State privacy laws, in plain English

Every comprehensive U.S. state privacy law — what it requires, who it applies to, what it costs to get wrong, and what to fix on your store.

CA
California
California Consumer Privacy Act / California Privacy Rights Act (CCPA / CPRA)
Effective 2020-01-01No cure periodUp to $7,500
CO
Colorado
Colorado Privacy Act (CPA)
Effective 2023-07-01No cure periodUp to $20,000
CT
Connecticut
Connecticut Data Privacy Act (CTDPA)
Effective 2023-07-01No cure periodUp to $25,000
DE
Delaware
Delaware Personal Data Privacy Act (DPDPA)
Effective 2025-01-01No cure periodUp to $10,000
IN
Indiana
Indiana Consumer Data Protection Act (INCDPA)
Effective 2026-01-0130-day cureUp to $7,500
IA
Iowa
Iowa Consumer Data Protection Act (ICDPA)
Effective 2025-01-0190-day cureUp to $7,500
MD
Maryland
Maryland Online Data Privacy Act (MODPA)
Effective 2025-10-01No cure periodUp to $10,000
MN
Minnesota
Minnesota Consumer Data Privacy Act (MCDPA)
Effective 2025-07-31No cure periodUp to $7,500
MT
Montana
Montana Consumer Data Privacy Act (MTCDPA)
Effective 2024-10-01No cure periodUp to $10,000
NH
New Hampshire
New Hampshire Privacy Act (NHPA)
Effective 2025-01-01No cure periodUp to $10,000
NJ
New Jersey
New Jersey Data Privacy Act (NJDPA)
Effective 2025-01-1530-day cureUp to $10,000
OR
Oregon
Oregon Consumer Privacy Act (OCPA)
Effective 2024-07-01No cure periodUp to $7,500
TN
Tennessee
Tennessee Information Protection Act (TIPA)
Effective 2025-07-0160-day cureUp to $15,000
TX
Texas
Texas Data Privacy and Security Act (TDPSA)
Effective 2024-07-0130-day cureUp to $7,500
UT
Utah
Utah Consumer Privacy Act (UCPA)
Effective 2023-12-3130-day cureUp to $7,500
VA
Virginia
Virginia Consumer Data Protection Act (VCDPA)
Effective 2023-01-0130-day cureUp to $7,500
More states added as their laws take effect. Compare states → · Check which apply to your business →