The laws, and what they mean in practice
Privacy, AI and cybersecurity laws that shape digital trust work, from the GDPR to every US state privacy law. Each entry says who it applies to, who enforces it and when, in plain words, with the sources. Free for everyone.
US states 33
CCPA/CPRA
CaliforniaThe most detailed US state privacy law and the only one with a dedicated privacy regulator. It covers employee and business-to-business data, requires opt-outs from selling and sharing, and has its own regulations on automated decision-making.
VCDPA
VirginiaThe template for most later state laws: consumer rights, opt-outs from targeted advertising, sale and profiling, opt-in consent for sensitive data, and data protection assessments.
CPA
ColoradoVirginia-style law with detailed Attorney General rules, including requirements to honor universal opt-out signals.
CTDPA
ConnecticutVirginia-style law, amended to broaden coverage and strengthen rules on sensitive data and minors.
UCPA
UtahOne of the more business-friendly state laws, with narrower rights and higher thresholds.
TDPSA
TexasNo revenue or volume threshold: it reaches almost every business that is not a small business, which makes it one of the broadest state laws in practice.
OCPA
OregonVirginia-style law that also gives consumers the right to learn the specific third parties their data was disclosed to.
MCDPA
MontanaVirginia-style law with relatively low thresholds, reflecting the state's population.
FDBR
FloridaNarrow in who it covers, but strict for the largest technology companies it targets.
ICDPA
IowaA narrower Virginia-style law with fewer consumer rights.
DPDPA
DelawareVirginia-style law with low thresholds and coverage of many nonprofits.
NHDPA
New HampshireVirginia-style law with thresholds scaled to a small state.
NJDPA
New JerseyVirginia-style law with broad sensitive-data definitions and rulemaking by the Division of Consumer Affairs.
NDPA
NebraskaTexas-style law without a volume threshold, applying to most businesses that are not small businesses.
TIPA
TennesseeHigh thresholds, and an affirmative defense for businesses that follow the NIST Privacy Framework.
MCDPA
MinnesotaAdds rights other states lack, including the right to question the result of a profiling decision and to see the list of third parties that received data.
MODPA
MarylandThe strictest state law on data minimization: collection must be reasonably necessary for the service, and selling sensitive data is prohibited.
ICDPA
IndianaVirginia-style law, in force from 2026.
KCDPA
KentuckyVirginia-style law, in force from 2026.
RIDTPPA
Rhode IslandVirginia-style law with unusual website disclosure duties and no cure period.
BIPA
IllinoisWritten notice and consent before collecting biometrics, a public retention schedule, and a private right of action that has produced some of the largest privacy settlements in the US.
CUBI
TexasNotice and consent before capturing biometric identifiers, limits on sale and disclosure, and destruction within a set period. Enforced by the Attorney General, which has obtained large settlements.
RCW 19.375
WashingtonNotice and consent or an opt-out mechanism before enrolling biometric identifiers for a commercial purpose.
MHMDA
WashingtonA broad definition of consumer health data, separate consent to collect and to share, a signed authorization to sell, geofencing limits near health facilities, and a private right of action.
SB 370
NevadaSimilar in approach to Washington's law, without a private right of action.
Delete Act
CaliforniaLets a California resident ask every registered data broker to delete their data with one request, which brokers must check and process on a fixed schedule.
Vermont data broker law
VermontThe first state data broker registry, with security program and disclosure requirements.
Texas data broker law
TexasRegistration, website notices and a security program for data brokers.
Oregon data broker registry
OregonAnnual registration for data brokers.
SHIELD Act
New YorkBroadened New York's breach notification law and requires reasonable administrative, technical and physical safeguards.
201 CMR 17.00
MassachusettsOne of the first prescriptive state security rules: a written information security program, encryption and vendor oversight.
NYDFS Part 500
New YorkA detailed cybersecurity program regulation with annual certification, CISO reporting, incident notice within 72 hours and personal liability exposure for certifying executives.
State breach laws
US statesEvery state requires notice to affected residents after a breach of personal information. Deadlines, regulator notices and what counts as personal information differ, so a multi-state breach means applying several laws at once.
This library explains laws for practitioners. It is not legal advice, and laws change: check the sources on each page and take advice from counsel before acting.