TIPA requirements
Tennessee's law took effect July 1, 2025 with the highest thresholds of any state: more than $25 million in revenue plus data on 175,000 consumers, or 25,000 consumers with more than half of revenue from selling personal data. Its distinctive feature is an affirmative defense for controllers that maintain a written privacy program reasonably conforming to the NIST Privacy Framework. Consumers may opt out of targeted advertising, sale, and profiling. The Attorney General enforces, with a 60-day cure period, penalties of up to $7,500 per violation, and treble damages for willful or knowing violations. The NIST safe harbor is only as good as the evidence that the program described on paper matches what the website and apps are doing in production.
Other US State Privacy Laws
See what your sites and apps actually send
Get a free site analysis: every tracker, mapped to the laws that apply to it.