Privacy laws U.S. by consumer rights covered 2024

As of November 2024, 10 states in the U.S. had state-level privacy laws signed. While the core content was mainly similar in these regulations, they differed in covering certain consumer rights. All signed laws protect the right of a consumer to access personal information collected by companies and shared with third parties. The first state-level privacy law proposed in California in 2018 had gaps, as it did not reference the consumer's right to request a correction of incorrect or outdated personal information and other rights. However, the second privacy law developed afterward in California, the California Privacy Rights Act, was more comprehensive. Other consumer rights, such as the consumer's right to opt out of specific processing and the right to opt in for sensitive data processing, were rarely protected, too. Only two laws covered the consumer's right of private action, with certain limitations.

State laws on data privacy in the United States as of November 2024, by consumer rights covered

Privacy laws	Right to access	Right to correct	Right to delete	Right to opt out of certain processing	Right to portability	Right to opt out of sales	Right to opt in for sensitive data processing	Right against automated decision making	Private right of action
California Consumer Privacy Act (effective - Jan 1, '20)	Yes	Yes	Yes	Sensetive data	Yes	Yes	No	Yes	Limited to certain violations only
Colorado Privacy Act (effective - Jul 1, '23)	Yes	Yes	Yes	Right to opt-out of processing for profiling/targeted advertising purposes	Yes	Yes	Yes	Yes	No
Connecticut Data Privacy Act (effective - Jul 1, '23)	Yes	Yes	Yes	Right to opt-out of processing for profiling/targeted advertising purposes	Yes	Yes	Yes	Yes	No
Delaware Personal Data Privacy Act (effective - Jan 1 '25)	Yes	Yes	Yes	Right to opt-out of processing for profiling/targeted advertising purposes	Yes	Yes	Yes	Yes	No
Indiana Consumer Data Protection Act (effective - Jan 1, '26)	Yes	Yes	Yes	Right to opt-out of processing for profiling/targeted advertising purposes	Yes	Yes	Yes	Yes	No
Iowa Consumer Data Protection Act (effective - Jan 1, '25)	Yes	No	Yes	No	Yes	Yes	No	No	No
Kentucky Consumer Data Protection Act (effective - Jan 1, '26)	Yes	Yes	Yes	Right to opt-out of processing for profiling/targeted advertising purposes	Yes	Yes	Yes	Yes	No
Maryland Online Data Privacy Act (effective - Oct 1, '25)	Yes	Yes	Yes	Right to opt-out of processing for profiling/targeted advertising purposes	Yes	Yes	Yes	Yes	No
Minnesota Consumer Data Privacy Act (effective - July 31, '25)	Yes	Yes	Yes	Right to opt-out of processing for profiling/targeted advertising purposes	Yes	Yes	Yes	Yes	No
Montana Consumer Data Privacy Act (effective - Oct 1, '24)	Yes	Yes	Yes	Right to opt-out of processing for profiling/targeted advertising purposes	Yes	Yes	Yes	Yes	No