits; others cover video viewing history, health data, biometrics and children.
Age-Appropriate Design Codes
State codes for services likely used by children: high-privacy defaults, no dark patterns. California's is partly enjoined; Vermont's starts 2027.
IllinoisBIPA
Illinois biometric law. Written notice and release before collecting face, voice or fingerprint data; $1,000 to $5,000 per violation, private suits.
CaliforniaCIPA
California's wiretap law, the top source of privacy class actions. $5,000 per violation. From 2027 SB 690 ends pen-register suits; wiretap claims stay.
CaliforniaCMIA
California's medical privacy law, broader than HIPAA. Private right of action, $1,000 per violation without proof of harm; pixel suits pair it with CIPA.
FederalCOPPA
Federal children's privacy law for under-13s. Parental consent before collecting identifiers; amended rule in full effect since April 2026.
FederalFTC Act, Section 5
The FTC's authority over unfair or deceptive practices. Tracking cases turn on the gap between what the privacy policy says and what pixels do.
FederalGLBA
Federal financial privacy law. Notice and opt-out before sharing customer data with nonaffiliated third parties; FTC, CFPB and bank regulators enforce.
FederalHIPAA / HITECH
Federal health privacy rules. Tracking pixels on patient portals and authenticated pages can transmit PHI; OCR enforces, settlements exceed $100M.
WashingtonMy Health My Data Act
Washington's consumer health data law. Consent to collect and share, authorization to sell, geofencing ban, private right of action. In effect 2024.
FederalVPPA
Federal law on disclosing video viewing history. $2,500 per person; revived against sites and apps where pixels send video titles plus IDs.
FederalWiretap Act / Stored Communications Act
Federal ECPA claims against interception of communications. Wiretap Act damages of $10,000; the crime-tort exception drives pixel litigation.
| Law | Official name | In effect | Who enforces | Private suits | Maximum penalty |
|---|---|---|---|---|---|
| CIPA | California Invasion of Privacy Act (Cal. Penal Code §630… | 1968; SB 690 operative 2027-01-01 | Private plaintiffs; criminal prosecution | Yes | $5,000 per violation in civil suits (§637.2); criminal fines up to… |
| VPPA | Video Privacy Protection Act (18 U.S.C. §2710) | 1988-11-05 | Private plaintiffs | Yes | Liquidated damages of $2,500 per person, plus punitive damages and… |
| COPPA | Children's Online Privacy Protection Act (15 U.S.C. §6501… | 2000-04-21; amended Rule compliance… | FTC and state attorneys general | No | Up to $53,088 per violation (2025 inflation adjustment; no… |
| HIPAA / HITECH | Health Insurance Portability and Accountability Act;… | Privacy Rule 2003-04-14 | HHS Office for Civil Rights; state… | No | Tiered civil money penalties, inflation-adjusted annually |
| CMIA | California Confidentiality of Medical Information Act… | 1982 | Private plaintiffs; Attorney General and… | Yes | Nominal damages of $1,000 per person without proof of harm, plus… |
| FTC Act, Section 5 | Federal Trade Commission Act §5 (15 U.S.C. §45) | 1914 | Federal Trade Commission | No | Up to $53,088 per violation of an FTC rule or order (2025… |
| Wiretap Act / Stored Communications Act | Electronic Communications Privacy Act of 1986 (18 U.S.C…. | 1986 | Private plaintiffs; Department of Justice | Yes | Statutory damages of $10,000 or $100 per day, whichever is greater… |
| BIPA | Illinois Biometric Information Privacy Act, 740 ILCS 14 | 2008; 2024 amendment (per-person… | Private plaintiffs | Yes | $1,000 per negligent violation, $5,000 per intentional or reckless… |
| My Health My Data Act | Washington My Health My Data Act, RCW 19.373 | 2024-03-31 (small businesses 2024-06-30) | Attorney General; private plaintiffs… | Yes | Washington Consumer Protection Act: AG civil penalties up to $7,500… |
| Age-Appropriate Design Codes | California Age-Appropriate Design Code Act, Cal. Civ. Code… | CA 2024-07-01 (partly enjoined); VT… | State attorneys general | No | California: up to $2,500 per affected child (negligent), $7,500… |
| GLBA | Gramm-Leach-Bliley Act, Title V (15 U.S.C. §6801 et seq.);… | 2001-07-01 | FTC, CFPB, federal banking regulators and… | No | No direct civil penalty for a first violation; FTC orders carry up… |
10 laws
International Privacy Laws
Data protection and cookie laws outside the US. Most require opt-in consent before any non-essential cookie or tracker runs, and regulators like France’s CNIL have fined companies hundreds of millions of euros for getting it wrong.
Privacy Act 1988 (+ reforms)
Australia's privacy law and its 2024 reforms: a new privacy tort, new lower penalty tiers, and a children's online privacy code. Max penalty A$50M.
BrazilLGPD
Brazil's general data protection law (2020), modeled on GDPR and enforced by the ANPD. Fines up to 2% of Brazil revenue, R$50M per violation.
CanadaQuebec Law 25 (+ PIPEDA)
Quebec's privacy law: tracking that identifies, locates or profiles must be off by default since Sept 2023. Fines up to C$25M or 4%.
ChinaPIPL (+ DSL, CSL)
China's personal information law (Nov 2021). Separate consent for sharing and sensitive data; app SDKs are the CAC's main enforcement target.
EUePrivacy Directive
The EU cookie law. Prior consent before storing or reading anything on a device, enforced by national regulators like the CNIL.
EU / EEAGDPR
The EU's data protection regulation (May 2018). Consent must be freely given and withdrawable; fines reach €20M or 4% of global turnover.
IndiaDPDP Act + Rules 2025
India's data protection law. From May 2027: verifiable parental consent for under-18s, no tracking or targeted ads to children, fines to ₹250 crore.
Japan, Korea, SingaporeAPPI / PIPA / PDPA
Japan, Korea and Singapore's privacy laws. Opt-in third-party sharing in Japan, strict separate consent in Korea, PDPC enforcement in Singapore.
SwitzerlandFADP (revised)
Switzerland's revised data protection law (Sept 2023). GDPR-like duties, express consent for high-risk profiling, fines up to CHF 250,000 on individuals.
United KingdomUK GDPR + PECR
UK data protection and cookie rules enforced by the ICO. 2025 reforms raised PECR fines to £17.5M or 4% of global turnover.
| Law | Official name | In effect | Who enforces | Private suits | Maximum penalty |
|---|---|---|---|---|---|
| GDPR | General Data Protection Regulation, Regulation (EU) 2016/679 | 2018-05-25 | National data protection authorities; courts | Yes | Up to EUR 20 million or 4% of worldwide annual turnover, whichever… |
| ePrivacy Directive | Directive 2002/58/EC on privacy and electronic… | 2003-10-31 (transposition deadline);… | National authorities (often the data… | Limited | Set by each member state |
| UK GDPR + PECR | UK GDPR; Data Protection Act 2018; Privacy and Electronic… | UK GDPR 2021-01-01; PECR 2003-12-11 | Information Commissioner's Office | Yes | UK GDPR: up to GBP 17.5 million or 4% of turnover; PECR fines raised… |
| LGPD | Lei Geral de Proteção de Dados Pessoais (Brazil, Law No…. | 2020-09-18; sanctions from 2021-08-01 | ANPD (National Data Protection Authority) | Yes | Up to 2% of Brazilian revenue, capped at BRL 50 million per violation |
| PIPL (+ DSL, CSL) | Personal Information Protection Law (2021); Data Security… | PIPL 2021-11-01; DSL 2021-09-01; CSL… | Cyberspace Administration of China and… | Limited | PIPL: up to RMB 50 million or 5% of prior-year revenue |
| APPI / PIPA / PDPA | Japan's Act on the Protection of Personal Information;… | Japan amended 2022-04-01; Korea… | Japan PPC; Korea PIPC; Singapore PDPC | Varies | Japan: up to JPY 100 million for corporations; Korea: up to 3% of… |
| Privacy Act 1988 (+ reforms) | Privacy Act 1988 (Cth); Privacy and Other Legislation… | 1989; statutory privacy tort 2025-06-10 | Office of the Australian Information… | Yes (statutory tort since… | For serious interferences, the greatest of AUD 50 million, three… |
| Quebec Law 25 (+ PIPEDA) | Quebec Act respecting the protection of personal… | Phased 2022-09-22, 2023-09-22,… | Commission d'accès à l'information… | Yes (Quebec) | Quebec: up to CAD 25 million or 4% of worldwide turnover |
| DPDP Act + Rules 2025 | Digital Personal Data Protection Act, 2023 (India);… | Phased: 2025-11-13 (Board); 2026-11-13… | Data Protection Board of India | No | Up to INR 250 crore per breach (Data Protection Board penalties from… |
| FADP (revised) | Swiss Federal Act on Data Protection (FADP), SR 235.1 | 2023-09-01 | Federal Data Protection and Information… | Yes | Criminal fines up to CHF 250,000 on responsible individuals |
See which of these laws apply to what your sites send
Vault JS tests your websites, mobile apps and CTV apps the way a regulator or plaintiff’s expert would, and maps every finding to the laws that apply to you.
Get a free site analysis