As of November 2024, 11 U.S. states had state-level data privacy laws signed. While the core content was similar in these regulations, they differed in addressing certain business obligations regarding data privacy. According to all state-level laws, businesses were obligated to notify consumers about certain data privacy operations. Furthermore, according to all signed laws, companies are required to treat consumers under a certain age with an opt-in default for the sale of their personal information.
State laws on data privacy in the United States as of November 2024, by business obligations
Privacy laws
Opt-in default (requirement age)
Notice/transparency requirement
Risk assessments
Prohibition on discrimination (exercising rights)
Purpose/processing limitation
California Consumer Privacy Act (effective - Jan 1, '20)
16
Yes
yes
No
Yes
Colorado Privacy Act (effective - Jul 1, '23)
Sensitive data/13
Yes
Yes
Yes
Yes
Connecticut Data Privacy Act (effective - Jul 1, '23)
Sensitive data/13
Yes
Yes
Yes
Yes
Delaware Personal Data Privacy Act (effective - Jan 1 '25)
17
Yes
Yes
Yes
Yes
Indiana Consumer Data Protection Act (effective - Jan 1, '26)
Sensitive data/13
Yes
Yes
Yes
Yes
Iowa Consumer Data Protection Act (effective - Jan 1, '25)
Sensitive data/13
Yes
No
Yes
Yes
Kentucky Consumer Data Protection Act (effective - Jan 1, '26)
Sensitive data/13
Yes
Yes
Yes
Yes
Maryland Online Data Privacy Act (effective - Oct 1, '25)
13
Yes
Yes
Yes
Yes
Minnesota Consumer Data Privacy Act (effective - July 31, '25)
Sensitive data/13
Yes
Yes
Yes
Yes
Montana Consumer Data Privacy Act (effective - Oct 1, '24)
Sensitive data/13
Yes
Yes
Yes
Yes
Nebraska Data Privacy Act (effective - Jan 1, '25)
Profit from the additional features of your individual account
Currently, you are using a shared account. To use individual functions (e.g., mark statistics as favourites, set
statistic alerts) please log in with your personal account.
If you are an admin, please authenticate by logging in again.
Learn more about how Statista can support your business.
IAPP. (November 18, 2024). State laws on data privacy in the United States as of November 2024, by business obligations [Graph]. In Statista. Retrieved December 18, 2024, from https://www.statista.com/statistics/1402503/privacy-state-laws-us-by-business-obligations/
IAPP. "State laws on data privacy in the United States as of November 2024, by business obligations." Chart. November 18, 2024. Statista. Accessed December 18, 2024. https://www.statista.com/statistics/1402503/privacy-state-laws-us-by-business-obligations/
IAPP. (2024). State laws on data privacy in the United States as of November 2024, by business obligations. Statista. Statista Inc.. Accessed: December 18, 2024. https://www.statista.com/statistics/1402503/privacy-state-laws-us-by-business-obligations/
IAPP. "State Laws on Data Privacy in The United States as of November 2024, by Business Obligations." Statista, Statista Inc., 18 Nov 2024, https://www.statista.com/statistics/1402503/privacy-state-laws-us-by-business-obligations/
IAPP, State laws on data privacy in the United States as of November 2024, by business obligations Statista, https://www.statista.com/statistics/1402503/privacy-state-laws-us-by-business-obligations/ (last visited December 18, 2024)
State laws on data privacy in the United States as of November 2024, by business obligations [Graph], IAPP, November 18, 2024. [Online]. Available: https://www.statista.com/statistics/1402503/privacy-state-laws-us-by-business-obligations/
