Laws covered
Alabama's privacy law, effective May 1, 2027. 25,000-consumer threshold, opt-outs, consent for sensitive data, 45-day cure, $15,000 per violation.
California's privacy law, enforced by the CPPA and AG. Opt-outs and GPC must actually work; fines run to $7,988 per intentional violation.
Colorado's privacy law. Universal opt-out signals like GPC must be honored since July 2024; cure period ended in 2025. AG enforced.
Connecticut's privacy law (July 2023). 35,000 threshold and no-threshold triggers since July 2026; opt-out signals required; AG enforced.
Delaware's privacy law (Jan 2025). Opt-out signals required since 2026; the threshold drops to 10,000 consumers in 2027. DOJ enforces.
Florida's Digital Bill of Rights (July 2024) applies to $1B+ companies. $50,000 per violation, tripled for known children.
Iowa's light-touch privacy law (Jan 2025). Opt-out of sale, notice-based sensitive data rules, 90-day cure, $7,500 per violation.
Indiana's Virginia-model privacy law, effective Jan 1, 2026. Opt-outs, opt-in for sensitive data, AG enforcement, permanent 30-day cure.
Kentucky's Virginia-model privacy law, effective Jan 1, 2026. Opt-outs of targeted ads and sale, AG enforcement, 30-day cure.
Louisiana's privacy law, effective Jan 1, 2027. $25M revenue or 75,000-consumer threshold, opt-outs, consent for sensitive data, AG enforces.
Minnesota's privacy law (July 2025). Right to a list of specific third parties, universal opt-out required, AG enforced, $7,500 per violation.
Maryland's strict privacy law (Oct 2025). Data minimization standard, outright ban on selling sensitive data, no targeted ads to under-18s.
Montana's privacy law (Oct 2024). 2025 amendments cut the threshold to 25,000 consumers and removed the cure period. Universal opt-out required.
Nebraska's privacy law (Jan 2025), Texas-style scope with no consumer threshold. Universal opt-out required, 30-day cure, $7,500 per violation.
New Hampshire's privacy law (Jan 2025). 35,000-consumer threshold, opt-out signals honored from day one, AG enforcement.
New Jersey's privacy law (Jan 2025). Universal opt-out required since July 2025; cure period ended July 2026; financial data is sensitive.
Oregon's privacy law (July 2024). Broad sensitive-data rules, geolocation sale ban from 2026, universal opt-out required, DOJ enforced.
Oklahoma's privacy law, effective Jan 1, 2027. Virginia model, 100,000-consumer threshold, AG enforcement, 30-day cure, $7,500 per violation.
Rhode Island's privacy law (Jan 2026) requires naming every third party you sell data to. No cure period, up to $10,000 per violation.
Texas privacy law (July 2024) covering nearly every non-small business. Universal opt-out required; the Texas AG is an active enforcer.
Tennessee's privacy law (July 2025) with the highest thresholds and a NIST Privacy Framework affirmative defense. Treble damages if willful.
Utah's business-friendly privacy law (Dec 2023). Opt-outs of targeted ads and sale, $25M revenue threshold, permanent 30-day cure.
Virginia's consumer data law (Jan 2023). Opt-outs of targeted ads and sale, opt-in for sensitive data, AG enforcement, $7,500 per violation.
Vermont's privacy law, effective Jan 1, 2028. Data minimization, universal opt-out signals, health-data geofencing ban, AG enforcement.
See what your sites and apps actually send
Get a free site analysis: every tracker, mapped to the laws that apply to it.