The laws, and what they mean in practice
Privacy, AI and cybersecurity laws that shape digital trust work, from the GDPR to every US state privacy law. Each entry says who it applies to, who enforces it and when, in plain words, with the sources. Free for everyone.
US states 24
CCPA/CPRA
CaliforniaThe most detailed US state privacy law and the only one with a dedicated privacy regulator. It covers employee and business-to-business data, requires opt-outs from selling and sharing, and has its own regulations on automated decision-making.
VCDPA
VirginiaThe template for most later state laws: consumer rights, opt-outs from targeted advertising, sale and profiling, opt-in consent for sensitive data, and data protection assessments.
CPA
ColoradoVirginia-style law with detailed Attorney General rules, including requirements to honor universal opt-out signals.
CTDPA
ConnecticutVirginia-style law, amended to broaden coverage and strengthen rules on sensitive data and minors.
UCPA
UtahOne of the more business-friendly state laws, with narrower rights and higher thresholds.
TDPSA
TexasNo revenue or volume threshold: it reaches almost every business that is not a small business, which makes it one of the broadest state laws in practice.
OCPA
OregonVirginia-style law that also gives consumers the right to learn the specific third parties their data was disclosed to.
MCDPA
MontanaVirginia-style law with relatively low thresholds, reflecting the state's population.
FDBR
FloridaNarrow in who it covers, but strict for the largest technology companies it targets.
ICDPA
IowaA narrower Virginia-style law with fewer consumer rights.
DPDPA
DelawareVirginia-style law with low thresholds and coverage of many nonprofits.
NHDPA
New HampshireVirginia-style law with thresholds scaled to a small state.
NJDPA
New JerseyVirginia-style law with broad sensitive-data definitions and rulemaking by the Division of Consumer Affairs.
NDPA
NebraskaTexas-style law without a volume threshold, applying to most businesses that are not small businesses.
TIPA
TennesseeHigh thresholds, and an affirmative defense for businesses that follow the NIST Privacy Framework.
MCDPA
MinnesotaAdds rights other states lack, including the right to question the result of a profiling decision and to see the list of third parties that received data.
MODPA
MarylandThe strictest state law on data minimization: collection must be reasonably necessary for the service, and selling sensitive data is prohibited.
ICDPA
IndianaVirginia-style law, in force from 2026.
KCDPA
KentuckyVirginia-style law, in force from 2026.
RIDTPPA
Rhode IslandVirginia-style law with unusual website disclosure duties and no cure period.
OCDPA
OklahomaEnacted in 2026 and not yet in force. Largely Virginia-style, with its own thresholds and cure period.
LDPA
LouisianaEnacted in 2026 and not yet in force. Largely Virginia-style, with its own thresholds and cure period.
APDPA
AlabamaEnacted in 2026 and not yet in force. Largely Virginia-style, with its own thresholds and cure period.
VDPOSA
VermontEnacted in 2026 and not yet in force. Largely Virginia-style, with its own thresholds and cure period.
This library explains laws for practitioners. It is not legal advice, and laws change: check the sources on each page and take advice from counsel before acting.