What Data Privacy Laws Protect Me? A State-By-State Guide

If you live in the United States, your personal data privacy can be protected by a combination of state and federal laws.

While there is currently no comprehensive federal data privacy law, an increasing number of states have enacted data privacy legislation. These laws include the California Consumer Privacy Act (CCPA), Colorado Privacy Act (CPA), and Virginia Consumer Data Protection Act (VCDPA).

If you have questions about your data privacy rights or feel your rights have been violated, seek legal guidance. For legal help with data privacy violations, speak with a consumer law attorney.

Why Privacy Protection Matters

Your personal data holds incredible power. In today’s world, social media, data brokers, and endless online services are part of our daily lives. Personal data collection shapes everything from the ads you see online to the decisions that financial institutions make about you.

Data privacy laws, while not perfect, provide increasing protection for consumers against companies that collect and use their personal information. Your right to access and control your information is becoming stronger than ever.

Understanding your consumer rights, including any state privacy legislation, is important to making the most of these protections.

Federal Laws Addressing Privacy and Security

There is no single comprehensive federal data privacy law. However, several federal laws address aspects of privacy and data security, including:

• Children’s privacy
• Health privacy
• Consumer privacy
• Credit reporting

Federal laws often lag behind new technological developments, so you must be proactive about safeguarding your digital privacy and know what protection you may have under your state’s law.

The California Standard: CCPA and CPRA

When it comes to comprehensive data privacy laws, California has led the way. The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), set the standard for privacy protection in the U.S.

The CCPA requires companies to disclose their practices for collecting and sharing personal data and sensitive personal information. The CPRA, which amended the CCPA, added new provisions that further expand consumer privacy laws. The CPRA also launched the California Privacy Protection Agency.

Together, these laws give Californians rights, including the ability to:

• Demand deletion of personal information
• Correct inaccuracies
• Opt out of the sale or sharing of personal information

Californians can stop the use of their personal data by brokers, nonprofits, and service providers, with some exemptions. The state attorney general has the authority to enforce these regulations on behalf of California’s citizens.

The CCPA also impacts individuals and businesses in other states. In fact, as state protections increase, more businesses nationwide have adopted stricter privacy protection models. Taking this approach, rather than maintaining a state-by-state system, eases the administrative burden. Companies may adopt practices from California, Colorado, or Connecticut and apply those to all customers, regardless of where they are located. This is a win for consumers everywhere.

State-by-State Data Privacy Laws

Following California’s lead, other states have enacted comprehensive privacy legislation. Some states have adopted laws similar to California’s, some have introduced even stronger protections, and others offer narrower protections.

The following table summarizes key protections in states with data privacy laws, where to file a data privacy complaint with the state, and presents states with proposed data privacy legislation.

State	State Privacy Laws	Key Protections of the State Privacy Laws	Private Right of Action	Link To File a Complaint
California	California Privacy Rights Act (CPRA) California Consumer Privacy Act (CCPA)	* Right to access, correct, and delete data * Businesses must provide clear privacy notice * Right to opt-out of data sharing * High-privacy settings for minors	Yes (data breaches)	CCPA/CPRA Complaint
Colorado	Colorado Privacy Act (CPA)	* Right to access, correct, and delete data * Businesses must provide clear privacy notice * Opt-in requirement for sensitive data * Must obtain affirmative consent for processing minor data		Colorado AG File a Complaint
Connecticut	Connecticut Data Privacy Act (CTDPA)	* Right to access, correct, and delete data * Businesses must provide clear privacy notice * Opt-in requirement for sensitive data * Prohibits targeted ads and selling data for minors		Connecticut DCP Complaint Center
Delaware	Delaware Personal Data Privacy Act (DPDPA)	* Right to access, correct, and delete data * Businesses must provide clear privacy notice * Opt-in requirement for sensitive data * Prohibits targeted ads and selling data for ages 13-17		Delaware Personal Data Privacy Portal
Florida	Florida Digital Bill of Rights (FDBR)	* Right to access, correct, and delete data * Businesses must provide clear privacy notice * Right to opt-out of sensitive data collection * Requires consent for data processing for minors		Florida AG Consumer Webform
Indiana	Indiana Consumer Data Protection Act (InCDPA)	* Right to access, correct, and delete data * Businesses must provide clear privacy notice * Opt-in requirement for sensitive data * Parents have right to access, correct, and delete data for minors		Indiana AG Consumer Complaint
Iowa	Iowa Data Protection Act (IDPA)	* Right to access and delete data * Businesses must provide clear privacy notice * Right to opt-out of sensitive data collection * Limited additional privacy protections for minors		Iowa AG Consumer Complaint
Kentucky	Kentucky Consumer Data Protection Act (KCDPA)	* Right to access, correct, and delete data * Businesses must provide clear privacy notice * Opt-in requirement for sensitive data * Limited additional privacy protections for minors		Kentucky AG Consumer Complaint
Maryland	Maryland Online Data Privacy Act (MODPA)	* Right to access, correct, and delete data * Businesses must provide clear privacy notice * Businesses cannot sell sensitive data * Prohibits targeted advertising to minors		Maryland OSP Complaint
Minnesota	Minnesota Consumer Data Privacy Act (MCDPA)	* Right to access, correct, and delete data * Must provide a description of consumer’s rights * Opt-in requirement for sensitive data * Platforms must show Social Media Warning for teens aged 13-17		Minnesota AG Data Privacy Complaint
Montana	Montana Consumer Data Privacy Act (MCDPA)	* Right to access, correct, and delete data * Must provide notice if they sell sensitive data * Opt-in requirement for sensitive data * Requires opt-in for ads targeting minors		Montana DOJ Consumer Complaints
Nebraska	Nebraska Data Privacy Act (NDPA)	* Right to access, correct, and delete data * Must provide notice if they sell sensitive data * Opt-in requirement for sensitive data * Requires data protection impact assessment for minors		Nebraska Data Privacy Complaint
New Hampshire	New Hampshire Data Privacy Act (NHDPA)	* Right to access, correct, and delete data * Businesses must provide clear privacy notice * Opt-in requirement for sensitive data * Requires opt-in for ads targeting minors		New Hampshire DOJ Consumer Protection
New Jersey	New Jersey Data Privacy Law	* Right to access, correct, and delete data * Must disclose use of dta for profiling * Opt-in requirement for sensitive data * Requires opt-in for ads targeting minors (ages 13-17)		New Jersey Consumer Affairs Complaint
Oregon	Oregon Consumer Privacy Act (OCPA)	* Right to access, correct, and delete data * Businesses must provide clear privacy notice * Opt-in requirement for sensitive data * Requires opt-in for ads targeting minors (ages 13-15)		Oregon Consumer Protection Portal
Rhode Island	Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)	* Right to access, correct, and delete data * Businesses must provide clear privacy notice * Opt-in requirement for sensitive data * Requires opt-in for ads targeting minors (ages 13-17)		Rhode Island AG Complaint
Tennessee	Tennessee Information Protection Act (TIPA)	* Right to access, correct, and delete data * Must disclose consumer’s rights * Opt-in requirement for sensitive data * Limited additional privacy protections for minors		Tennessee AG Consumer Complaint
Texas	Texas Data Privacy and Security Act (TDPSA)	* Right to access, correct, and delete data * Must provide notice if they sell sensitive data * Opt-in requirement for sensitive data * Heightened transparency for data collection from minors		Texas AG Data Privacy Complaint
Utah	Utah Consumer Privacy Act (UCPA)	* Right to access, correct, and delete data * Must disclose consumer’s rights * Opt-in requirement for sensitive data * Social media protections for minors falls under another law		Utah CPA Complaint
Virginia	Virginia Consumer Data Privacy Act (VCDPA)	* Right to access, correct, and delete data * Businesses must provide clear privacy notice * Requires consent for sensitive data gathering * Specific protections for minors’ data		Virginia AG Consumer Complaint Form

Data Privacy Laws Coming Into Effect July 1, 2026, or Later

State	State Privacy Laws	Key Protections of the State Privacy Laws	Private Right of Action	Effective Date
Arkansas	Arkansas Personal Information Protection Act (APIPA)	* Right to access, correct, and delete data for minors only * Businesses must provide clear privacy notice for minors only * Right to opt-out of data sharing for minors * Targeted ad ban and personal data collection for under 17		July 1, 2026
Alabama	Alabama Personal Data Protection Act (APDPA)	* Right to access, correct, and delete data * Businesses must provide clear privacy notice * Right to opt-out of data sharing * Opt-in for data or targeted ads for teens age 13-15		May 1, 2027
Oklahoma	Oklahoma Consumer Privacy Act (OKCDPA)	* Right to access, correct, and delete data * Businesses must provide clear privacy notice * Right to opt-out of data sharing * Limited additional privacy protections for minors		Jan 1, 2027
Vermont	Vermont Data Privacy Act	* Right to access, correct, and delete data * Businesses must provide clear privacy notice * Businesses cannot sell sensitive data * High-privacy settings for minors	Right of action (consumer health data)	July 1, 2026

How Data Privacy Laws Protect You

State privacy laws seek to give you control, security, and transparency over your personal data. The specific protections that apply to you depend on your state, whether it has data privacy laws in place, and if so, what type.

A couple of states allow private rights of action for data privacy violations, meaning consumers can sue directly. The good news is that more U.S. states are enacting more comprehensive data privacy laws.

Although these state privacy laws differ, many share common provisions to protect your privacy. Here are some of the most common core rights these laws address.

The Right To Know and Access

Transparency is at the heart of many data privacy laws. Businesses must clearly explain their data collection practices. They must also disclose the kinds of personal data they share. This includes geolocation information or other sensitive personal information.

You have the right to access your data. This right is included in most comprehensive state privacy laws.

The Right To Delete

You can ask a company or financial institution to delete your information, whether from direct operations or from service providers.

There are, however, some exceptions, such as for fraud prevention. Laws like the CCPA and CPA require full compliance from companies and their third-party vendors.

The Right To Opt Out

Nearly all current and proposed consumer privacy laws include the right to opt out of data sharing. This data can include data sales, targeted ads, and profiling

Opting out protects your information from being sold to data brokers or used for profiling. Many U.S. state privacy laws emphasize the ability to opt out with a single click. When you do so, businesses must honor your wishes.

Protection for Sensitive Data

Sensitive data comes in all types. It can include:

• Health data
• Genetic or biometric data
• Information on minors
• Sexual orientation
• Race

These categories of data could be considered sensitive data and may require additional protections and explicit consent under some data privacy laws. These protections have become even stronger in more recent laws.

Cybersecurity and Data Security

State data privacy laws require reasonable cybersecurity and data management practices that secure your personal data. These practices are essential for reducing the chances of data breaches.

State attorneys general play a vital role in enforcing these protections on behalf of their citizens, bringing an extra layer of accountability.

How To Initiate a Claim for a Data Privacy Violation

As a consumer, you can act under privacy legislation by following a few simple steps:

1. Review privacy policies. Be familiar with the privacy policy for the businesses you interact with by reading the policy. Whether you’re dealing with a small business or a multi-national corporation, they should provide instructions for exercising your right to access, delete, or opt out of data collection.
2. Submit requests. Use the appropriate forms to make requests under privacy laws. Laws such as the CCPA, CTDPA, and VCDPA mandate specific forms or means of contact.
3. Enforcement. If the business ignores your request or if your sensitive data is mishandled, you can file a complaint with your state’s attorney general.

Protecting Your Digital Privacy

Protecting your digital privacy is more important than ever. Eliminating your digital footprint entirely is unrealistic, but you can take meaningful steps to protect yourself.

The easiest way to protect your digital privacy is to reduce the amount of information you share online. Other measures include the following:

• Secure your accounts. Create strong, unique passwords, update them regularly, and protect sensitive information.
• Keep software current. Install reliable antivirus software and keep it up to date.

• Stay alert for scams. Avoid clicking unknown links, replying to texts from unfamiliar senders, or responding to unsolicited social media messages.
• Tighten your settings. Check and adjust the privacy controls on your web browsers, mobile apps, and smart devices.
• Protect your connection. Use a virtual private network (VPN) and avoid connecting to unsecured public Wi-Fi to ensure a safe and secure connection while online.
• Minimize app tracking. Limit how many apps you download. When possible, log in to social media through a website rather than using the dedicated app.
• Choose privacy-focused tools. Switch to web browsers and messaging apps that feature built-in privacy protections.

Get Legal Help for Data Privacy Rights Violations

Even if you take all the precautions in the world, you may still experience a data privacy violation. If you are a consumer whose data privacy rights have been violated, it’s critical to understand your legal options.

For legal help with data privacy violations, speak with an attorney specializing in consumer law. They can explain your rights and help you move forward.