| Alabama |
Enacted, not yet in force
|
May 1, 2027 |
A comprehensive consumer privacy law is enacted and starts May 1, 2027. It is not in force yet. |
| Alaska |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force as of September 28, 2026. Federal rules and the local data-breach law still apply, and other laws may cover specific data, such as health or children's data. |
| Arizona |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force as of September 28, 2026. Federal rules and the local data-breach law still apply, and other laws may cover specific data, such as health or children's data. |
| Arkansas |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force as of September 28, 2026. Federal rules and the local data-breach law still apply, and other laws may cover specific data, such as health or children's data. |
| California |
In force (CCPA/CPRA)
|
January 1, 2020 |
Comprehensive consumer privacy law in force: CCPA/CPRA, effective January 1, 2020. The CPRA amendments have applied since January 1, 2023. CalOPPA also applies to any commercial website that collects personal information from a California resident. |
| Colorado |
In force (CPA)
|
July 1, 2023 |
Comprehensive consumer privacy law in force: CPA, effective July 1, 2023. |
| Connecticut |
In force (CTDPA)
|
July 1, 2023 |
Comprehensive consumer privacy law in force: CTDPA, effective July 1, 2023. |
| Delaware |
In force (DPDPA)
|
January 1, 2025 |
Comprehensive consumer privacy law in force: DPDPA, effective January 1, 2025. |
| District of Columbia |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force as of September 28, 2026. Federal rules and the local data-breach law still apply, and other laws may cover specific data, such as health or children's data. |
| Florida |
In force (Florida Digital Bill of Rights)
|
July 1, 2024 |
Comprehensive consumer privacy law in force: Florida Digital Bill of Rights, effective July 1, 2024. It covers far fewer businesses than the other state laws, mainly very large companies. |
| Georgia |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force as of September 28, 2026. Federal rules and the local data-breach law still apply, and other laws may cover specific data, such as health or children's data. |
| Hawaii |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force as of September 28, 2026. Federal rules and the local data-breach law still apply, and other laws may cover specific data, such as health or children's data. |
| Idaho |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force as of September 28, 2026. Federal rules and the local data-breach law still apply, and other laws may cover specific data, such as health or children's data. |
| Illinois |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force as of September 28, 2026. Federal rules and the local data-breach law still apply, and other laws may cover specific data, such as health or children's data. |
| Indiana |
In force (INCDPA)
|
January 1, 2026 |
Comprehensive consumer privacy law in force: INCDPA, effective January 1, 2026. |
| Iowa |
In force (ICDPA)
|
January 1, 2025 |
Comprehensive consumer privacy law in force: ICDPA, effective January 1, 2025. |
| Kansas |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force as of September 28, 2026. Federal rules and the local data-breach law still apply, and other laws may cover specific data, such as health or children's data. |
| Kentucky |
In force (KCDPA)
|
January 1, 2026 |
Comprehensive consumer privacy law in force: KCDPA, effective January 1, 2026. |
| Louisiana |
Enacted, not yet in force
|
January 1, 2027 |
A comprehensive consumer privacy law is enacted and starts January 1, 2027. It is not in force yet. |
| Maine |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force as of September 28, 2026. Federal rules and the local data-breach law still apply, and other laws may cover specific data, such as health or children's data. |
| Maryland |
In force (MODPA)
|
October 1, 2025 |
Comprehensive consumer privacy law in force: MODPA, effective October 1, 2025. |
| Massachusetts |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force as of September 28, 2026. Federal rules and the local data-breach law still apply, and other laws may cover specific data, such as health or children's data. |
| Michigan |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force as of September 28, 2026. Federal rules and the local data-breach law still apply, and other laws may cover specific data, such as health or children's data. |
| Minnesota |
In force (MNDPA)
|
July 31, 2025 |
Comprehensive consumer privacy law in force: MNDPA, effective July 31, 2025. |
| Mississippi |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force as of September 28, 2026. Federal rules and the local data-breach law still apply, and other laws may cover specific data, such as health or children's data. |
| Missouri |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force as of September 28, 2026. Federal rules and the local data-breach law still apply, and other laws may cover specific data, such as health or children's data. |
| Montana |
In force (MCDPA)
|
October 1, 2024 |
Comprehensive consumer privacy law in force: MCDPA, effective October 1, 2024. |
| Nebraska |
In force (NDPA)
|
January 1, 2025 |
Comprehensive consumer privacy law in force: NDPA, effective January 1, 2025. |
| Nevada |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force as of September 28, 2026. Federal rules and the local data-breach law still apply, and other laws may cover specific data, such as health or children's data. |
| New Hampshire |
In force (NHPA)
|
January 1, 2025 |
Comprehensive consumer privacy law in force: NHPA, effective January 1, 2025. |
| New Jersey |
In force (NJDPA)
|
January 15, 2025 |
Comprehensive consumer privacy law in force: NJDPA, effective January 15, 2025. |
| New Mexico |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force as of September 28, 2026. Federal rules and the local data-breach law still apply, and other laws may cover specific data, such as health or children's data. |
| New York |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force. The SHIELD Act applies to any business that holds a New York resident's private information: it requires reasonable administrative, technical and physical safeguards and sets breach-notice rules. |
| North Carolina |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force as of September 28, 2026. Federal rules and the local data-breach law still apply, and other laws may cover specific data, such as health or children's data. |
| North Dakota |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force as of September 28, 2026. Federal rules and the local data-breach law still apply, and other laws may cover specific data, such as health or children's data. |
| Ohio |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force as of September 28, 2026. Federal rules and the local data-breach law still apply, and other laws may cover specific data, such as health or children's data. |
| Oklahoma |
Enacted, not yet in force
|
January 1, 2027 |
A comprehensive consumer privacy law is enacted and starts January 1, 2027. It is not in force yet. |
| Oregon |
In force (OCPA)
|
July 1, 2024 |
Comprehensive consumer privacy law in force: OCPA, effective July 1, 2024. |
| Pennsylvania |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force as of September 28, 2026. Federal rules and the local data-breach law still apply, and other laws may cover specific data, such as health or children's data. |
| Rhode Island |
In force (RIDTPPA)
|
January 1, 2026 |
Comprehensive consumer privacy law in force: RIDTPPA, effective January 1, 2026. |
| South Carolina |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force as of September 28, 2026. Federal rules and the local data-breach law still apply, and other laws may cover specific data, such as health or children's data. |
| South Dakota |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force as of September 28, 2026. Federal rules and the local data-breach law still apply, and other laws may cover specific data, such as health or children's data. |
| Tennessee |
In force (TIPA)
|
July 1, 2025 |
Comprehensive consumer privacy law in force: TIPA, effective July 1, 2025. |
| Texas |
In force (TDPSA)
|
July 1, 2024 |
Comprehensive consumer privacy law in force: TDPSA, effective July 1, 2024. |
| Utah |
In force (UCPA)
|
December 31, 2023 |
Comprehensive consumer privacy law in force: UCPA, effective December 31, 2023. |
| Vermont |
Enacted, not yet in force
|
January 1, 2028 |
A comprehensive consumer privacy law is enacted and starts January 1, 2028. It is not in force yet. |
| Virginia |
In force (VCDPA)
|
January 1, 2023 |
Comprehensive consumer privacy law in force: VCDPA, effective January 1, 2023. |
| Washington |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force as of September 28, 2026. Federal rules and the local data-breach law still apply, and other laws may cover specific data, such as health or children's data. |
| West Virginia |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force as of September 28, 2026. Federal rules and the local data-breach law still apply, and other laws may cover specific data, such as health or children's data. |
| Wisconsin |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force as of September 28, 2026. Federal rules and the local data-breach law still apply, and other laws may cover specific data, such as health or children's data. |
| Wyoming |
None in force
|
Not applicable |
No comprehensive consumer privacy law in force as of September 28, 2026. Federal rules and the local data-breach law still apply, and other laws may cover specific data, such as health or children's data. |