As of July 2023, 10 U.S. states had state-level data privacy laws signed. While the core content was similar in these regulations, they differed in addressing certain business obligations regarding data privacy. According to all state-level laws, businesses were obligated to notify consumers about certain data privacy operations. Furthermore, according to all signed laws, companies are required to treat consumers under a certain age with an opt-in default for the sale of their personal information.
State laws on data privacy in the United States as of July 2023, by business obligations
Privacy laws
Opt-in default (requirement age)
Notice/transparency requirement
Risk assessments
Prohibition on discrimination (exercising rights)
Purpose/processing limitation
California Consumer Privacy Act (effective - Jan 1, '20)
16
Yes
No
No
Yes
California Privacy Rights Act (fully operative - Jan 1, '23)
16
Yes
Yes
Yes
Yes
Colorado Privacy Act (effective - Jul 1, '23)
Sensitive data/13
Yes
Yes
Yes
Yes
Connecticut Data Privacy Act (effective - Jul 1, '23)
Sensitive data/13
Yes
Yes
Yes
Yes
Indiana Consumer Data Protection Act (effective - Jan. 1, '26)
Sensitive data/13
Yes
Yes
Yes
Yes
Iowa Consumer Data Protection Act (effective - Jan.1, '25)
Sensitive data/13
Yes
No
Yes
Yes
Montana Consumer Data Privacy Act (effective - Oct.1, '24)
Sensitive data/13
Yes
Yes
Yes
Yes
Tennessee Information Protection Act (effective - Jul. 1, '25)
Sensitive data/13
Yes
Yes
Yes
Yes
Texas Data Privacy and Security Act (effective - Jul 1, '24)
Sensitive data/13
Yes
Yes
Yes
Yes
Utah Consumer Privacy Act (effective - Dec 31, '23)
13
Yes
No
Yes
No
Virginia Consumer Data Protection Act (effective - Jan 1, '23)
Profit from the additional features of your individual account
Currently, you are using a shared account. To use individual functions (e.g., mark statistics as favourites, set
statistic alerts) please log in with your personal account.
If you are an admin, please authenticate by logging in again.
Learn more about how Statista can support your business.
IAPP. (July 7, 2023). State laws on data privacy in the United States as of July 2023, by business obligations [Graph]. In Statista. Retrieved November 17, 2024, from https://www.statista.com/statistics/1402503/privacy-state-laws-us-by-business-obligations/
IAPP. "State laws on data privacy in the United States as of July 2023, by business obligations." Chart. July 7, 2023. Statista. Accessed November 17, 2024. https://www.statista.com/statistics/1402503/privacy-state-laws-us-by-business-obligations/
IAPP. (2023). State laws on data privacy in the United States as of July 2023, by business obligations. Statista. Statista Inc.. Accessed: November 17, 2024. https://www.statista.com/statistics/1402503/privacy-state-laws-us-by-business-obligations/
IAPP. "State Laws on Data Privacy in The United States as of July 2023, by Business Obligations." Statista, Statista Inc., 7 Jul 2023, https://www.statista.com/statistics/1402503/privacy-state-laws-us-by-business-obligations/
IAPP, State laws on data privacy in the United States as of July 2023, by business obligations Statista, https://www.statista.com/statistics/1402503/privacy-state-laws-us-by-business-obligations/ (last visited November 17, 2024)
State laws on data privacy in the United States as of July 2023, by business obligations [Graph], IAPP, July 7, 2023. [Online]. Available: https://www.statista.com/statistics/1402503/privacy-state-laws-us-by-business-obligations/
