Updated October 5, 2026. Hover over or tap a state for its law, dates, cure period and penalties.
Key facts for the 24 comprehensive state laws, from the enacted statute text. Full details for each state are in the cards below.
Laws consumers can rely on today. States that require recognition of universal opt-out signals are marked in blue.
California
California Consumer Privacy Act of 2018 (CCPA / CPRA)
The California Consumer Privacy Act took effect January 1, 2020, was expanded by the CPRA on January 1, 2023, and requires businesses to honor opt-outs of sale and sharing, including the Global Privacy Control signal.
- Signed
- June 28, 2018
- Effective
- January 1, 2020
- Opt-out signals
- Required
- Cure period
- None for CalPrivacy or AG actions (the CPRA removed the automatic 30-day cure). Private data-breach suits keep a 30-day cure before statutory damages (Civ. Code §1798.150(b))
- Penalties
- Up to $2,663 per violation, $7,988 per intentional violation or one involving minors (2025 CPI-adjusted)
Read the lawOther privacy lawsWiretapCIPA: The source of most pixel, chat and session replay lawsuits. Private suits, $5,000 per violation.
HealthCMIA: Medical information privacy, broader than HIPAA. Private right of action.
Computer accessCDAFA: Computer data access law that plaintiffs often pair with CIPA in tracking suits.
Privacy policyCalOPPA: Requires a posted privacy policy that discloses tracking and Do Not Track handling.
Data brokersDelete Act: Data broker registration and a single deletion request mechanism run by CalPrivacy.
ChildrenAge-Appropriate Design Code: High-privacy defaults for services likely used by children. Partly enjoined since March 2026.
Colorado
Colorado Privacy Act (CPA)
Colorado's Privacy Act took effect July 1, 2023 and, since July 1, 2024, requires controllers to honor universal opt-out signals such as the Global Privacy Control.
- Signed
- July 7, 2021
- Effective
- July 1, 2023
- Opt-out signals
- Required
- Cure period
- Expired 2025-01-01
- Penalties
- Up to $20,000 per violation, each consumer or transaction counted separately; $50,000 if committed against an elderly person (C.R.S. §6-1-112(1)). No $500,000 cap
Read the lawConnecticut
Connecticut Data Privacy Act (CTDPA)
Connecticut's Data Privacy Act took effect July 1, 2023, has required recognition of universal opt-out signals since January 1, 2025, and was broadened by a 2025 amendment in effect July 1, 2026.
- Signed
- May 10, 2022
- Effective
- July 1, 2023
- Opt-out signals
- Required
- Cure period
- Discretionary since 2025-01-01 (mandatory cure ended 2024-12-31)
- Penalties
- Up to $5,000 per willful violation (CUTPA)
Read the lawDelaware
Delaware Personal Data Privacy Act (DPDPA)
Delaware's Personal Data Privacy Act took effect January 1, 2025, has required recognition of universal opt-out signals since January 1, 2026, and drops its threshold to 10,000 residents on January 1, 2027.
- Signed
- September 11, 2023
- Effective
- January 1, 2025
- Opt-out signals
- Required
- Cure period
- 60 days until 2025-12-31; expired
- Penalties
- Up to $10,000 per violation
Read the lawFlorida
Florida Digital Bill of Rights (FDBR)
Florida's Digital Bill of Rights took effect July 1, 2024 and applies mainly to companies with more than $1 billion in global revenue.
- Signed
- June 6, 2023
- Effective
- July 1, 2024
- Opt-out signals
- Not required
- Cure period
- 45 days, at the Department's discretion
- Penalties
- Up to $50,000 per violation, trebled for intentional cases involving children
Read the lawIndiana
Indiana Consumer Data Protection Act (Indiana CDPA)
Indiana's Consumer Data Protection Act took effect January 1, 2026, follows the Virginia model, and keeps a permanent 30-day cure period.
- Signed
- May 1, 2023
- Effective
- January 1, 2026
- Opt-out signals
- Not required
- Cure period
- 30 days (permanent)
- Penalties
- Up to $7,500 per violation
Read the lawIowa
Iowa Consumer Data Protection Act (ICDPA)
Iowa's Consumer Data Protection Act took effect January 1, 2025 and has the longest permanent cure period of any state, 90 days.
- Signed
- March 28, 2023
- Effective
- January 1, 2025
- Opt-out signals
- Not required
- Cure period
- 90 days (permanent)
- Penalties
- Up to $7,500 per violation
Read the lawKentucky
Kentucky Consumer Data Protection Act (Kentucky CDPA)
Kentucky's Consumer Data Protection Act took effect January 1, 2026 and requires opt-in consent for sensitive data.
- Signed
- April 4, 2024
- Effective
- January 1, 2026
- Opt-out signals
- Not required
- Cure period
- 30 days (permanent)
- Penalties
- Up to $7,500 per violation
Read the lawMaryland
Maryland Online Data Privacy Act (MODPA)
Maryland's Online Data Privacy Act took effect October 1, 2025 and is the strictest state law, limiting collection to what is strictly necessary and banning the sale of sensitive data.
- Signed
- May 9, 2024
- Effective
- October 1, 2025
- Opt-out signals
- Required
- Cure period
- 60 days, at the AG's discretion, until 2027-04-01
- Penalties
- Up to $10,000 per violation; $25,000 for repeat violations
Read the lawMinnesota
Minnesota Consumer Data Privacy Act (Minnesota CDPA)
Minnesota's Consumer Data Privacy Act took effect July 31, 2025, requires recognition of universal opt-out signals, and gives consumers a right to question the result of profiling decisions.
- Signed
- May 24, 2024
- Effective
- July 31, 2025
- Opt-out signals
- Required
- Cure period
- 30 days until 2026-01-31; expired
- Penalties
- Up to $7,500 per violation
Read the lawMontana
Montana Consumer Data Privacy Act (Montana CDPA)
Montana's Consumer Data Privacy Act took effect October 1, 2024; amendments in effect since October 1, 2025 lowered the threshold to 25,000 consumers and removed the cure period.
- Signed
- May 19, 2023
- Effective
- October 1, 2024
- Opt-out signals
- Required
- Cure period
- None since 2025-10-01 (SB 297 removed the 60-day cure, which was due to expire 2026-04-01)
- Penalties
- Up to $7,500 per violation (MCA §30-14-2820(2), added by SB 297, effective October 1, 2025), plus injunctive relief, attorney fees and costs
Read the lawNebraska
Nebraska Data Privacy Act (NDPA)
Nebraska's Data Privacy Act took effect January 1, 2025, applies regardless of company size unless the business is a small business that does not sell sensitive data, and keeps a permanent 30-day cure period.
- Signed
- April 17, 2024
- Effective
- January 1, 2025
- Opt-out signals
- Required (technical-feasibility clause)
- Cure period
- 30 days (permanent)
- Penalties
- Up to $7,500 per violation
Read the lawNew Hampshire
New Hampshire Data Privacy Act (NHDPA)
New Hampshire's Data Privacy Act took effect January 1, 2025, applies to businesses handling data on 35,000 residents, and requires recognition of universal opt-out signals.
- Signed
- March 6, 2024
- Effective
- January 1, 2025
- Opt-out signals
- Required
- Cure period
- 60 days, mandatory through 2025-12-31; discretionary since 2026-01-01
- Penalties
- Up to $10,000 per violation
Read the lawNew Jersey
New Jersey Data Privacy Act (NJDPA)
New Jersey's Data Privacy Act took effect January 15, 2025, has required recognition of universal opt-out signals since July 15, 2025, and its cure period expired July 15, 2026.
- Signed
- January 16, 2024
- Effective
- January 15, 2025
- Opt-out signals
- Required
- Cure period
- 30 days until 2026-07-15; expired
- Penalties
- Up to $10,000 for a first violation, $20,000 for later ones
Read the lawOregon
Oregon Consumer Privacy Act (OCPA)
Oregon's Consumer Privacy Act took effect July 1, 2024, has required recognition of universal opt-out signals since January 1, 2026, and no longer offers a cure period.
- Signed
- July 18, 2023
- Effective
- July 1, 2024
- Opt-out signals
- Required
- Cure period
- None since 2026-01-01 (the 30-day cure ran until 2025-12-31)
- Penalties
- Up to $7,500 per violation
Read the lawRhode Island
Rhode Island Data Transparency and Privacy Protection Act (RI Data)
Rhode Island's Data Transparency and Privacy Protection Act took effect January 1, 2026 and has no cure period.
- Signed
- June 25, 2024 (became law without the governor's signature)
- Effective
- January 1, 2026
- Opt-out signals
- Not required
- Cure period
- None
- Penalties
- Up to $10,000 per violation (UDAP); separately $100 to $500 per unlawful disclosure
Read the lawTennessee
Tennessee Information Protection Act (TIPA)
Tennessee's Information Protection Act took effect July 1, 2025 and gives companies an affirmative defense if their privacy program follows the NIST Privacy Framework.
- Signed
- May 11, 2023
- Effective
- July 1, 2025
- Opt-out signals
- Not required
- Cure period
- 60 days
- Penalties
- Up to $7,500 per violation; treble damages for willful violations
Read the lawTexas
Texas Data Privacy and Security Act (TDPSA)
The Texas Data Privacy and Security Act took effect July 1, 2024, applies to most businesses regardless of revenue, and has required recognition of universal opt-out signals since January 1, 2025.
- Signed
- June 18, 2023
- Effective
- July 1, 2024
- Opt-out signals
- Required (technical-feasibility clause)
- Cure period
- 30 days
- Penalties
- Up to $7,500 per violation
Read the lawOther privacy lawsBiometricCUBI: Notice and consent before capturing biometric identifiers. Enforced by the Attorney General.
Data brokersData Broker Law: Registration and security duties for data brokers.
Utah
Utah Consumer Privacy Act (UCPA)
Utah's Consumer Privacy Act took effect December 31, 2023 and is the most business-friendly state law, with opt-outs for targeted advertising and sale but no universal opt-out requirement.
- Signed
- March 24, 2022
- Effective
- December 31, 2023
- Opt-out signals
- Not required
- Cure period
- 30 days
- Penalties
- Up to $7,500 per violation, plus actual damages
Read the lawVirginia
Virginia Consumer Data Protection Act (VCDPA)
Virginia's Consumer Data Protection Act took effect January 1, 2023 and became the template for most later state laws, with opt-outs for targeted advertising and sale and opt-in consent for sensitive data.
- Signed
- March 2, 2021
- Effective
- January 1, 2023
- Opt-out signals
- Not required
- Cure period
- 30 days (permanent)
- Penalties
- Up to $7,500 per violation
Read the lawEnacted laws with a future effective date. Consent and opt-out settings need to be ready before these dates.
Alabama
Alabama Personal Data Protection Act (Alabama PDPA)
Alabama's Personal Data Protection Act was signed April 17, 2026, takes effect May 1, 2027, and applies to businesses handling data on more than 25,000 Alabama consumers.
- Signed
- April 17, 2026
- Effective
- May 1, 2027
- Opt-out signals
- Not required
- Cure period
- 45 days (permanent)
- Penalties
- Up to $15,000 per violation, assessed by a court after a failure to cure
Read the lawLouisiana
Louisiana Data Privacy Act (Louisiana DPA)
The Louisiana Data Privacy Act was signed May 29, 2026, takes effect January 1, 2027, and covers businesses with more than $25 million in revenue or data on 75,000 Louisiana consumers.
- Signed
- May 29, 2026
- Effective
- January 1, 2027
- Opt-out signals
- Required (conditional)
- Cure period
- 30 days, only from 2027-01-01 to 2027-07-31
- Penalties
- LUTPA civil penalties: up to $5,000 per violation (La. R.S. 51:1407)
Read the lawOklahoma
Oklahoma Data Privacy Act (OKCDPA)
Oklahoma's Data Privacy Act was signed March 20, 2026 and takes effect January 1, 2027, following the Virginia model.
- Signed
- March 20, 2026
- Effective
- January 1, 2027
- Opt-out signals
- Not required
- Cure period
- 30 days (permanent)
- Penalties
- Up to $7,500 per violation
Read the lawVermont
Vermont Data Privacy and Online Surveillance Act (Vermont DPOSA)
Vermont's Data Privacy and Online Surveillance Act was signed June 16, 2026, takes effect January 1, 2028, and requires data minimization and recognition of universal opt-out signals.
- Signed
- June 16, 2026
- Effective
- January 1, 2028
- Opt-out signals
- Required
- Cure period
- 60 days where the AG finds cure possible, 2028-01-01 to 2029-06-30; discretionary afterwards
- Penalties
- Vermont Consumer Protection Act civil penalties: up to $10,000 per violation (9 V.S.A. §2458)
Read the lawComprehensive privacy bills moving through the legislature, per the IAPP US State Privacy Legislation Tracker (updated September 8, 2026).
No comprehensive privacy law yet, but wiretap, biometric, health or video laws still reach website and app tracking. Federal laws such as the VPPA, COPPA and the Wiretap Act apply in every state.
Alaska, Arizona, Arkansas, Georgia, Hawaii, Idaho, Kansas, Maine, Mississippi, Missouri, New Mexico, North Dakota, South Carolina, South Dakota, West Virginia, Wisconsin, Wyoming and the District of Columbia. Of these, 2026 bills in Alaska, Arizona, Georgia, Hawaii, Maine, New Mexico, South Carolina, West Virginia and Wisconsin died or ran out of session time. Federal laws such as the VPPA, COPPA, the Wiretap Act and FTC Act Section 5 still apply, and so can California’s CIPA when a site reaches California residents.
Dates, cure periods and penalties come from the enacted statute text in the Vault JS legal library. This map is a summary, not legal advice. Spot an error? Tell us.