Privacy laws U.S. by business obligations 2025| ��ƽ��

State laws on data privacy in the United States as of February 2025, by business obligations

Privacy laws	Opt-in default (requirement age)	Notice/transparency requirement	Risk assessments	Prohibition on discrimination (exercising rights)	Purpose/processing limitation
California Consumer Privacy Act (effective - Jan 1, '20)	16	Yes	Yes	Yes	Yes
Colorado Privacy Act (effective - Jul 1, '23)	Sensitive data/13	Yes	Yes	Yes	Yes
Connecticut Data Privacy Act (effective - Jul 1, '23)	Sensitive data/13	Yes	Yes	Yes	Yes
Delaware Personal Data Privacy Act (effective - Jan 1 '25)	17	Yes	Yes	Yes	Yes
Indiana Consumer Data Protection Act (effective - Jan 1, '26)	Sensitive data/13	Yes	Yes	Yes	Yes
Iowa Consumer Data Protection Act (effective - Jan 1, '25)	Sensitive data/13	Yes	No	Yes	Yes
Kentucky Consumer Data Protection Act (effective - Jan 1, '26)	Sensitive data/13	Yes	Yes	Yes	Yes
Maryland Online Data Privacy Act (effective - Oct 1, '25)	13	Yes	Yes	Yes	Yes
Minnesota Consumer Data Privacy Act (effective - July 31, '25)	Sensitive data/13	Yes	Yes	Yes	Yes
Montana Consumer Data Privacy Act (effective - Oct 1, '24)	Sensitive data/13	Yes	Yes	Yes	Yes
Nebraska Data Privacy Act (effective - Jan 1, '25)	Sensitive data/13	Yes	Yes	Yes	Yes
New Hampshire Privacy Act (effective- Jan 1, '25)	Sensitive data/13	Yes	Yes	Yes	Yes
New Jersey Data Protection Act (effective- Jan 15, '25)	Sensitive data/13	Yes	Yes	Yes	Yes
Oregon Consumer Privacy Act (effective - Jul 1, '24)	Sensitive data/13	Yes	Yes	Yes	Yes
Rhode Island Data Transparency and Privacy Protection Act (effective - 1 Jan. '26)	Sensitive data/13	Yes	Yes	Yes	Yes
Tennessee Information Protection Act (effective - 1 Jul, '25)	Sensitive data/13	Yes	Yes	Yes	Yes
Texas Data Privacy and Security Act (effective - 1 Jul, '24)	Sensitive data/13	Yes	Yes	Yes	Yes
Utah Consumer Privacy Act (effective - 31 Dec, '23)	Sensitive data/13	Yes	No	Yes	No
Virginia Consumer Data Protection Act (effective - 1 Jan, '23)	Sensitive data/13	Yes	Yes	Yes	Yes

Download

Source

Show detailed source information?

Already a member?

Source

Release date

February 2025

More information

Region

United States

Survey time period

February 2025

Citation formats

As of February 2025, 19 U.S. states had state-level data privacy laws signed. While the core content in these regulations was similar, they varied in addressing certain business obligations regarding data privacy. According to all state-level laws, businesses are obligated to notify consumers about certain data privacy operations. Furthermore, all signed laws require companies to treat consumers under a certain age with an opt-in default for the sale of their personal information.