State Privacy Laws: Which States Have One and Where to Read It

Short answer: Many states now have comprehensive state privacy laws, and the list keeps changing. A comprehensive privacy law is a statute (a law passed by a legislature) that gives people rights over their personal data and puts duties on businesses across most industries. The table below covers every state I could confirm from the state's own code, with the citation to read. This post is general information and is not legal advice.

TL;DR

• "Comprehensive" here means rights to see, correct, delete and opt out of the sale of personal data, plus duties for businesses that handle it. A health privacy law or a breach notice law does not count.
• Whether a law covers you depends on thresholds, such as how many residents' data you handle.
• Start dates, cure periods and thresholds are changing in several states during 2026 and 2027.
• California is the only row with an express right for consumers to sue, and only after certain data breaches.
• Do not rely on any list for a count. Use the check at the end of this post.

What I counted as a comprehensive law

The test: a statute must give consumers rights over their personal data and impose duties on the businesses that control it, across industries. A sector law covers one field, such as banking or health care. A breach law only says what to do after data is stolen. Neither is in the table.

I found candidates by running a topic search across every state's statutes through Vaquill AI's API. Then I read each law's coverage, enforcement and start-date text in the state's own code or session law. A session law is the act as the legislature passed it, before it is folded into the code.

State privacy laws in one table

How to use the table: find your states, check the "covers a business that" column against your numbers, then read the enforcement columns. Five terms matter.

• A consumer is a person whose data is collected. Each law defines the term for itself.
• A controller is the business that decides why and how personal data is used.
• A cure period is a window to fix a violation after a warning, before any penalty.
• A private suit is a lawsuit that a consumer files on their own.
• Sensitive data is a list each statute sets out, with things like health details.

I checked every row on October 5, 2026. Where a column is silent, the text I read is silent. Later amendments can change a row, and each law has exemptions the table does not show, so treat it as a starting point.

Connecticut's row comes from Public Act 25-113, because the state's online code page I read had not yet folded in the July 2026 changes. Delaware's 2027 change is House Bill 380, signed September 2, 2026, and you can read it on the Delaware legislature's site. The summary printed on that page was written when the bill was introduced and cites a different threshold, so use the signed version's numbers. Kentucky's is 2026 Ky. Acts ch. 118. Start dates come from each session law. Coverage and enforcement come from the codified text, except Connecticut's coverage, which comes from the public act.

Laws that are not in the table yet

The table holds laws I could read in the state code. Oklahoma, Louisiana and Vermont have each passed a comprehensive law that starts later. I read the acts on their legislatures' sites, such as Oklahoma's bill page. Oklahoma's Senate Bill 546 and Louisiana's Act 502 start January 1, 2027. Vermont's Act 145 starts January 1, 2028. I left them out because I could not read their codified text, which is the version that sits in the state's code.

What they have in common

These laws follow a shared pattern. New Hampshire's section on consumer rights is typical. It lets a consumer confirm whether a business holds their data, correct it, delete it, get a copy, and opt out of targeted ads, the sale of the data, or automated decisions with serious effects. Many of the laws also require a privacy notice and a written risk review, called a data protection assessment, for riskier uses. Most set special rules for sensitive data, which is a list the statute sets out.

Here is a real operative passage. Virginia's coverage section, Va. Code § 59.1-576(A), reads:

This chapter applies to persons that conduct business in the Commonwealth or produce products or services that are targeted to residents of the Commonwealth and that (i) during a calendar year, control or process personal data of at least 100,000 consumers or (ii) control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data.

You can read it at the Virginia code site.

Where they differ, and what matters most if you sell nationwide

Who is covered. Virginia needs 100,000 consumers. Maryland needs 35,000. Delaware moves to 10,000 in 2027. Texas and Nebraska ask whether you are a small business instead of counting people. Florida puts its main duties on companies with over $1 billion in global revenue. Connecticut now covers any business that handles sensitive data or offers data for sale.

Start dates and moving rules. Alabama starts in 2027. Delaware and Kentucky change in 2027. Connecticut changed in July 2026. A table from last spring may be wrong.

Cure periods. A cure period lets you fix a problem after a warning. Virginia, Texas, Indiana and Utah keep one in their text with no end date. Minnesota's and Oregon's have ended. Rhode Island and Montana show none in their enforcement sections. If you plan to rely on a cure period, read the enforcement section for that state itself.

Who can sue. Every law in the table sends enforcement to a state office. California's text lets consumers sue, and only after certain data breaches. Maryland's text keeps other remedies open, so ask counsel what that means there. Alabama's text says nothing either way.

Who counts as a consumer. Virginia says a consumer acts "only in an individual or household context" and excludes people acting "in a commercial or employment context." California defines a consumer as "a natural person who is a California resident." That difference decides whether employee and business-contact data is in scope.

Here are thresholds in practice. A company with data on 40,000 Maryland residents is covered in Maryland. A company with data on 12,000 Delaware residents is not covered today, unless it earns over 20% of revenue from selling data, but will be from January 1, 2027.

The safest national approach is to meet the strictest version of each rule you are subject to. A lawyer can tell you which rules apply to you.

Common mistakes

• Counting states. A number goes stale in weeks. Check the states where your customers live.
• Reading a summary instead of the statute. Law-firm charts help you find the section. They lag behind amendments.
• Using the old threshold. Connecticut and Delaware changed theirs. Your headcount of users may now cross the line.
• Assuming a nonprofit or a bank is out. Many laws exempt them in whole or in part, and the exemptions differ. Read the exemption section.

How to check whether your state has one

1. Open the state legislature's official website and find the searchable code. Do not start from a blog.
2. Search the code for the words "controller" and "personal data." Add "consumer" and "opt out" if you get too many hits.
3. Open the hit and look for a section on coverage, one on consumer rights and one on enforcement. A law with all three is the kind this post means.
4. Read the coverage section and note the numbers. Read the enforcement section for the enforcer, penalties, any cure period and any private suit.
5. Find the start date in the session law or the history note under the section.
6. Look for newer acts. Search the legislature's site for this year's enacted bills on "data privacy," and check the attorney general's site.
7. Write down the date you checked. Our guides on running a 50-state survey and citing a statute walk through the method. For the layers of law you will meet, see types of primary law. For why a source can lag, see legal data freshness.

This guide is part of US Law Data: The Complete Guide, a map of where US law comes from and how to use it.

FAQ

Which states have privacy laws?

Many do, and more are passing them. The table lists the ones I could confirm from state code. The section after it names three more that start in 2027 and 2028. For your states, use the check above.

Does my small business have to follow a state privacy law?

It depends on the state. Most laws apply only above a size test, such as the number of residents whose data you handle. Texas and Nebraska use a small business test instead. Some states also apply a few rules to small businesses, such as consent before selling sensitive data. Read the coverage section.

Is there a federal privacy law that covers everything?

The state laws I read point to federal laws for single fields, such as HIPAA, the federal health privacy law, and COPPA, the federal children's online privacy law. This post covers state statutes only.

Can a consumer sue under these laws?

Rarely. Every law in the table puts enforcement in a state office. California's text lets consumers sue after certain data breaches. Maryland's text keeps other remedies open, and Alabama's is silent. Ask counsel before relying on any of these points.

What is a state privacy law tracker, and can I trust one?

A tracker is a list someone keeps up to date. Use it to find the section, then read that section on the state's own site. It is only as current as its last edit.

If you need official statute text behind a workflow like this one, see Vaquill AI's legal API.

Priyansh Khodiyar

Co-Founder & CTO

Priyansh leads engineering and AI at Vaquill AI: the pipelines that pull statutes, regulations and court rules from every US jurisdiction's official publisher, and the REST API, MCP server and open dataset that serve them.