To help consumers better understand their rights, we created a comprehensive list that includes all current and pending data privacy laws by state.  Having access to an easy-to-read version of these new state laws will help our consumers make more informed and educated decisions related to their data privacy.

Alabama

• None

Alaska

• None

Arizona

• None

Arkansas

• None

California

• CCPA (1/1/2020) & CPRA (1/1/2023)
  • California currently has the most comprehensive data privacy laws among all states. California gives consumers the right to know what personal information businesses collect, to whom it is sold, the right to opt out of the sale of personal information, and the right to nondiscriminatory treatment for exercising their privacy rights.

Colorado

• CPA (7/1/2023)
  • Colorado’s Privacy Act gives consumers the right to access, correct, and delete data from brokerage websites. Colorado also gives the right to opt out, data portability, and requires consent to the sale of their data.

Connecticut (7/1/2023)

• CTDPA
  • This law grants consumers the right to access, correct, delete, transfer, and opt out of the sale of their data.

Delaware (1/1/2025)

• DPDPA
  • This privacy law applies to companies that process the data of 35,000 consumers or more and that derive more than 20% of their revenue from the sale of personal data. These companies must confirm wether or not a controller is processing their data, correct any inaccuracies, delete personal data not provided by the consumer, give copies of the data collected to the consumer, give a list of third parties that also have access to the consumers data, as well as give a way to opt out of the sale of personal data from that website. 

Florida

• FDBR (7/1/2024)
  • The Florida Digital Bill of Rights protects all Florida residents from companies that process personal data or derive at least 50% of their annual revenue from targeted advertising services. This bill gives consumers in Florida the right to: obtain, correct, delete, transfer, and opt out of the sale of any personal data.

Georgia

• GCPPA (7/1/2026)
  • This law applies to companies that exceed 25 million in revenue and process the info of a minimum of 175,000 Georgian consumers or derive at least 50% of their revenue from the sale of at least 25,000 consumers in Georgia. Companies that fall under this scope must give consumers the right to access, correct, obtain a copy of, and delete their data. These companies must also give a clear way to opt out of the sale of a consumer’s data.

Hawaii

• None

Idaho

• None

Illinois

• None

Indiana

• INCDPA (1/1/2026)
  • This law applies to companies that process the data of at least 100,000 residents of Indiana or process the personal data of at least 25,000 Indiana residents that gross a minimum of 50% of their revenue. This will give residents the right to: correct any inaccuracies in their data; opt out of their data being sold; confirm whether their data is being processed; and request the deletion of any personal data collected. 

Iowa

• ICDPA (1/1/2025)
  • Companies that process the personal data of at least 100,000 Iowa consumers, as well as gross 50% or more of their revenue from the sale of personal data, must be compliant with this law.  These companies must confirm whether or not they are processing a consumer’s data, they must give consumers the ability to delete their data, they must give a consumer a copy of their data at request, and give the consumer the ability to opt out of the sale of their data. 

Kansas

• None

Kentucky

• KCDPA (1/1/2026)
  • This law applies to companies that process over 100,000 consumers’ data or derive 50% of their revenue from a minimum of 25,000 consumers.  Consumers in Kentucky will have the right to: confirm that their data is being processed; correct inaccuracies in their data; delete any personal data obtained; be provided a usable copy of any collected data; and opt out of the sale of their data.

Louisiana

• None

Maine

• None

Maryland

• MODPA (10/1/2025)
  • Companies that process the data of at least 35,000 consumers as well as derive 20% or more of their revenue from the sale of personal data, are required to be compliant with the following laws.  In addition, companies are banned from selling any data related to: racial origin, religious beliefs, health data, sex life, sexual orientation, national origin and citizenship, or immigration status.  The rights given to consumers are as follows: the right to confirm if a consumer’s data is being processed; the right to access any personal data; the right to correct any inaccuracies; the right to obtain a usable copy of a consumer’s information; the right to know which third parties also have access to your data; the right to opt out of the sale of your data.

Massachusetts

• None

Michigan

• None

Minnesota

• MCDPA (7/31/2025)
  • Companies that process the data of 100,000+ consumers and derive 50% or more revenue from the sale of personal data must be compliant with these laws.  This law will give Minnesota consumers the following rights: The right to know if their data is being or has been collected; the right to access any collected data; The right to obtain a list of any third parties that have access to their data; the right to correct any inacuraices in their data; the right to have their data deleted upon request; the right to opt out of the sale of personal data; the right to non-dsirimination for exercising any of the new privacy rights.

Mississippi

• None

Missouri

• None

Montana

• MTCDPA (10/1/2025)
  • This law gives consumers the right to opt out, access, correct, delete, transfer, and not be discriminated against regarding the sale of their data. These laws apply to companies that handle the data of a minimum of 50,000 residents and gross over 25% of revenue from the sale of personal data.

Nebraska (1/1/2025)

• NDPA
  • This law requires that companies confirm whether or not they are processing a consumer’s data, as well as they must correct any inaccuracies in the consumer’s data. In addition, they are required to delete any data at the request of the consumer, provide a copy of the person’s data, and allow the consumer to opt out of the sale of their data.

Nevada (10/1/2021)

• NPICICA
  • This law applies to commercial brokers who have a webpage that attracts 20,000 or more visitors annually and participate in the sale of personal data. Companies that meet this standard are required to give Nevada residents the right to: allow consumers to opt out of the sale of their personal information, and receive consent from consumers before sharing/selling personal data.

New Hampshire (1/1/2025)

• NHPA
  • This law grants the right to correct any inaccuracies in the consumer’s profile, confirm whether a broker has the consumer’s data, delete any personal data, obtain a copy of any of the data held in a format that is easily transmitted, and the ability to opt out of the process. 

New Jersey (1/15/2025)

• NJDPA
  • This law applies to brokers who process the personal data of at least 100,000 consumers, as well as make revenue from the sale of at least 25,000 consumers’ data. This law requires that these companies confirm if they have your data, correct inaccuracies in your data, delete your data, provide a legible copy of your data, and give you the ability to opt out of the sale or collection of your data. 

New Mexico

• None

New York

• None

North Carolina

• None

North Dakota

• None

Ohio

• None

Oklahoma

• None

Oregon

• OCPA (7/1/2024)
  • This law gives the consumer rights to confirmation of whether their data is being controlled by a broker, a list of parties that have access to this data, and a copy of their data. This law also requires the broker to correct any and all inaccuracies in the data, delete personal data of the consumer, and allow the consumer to opt out of the processing of their data. These laws apply to companies that have access to the data of 100,000 or more consumers per year, as well as grossing 25% or more of their profits from the sale of personal data.

Pennsylvania

• None

Rhode Island

• RIDTPPA (1/1/2026)
  • This law applies to companies that process a minimum of 35,00 state residents’ data or control at least 10,000 residents’ data and derive 20% of gross revenue from it. Residents will have the right to: confirm their data is being processed; correct any inaccuracies; delete any personal data; have data portability; and opt out of the sale of their data.

South Carolina

• None

South Dakota

• None

Tennessee

• TIPA (7/1/2025)
  • Companies that process the information of at least 175,000 consumers in a calendar year, as well as gross a minimum of 50% of their revenue from the sale of personal data, must be compliant with this law. These companies must confirm they have your data, correct inaccuracies in your data, delete your data, provide a copy of your data, and provide a way to opt out of the sale of your data.

Texas

• TDPSA (7/1/2024)
  • This law gives consumers the right to correct, access, delete, and opt out of the sale of their data. This law also stops companies from processing data relating to children under COPPA.

Utah

• UCPA (12/31/2023)
  • This law gives consumers the right to access and delete their data, opt out of the collection of their data, and obtain a copy of their data in a portable, usable format. These laws apply to businesses that have a revenue of 25 million or more, control the data of 100,000 people or more, and that 50% of their revenue is generated from the sale of personal data.

Vermont 

• VDPA (7/1/2025)
  • This law applies to companies that process the data of at least 25,000 consumers or derive 25% or more of their gross revenue from the sale of 12,500 or more Vermont consumers. Under this law, personal data is defined as any data that could directly or indirectly identify an individual.  This law gives Vermont consumers the right to know if their info is being processed, to access their information, delete their data, correct their data, and opt out of the sla eof their data.

Virginia 

• VCDPA (1/1/2023)
  • This law requires that businesses give consumers clear privacy notices as well as a clear way to opt out.  It also requires that businesses comply with opt-out requests within 45 days, as well as opt-in consent from consumers. Businesses must disclose to consumers if their data will be sold, as well as allow consumers to be able to opt out of that sale and delete their data.

Washington

• None

West Virginia

• None

Wisconsin

• None

Wyoming

• None