State Consumer Protection Laws (UDAP Statutes) Explained: 12 States Side by Side

Short answer: Every state has at least one law that bans unfair or deceptive business practices, and people call these laws UDAP statutes (short for "unfair and deceptive acts and practices"). They share a core idea and differ on the details that cost money: whether a customer can sue, whether damages can be tripled, how big the fines are, and whether you must send a warning letter first. This guide reads those details from the statute text in 12 named states. It does not cover all 50. This is general information, not legal advice.

TL;DR

• A UDAP statute is a state law (a statute, meaning a law passed by a legislature) that declares unfair or deceptive business conduct unlawful. Most give power to both a state official and private people who were harmed.
• This guide covers 12 states: California, Colorado, Florida, Illinois, Massachusetts, Michigan, New York, North Carolina, Ohio, Texas, Virginia and Washington. A state that is missing has not been ruled out.
• The big differences are who can sue, whether triple damages are possible, the size of the fine, and whether a notice must come before a lawsuit.
• Six of the 12 states tell their courts to follow federal Federal Trade Commission (FTC) readings of the federal law.
• I read each row on October 5, 2026. Laws change, so confirm against the current text before you rely on a row.

What a UDAP statute is

A deceptive practice is conduct that misleads a customer, such as a false price claim. An unfair practice can hurt a customer without any lie. New York's text defines it as one that "causes or is likely to cause substantial injury which is not reasonably avoidable." State laws handle these ideas in three ways. Some use one broad sentence. Some add a list of banned acts. Some do both.

Does every state have one? Justia's 50-state survey of consumer protection laws names a main UDAP statute for each state and Washington, DC, though I have read only the 12 below. Florida's section 501.202 says its aim is: "To make state consumer protection and enforcement consistent with established policies of federal law." The federal law behind them is section 5 of the FTC Act, first passed in 1914 and amended many times since (15 U.S.C. § 45).

State consumer protection laws: 12 states in one table

I found each section through Vaquill AI's API, then compared it with the state's own site on October 5, 2026. Some state sites block automated reads. For Illinois, Massachusetts, Michigan, North Carolina, Ohio and Colorado, I read the official page through a saved copy. Colorado's text comes from the legislature's 2026 printout, which the office labels uncertified.

Plain words used in the table:

• A private suit is a lawsuit a customer files on their own.
• A civil penalty is a fine paid to the state.
• Treble damages means three times the customer's proven loss. "Multiple" damages covers two or three times.
• An AG is the state attorney general, the state's chief legal officer.
• A pre-suit notice is a written warning the customer must send before suing.
• Actual damages are the loss the customer proves. Punitive damages are extra money meant to punish.
• A class action is one lawsuit filed for a large group with the same complaint.
• Unconscionable means grossly unfair or one-sided.

One row carries a date warning. Virginia section 59.1-200 shows four dated versions on the official page. The version that began October 1, 2026 was in force when I read it, and later versions start November 1, 2026 and July 1, 2027. The remedy and enforcement sections I used (59.1-204 and 59.1-206) are single versions.

How the states differ

What counts as deceptive. Washington, North Carolina, Massachusetts and Florida use broad words and leave the rest to courts. Michigan, Virginia and Ohio use lists. Texas's list matters because the main private route, section 17.50(a)(1), must rest on an act on that list. Warranty and unconscionability claims use other routes. New York's section 349 also bans "abusive" acts and defines the word.

Who can sue. All 12 states let some private person sue. The group varies. Ohio limits suits to "consumers." Massachusetts splits consumers from businesses. Colorado lets injured businesses sue. Texas excludes a business with $25 million or more in assets.

Extra damages. North Carolina is the only one of the 12 where tripling is automatic after a loss is proven. Texas, New York, Washington and Virginia leave it to the court. Colorado and Ohio set conditions. Florida, Illinois and Michigan show none in the text I read.

Warning letters. Texas needs 60 days and Massachusetts and California's CLRA need 30. The others in my table have none for most private claims.

Fines. Per-violation amounts run from $2,500 (California, Virginia) to $20,000 (Colorado). Illinois allows up to $50,000 per finding.

How a federal FTC rule relates to a state UDAP law

The federal rule is a separate law, and a state law can borrow from it. Congress wrote the base rule in 15 U.S.C. § 45(a)(1): "Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful." The FTC then writes detailed rules under that law.

Six of the 12 states tell courts to look to the FTC in their own text. Ohio tells its courts to give "due consideration and great weight" to FTC rules and guides (R.C. 1345.02(C)). Florida's § 501.204(2) uses similar words. Illinois, Massachusetts and Washington say courts should consider or be guided by the FTC's readings. Texas says so for the attorney general's suits.

A real example is the Telemarketing Sales Rule, which the FTC wrote. Under 16 C.F.R. § 310.3(a)(1)(i), a telemarketer must disclose "the total costs to purchase, receive, or use" what it sells before the customer agrees to pay. Federal law lets a state attorney general sue in federal court to enforce that rule (15 U.S.C. § 6103(a)). A second section adds that nothing there stops a state official "from proceeding in State court on the basis of an alleged violation of any civil or criminal statute of such State" (§ 6103(f)(1)). So one sales call that hides the total cost can fall under the federal rule and under a state UDAP statute. The state statute is the one that may give the customer a private suit. New York goes the other way on one point: compliance with FTC rules is "a complete defense" to its section 349 claims (§ 349(d)).

What goes wrong

• Reading one state's rule as the rule. A warning letter that works in Massachusetts is unneeded in Washington.
• Missing the list. In Texas, the main private route must rest on an act on the list.
• Reading "None in the text" as "none anywhere." The cell tells you what the sections I read say. Another section of the state's code may add a penalty or a duty.
• Assuming one UDAP law per state. California has three, spread across two codes. Other statutes can also make a violation a UDAP violation.
• Using an old print. Colorado changed section 6-1-105 in 2026, and a further change takes effect January 1, 2027.

What this guide does not cover

This guide covers 12 states. It does not cover the other 38, DC or the territories, and a missing state does not mean no law. To find the others, follow our 50-state survey guide. I left out New Jersey because I could not confirm all of its text on the legislature's own site.

To see whether a section has changed, read the history line under it. Our guides on session laws and legal data freshness explain why charts lag. For breach and privacy rules, see the state data breach guide and the state privacy laws guide.

This guide is part of US Law Data: The Complete Guide.

FAQ

What is a UDAP statute?

It is a state law that bans unfair and deceptive business practices. The letters stand for "unfair and deceptive acts and practices." Each state names its own law differently, such as the Consumer Protection Act or the Deceptive Trade Practices Act.

Can a customer sue under a state consumer protection law?

In all 12 states here, yes, in some form. The conditions differ. California's UCL alone allows only a court order and a refund, while its CLRA allows damages.

Which states allow triple damages?

In the text I read, North Carolina triples automatically. Texas, New York, Washington and Virginia allow up to three times at the court's choice. Massachusetts allows two to three times, and Ohio and Colorado set conditions. Florida, Illinois and Michigan show none.

Do I have to send a notice before suing?

Texas needs 60 days' written notice. Massachusetts consumer claims need a 30-day written demand, and so does the California CLRA for damages. Most others in my table do not need one for most private claims.

Who enforces these laws?

The attorney general in all 12 states. Many also let district attorneys, state attorneys or local attorneys act. Florida gives first role to the local state attorney.

How does an FTC rule affect my state's law?

Six of the 12 states tell courts to look to the FTC's readings. The federal telemarketing law lets state attorneys general enforce the FTC's telemarketing rule. New York treats compliance with FTC rules as a complete defense.

Is this list complete?

No. It covers 12 states. Check your own state's code and the history line under each section.

For readers who want the statute text behind a chart like this one, see the legal API.

Priyansh Khodiyar

Co-Founder & CTO

Priyansh leads engineering and AI at Vaquill AI: the pipelines that pull statutes, regulations and court rules from every US jurisdiction's official publisher, and the REST API, MCP server and open dataset that serve them.