California

Click below to download a full summary of the law.

Download now

At a glance:

Title of Law (and Acronym)

California Consumer Privacy Act of 2018 as amended by California Privacy Rights Act of 2020 (CCPA As Amended)

Statute Cite

CAL. CIV. CODE §§ 1798.100-1798.199.100 (West 2023)

Regulation Cite

Cal. Code Regs. tit. 11, §§ 7000-7304 (2023)

Effective Date

01/01/2020

Applicability Thresholds

For-profit entity that collects consumers’ personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers’ personal information, that does business in the State of California, and that:

(1) As of January 1 of the calendar year, had annual gross revenues in excess of $26,625,000 in the preceding calendar year;

(2) Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households; or

(3) Derives 50 percent or more of its annual revenues from selling or sharing consumers’ personal information.

Applicable to Employees and Business Contacts?

Yes

Statutory Penalties

Up to $7,500 for each intentional violation and each violation involving the personal information of minor consumers

Private Right of Action

Yes (limited to data breach claims)

McDermott Resources

State regulators step up enforcement of new privacy laws, August 8, 2023

Ruling delays enforcement of latest CCPA regulations, July 5, 2023

California Privacy Protection Agency approves CCPA regulations, February 10, 2023

California Privacy Rights Act takes effect…sort of, January 4, 2023

California voters approve the California Privacy Rights Act, November 4, 2020

Colorado

Click below to download a full summary of the law.

Download now

At a glance:

Title of Law (and Acronym)

Colorado Privacy Act of 2021 (CPA)

Statute Cite

COLO. REV. STAT. § 6-1-1301 to -1313 (2022)

Regulation Cite

Colo. Code Regs. Tit. 4, § 904-3 (2023)

Effective Date

07/01/2023

Applicability Thresholds

A business that conducts business in Colorado or produces or delivers commercial products or services that are intentionally targeted to residents of Colorado, and satisfies one or both of the following thresholds:

(1) Controls or processes the personal data of 100,000 consumers or more during a calendar year;

(2) Derives revenue or receives a discount on the price of goods or services from the sale of personal data and processes or controls the personal data of 25,000 consumers or more; or

(3) Controls or processes any amount of biometric identifiers or biometric data regardless of the amount of biometric identifiers or biometric data controlled or processed annually (effective July 1, 2025).

Applicable to Employees and Business Contacts?

No

Statutory Penalties

Not more than $20,000 per violation

Private Right of Action

No

McDermott Resources

State regulators step up enforcement of new privacy laws, August 8, 2023

Colorado finalizes sweeping new privacy rules; Iowa joins the fray, March 21, 2023

Preparing for new consumer privacy laws in Colorado, Connecticut, and Utah, February 3, 2023

‘Tis the season: Colorado attorney general releases new draft CPA regulations, December 22, 2022

Colorado attorney general’s office issues draft Colorado Privacy Act regulations, October 3, 2022

State privacy patchwork spreads with signing of Colorado Privacy Act, July 9, 2021

Connecticut

Click below to download a full summary of the law.

Download now

At a glance:

Title of Law (and Acronym)

Connecticut Data Privacy Act of 2022 (CTDPA)

Statute Cite

CONN. GEN. STAT. §§ 42-515 to -525 (2022)

Regulation Cite

N/A

Effective Date

07/01/2023

Items marked with “*” are effective 07/01/2026

Applicability Thresholds

Companies that conduct business in Connecticut or companies that produce products or services that are targeted to residents of this state and that during the preceding calendar year:

(1) Controlled or processed the personal data of not less than 100,000 (35,000*) consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or

(2) Controlled or processed the personal data of not less than 25,000 consumers and derived more than 25 percent of their gross revenue from the sale of personal data. (Provision deleted and replaced by “control or process consumers’ sensitive data, excluding personal data controlled solely for payment transactions and (3) Offer consumers’ personal data for sale.”*)

Applicable to Employees and Business Contacts?

No

Statutory Penalties

Up to $5,000 per violation

Private Right of Action

No

McDermott Resources

Connecticut can’t help itself, amends consumer privacy law again, June 13, 2025

Nevada and Connecticut pass consumer health data laws, June 28, 2023

Connecticut steps up to the consumer privacy law plate, May 2, 2022

Delaware

Click below to download a full summary of the law.

Download now

At a glance:

Title of Law (and Acronym)

Delaware Personal Data Privacy Act (DPDPA)

Statute Cite

DEL. CODE ANN. tit. 6, §§ 12D-101 to -111 (2023)

Regulation Cite

N/A

Effective Date

01/01/2025

Applicability Thresholds

Any person that conducts business in Delaware or provides products or services to Delaware residents and:

(1) Controls or processes personal data of 35,000 or more Delaware consumers (excluding data controlled or processed solely for the purpose of completing a payment transaction); or

(2) Controls or processes personal data of 10,000 or more Delaware consumers and derives over 20% of gross revenue from the sale of that data.

Applicable to Employees and Business Contacts?

No

Statutory Penalties

Up to $10,000 per violation

Private Right of Action

No

McDermott Resources

Baker’s dozen: Delaware becomes 13th state to enact state consumer privacy law, September 13, 2023

Florida

Click below to download a full summary of the law.

Download now

At a glance:

Title of Law (and Acronym)

Florida Digital Bill of Rights (FDBR)

Statute Cite

FLA. STAT. §§ 501.702–72 (2023)

Regulation Cite

N/A

Effective Date

07/01/2024

Applicability Thresholds

Most of the FDBR applies to for-profit entities that conduct business in Florida and collect personal data about Florida consumers (or are the entity on behalf of which such information is collected) that meet the following requirements:

(1) Make in excess of $1 billion in global gross annual revenues; and

(2) Satisfy at least one of the following:

(a) Derive 50% or more of its global gross annual revenues from the sale of advertisements online, including providing targeted advertising or the sale of ads online;

(b) Operate a consumer smart speaker and voice command component service with an integrated virtual assistant connected to a cloud computing service that uses hands-free verbal activation. For purposes of this sub-subparagraph, a consumer smart speaker and voice command component service does not include a motor vehicle or speaker or device associated with or connected to a vehicle that is operated by a motor vehicle manufacturer or a subsidiary or affiliate thereof; or

(c) Operate an app store or a digital distribution platform that offers at least 250,000 different software applications for consumers to download and install.

However, under § 501.715(1), even companies that do not meet the requirements of (1) and (2) are required to obtain consent before selling sensitive data if they are a for-profit entity conducting business in Florida and collecting personal data from Florida residents.

Applicable to Employees and Business Contacts?

No

Statutory Penalties

Up to $15,000 per violation, with the possibility of treble damages for any of the following violations:

• A violation involving a known child
• Failure to delete or correct personal data after receiving an authenticated consumer request, unless an exception applies to the request
• Continuing to sell personal data after a consumer opts-out

Private Right of Action

No

McDermott Resources

Florida adds a new twist to consumer privacy patchwork, May 10, 2023

Indiana

Click below to download a full summary of the law.

Download now

At a glance:

Title of Law (and Acronym)

Indiana Consumer Data Protection Act of 2023 (Indiana CDPA)

Statute Cite

IND. CODE § 24-15 (2023)

Regulation Cite

N/A

Effective Date

01/01/2026

Applicability Thresholds

A company that conducts business in Indiana or produces products or services that are targeted to residents of Indiana and that during a calendar year:

(1) Controls or processes personal data of at least 100,000 consumers who are Indiana residents; or

(2) Controls or processes personal data of at least 25,000 consumers who are Indiana residents and derives more than 50 percent of gross revenue from the sale of personal data.

Applicable to Employees and Business Contacts?

No

Statutory Penalties

Up to $7,500 per violation

Private Right of Action

No

McDermott Resources

And then there were seven: Indiana passes consumer privacy bill, April 14, 2023

Iowa

Click below to download a full summary of the law.

Download now

At a glance:

Title of Law (and Acronym)

Iowa Consumer Data Protection Act of 2023 (Iowa CDPA)

Statute Cite

IOWA CODE § 715D.1–9 (2023)

Regulation Cite

N/A

Effective Date

01/01/2025

Applicability Thresholds

A company conducting business in Iowa or producing products or services that are targeted to consumers who are residents of Iowa and that during a calendar year does either of the following:

(1) Controls or processes personal data of at least 100,000 consumers; or

(2) Controls or processes personal data of at least 25,000 consumers and derives over 50 percent of gross revenue from the sale of personal data.

Applicable to Employees and Business Contacts?

No

Statutory Penalties

Up to $7,500 per violation

Private Right of Action

No

McDermott Resources

Iowa’s new privacy law: The basics, April 10, 2023

Kentucky

Click below to download a full summary of the law.

Download now

At a glance:

Title of Law (and Acronym)

Kentucky act relating to consumer data privacy

Statute Cite

KY. REV. STAT. ANN. § 367.3611–29 (2024)

Regulation Cite

N/A

Effective Date

01/01/2026

Applicability Thresholds

Persons that conduct business in Kentucky or produce products or services that are targeted to residents of Kentucky and that, during a calendar year:

(1) Control or process the personal data of at least 100,000 consumers; or

(2) Control or process the personal data of at least 25,000 consumers and derived over 50% of their gross revenue from the sale of personal data.

Applicable to Employees and Business Contacts?

No

Statutory Penalties

Up to $7,500 per violation

Private Right of Action

No

McDermott Resources

The list grows: Kentucky lawmakers close in on comprehensive privacy law, March 20, 2024

Maryland

Click below to download a full summary of the law.

Download now

At a glance:

Title of Law (and Acronym)

Maryland Online Data Privacy Act of 2024

Statute Cite

MD. CODE ANN., COM. LAW § 14-4701 (2024)

Regulation Cite

N/A

Effective Date

10/01/2025; applies to processing activities on or after 04/01/2026

Applicability Thresholds

Persons that conduct business in Maryland or provide services or products that are targeted to residents of Maryland and that, during the immediately preceding calendar year, did either of the following:

(1) Controlled or processed the personal data of at least 35,000 consumers, excluding the personal data controlled or processed solely for the purpose of completing a payment transaction; or

(2) Controlled or processed the personal data of at least 10,000 consumers and derived more than 20% of their gross revenue from the sale of personal data.

Applicable to Employees and Business Contacts?

No

Statutory Penalties

Up to $10,000 per violation and up to $25,000 per repeat violation

Private Right of Action

No

McDermott Resources

Maryland joins growing ranks and passes its own consumer data privacy law, April 10, 2024

Minnesota

Click below to download a full summary of the law.

Download now

At a glance:

Title of Law (and Acronym)

Minnesota Consumer Data Privacy Act (MCDPA)

Statute Cite

MINN. STAT. §§ 325M.10-21 (2024)

Regulation Cite

N/A

Effective Date

07/31/2025; applies to postsecondary institutions on or after 07/31/2029

Applicability Thresholds

Any person that conducts business in Minnesota or provides products or services that are targeted to Minnesota residents and, during the immediately preceding calendar year, either:

(1) Controlled or processed the personal data of at least 100,000 Minnesota consumers (excluding that personal data controlled or processed solely for the purpose of completing a payment transaction); or

(2) Controlled or processed the personal data of at least 25,000 Minnesota consumers and derives more than 25% of their gross revenue from the sale of personal data.

Applicable to Employees and Business Contacts?

No

Statutory Penalties

Up to $7,500 per violation

Private Right of Action

No

McDermott Resources

The Gopher State goes for it: Minnesota passes consumer data privacy law, May 22, 2024

Montana

Click below to download a full summary of the law.

Download now

At a glance:

Title of Law (and Acronym)

Montana Consumer Data Privacy Act of 2023 (MCDPA)

Statute Cite

MONT. CODE ANN. §§ 30-14-2801–17 (2023)

Regulation Cite

N/A

Effective Date

10/01/2024

Applicability Thresholds

Companies that conduct business in Montana or persons that produce products or services that are targeted to residents of Montana and:

(1) Control or process the personal data of not less than 25,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or

(2) Control or process the personal data of not less than 15,000 consumers and derive more than 25% of gross revenue from the sale of personal data.

Applicable to Employees and Business Contacts?

No

Statutory Penalties

Up to $10,000 per willful violation per Mont. Code Ann. § 30-14-142, Unfair Trade Practices

Private Right of Action

No

McDermott Resources

Consumer privacy law comes to Big Sky Country as Montana passes new law, April 25, 2023

Nebraska

Click below to download a full summary of the law.

Download now

At a glance:

Title of Law (and Acronym)

Nebraska Data Privacy Act (NEDPA)

Statute Cite

NEB. REV. STAT. §§ 87-1101–30 (2024)

Regulation Cite

N/A

Effective Date

01/01/2025

Applicability Thresholds

Companies that:

(1) Conduct business in Nebraska or produces a product or service consumed by Nebraska residents;

(2) Process or engage in the sale of personal data; and

(3) Are not a small business as determined under the federal Small Business Act.

Applicable to Employees and Business Contacts?

No

Statutory Penalties

Up to $7,500 per violation

Private Right of Action

No

McDermott Resources

Go Big Red! Nebraska passes consumer data privacy law, April 18, 2024

Nevada

Click below to download a full summary of the law.

Download now

At a glance:

Title of Law (and Acronym)

Nevada’s Consumer Health Data Privacy Law

Statute Cite

S.B. 370, 2023 Leg., 82nd Sess. (Nev. 2023)

Regulation Cite

N/A

Effective Date

03/31/2024

Applicability Thresholds

Any legal entity that:

(1) Conducts business in Nevada, or produces or provides products or services that are target to consumers in Nevada; and

(2) Alone or jointly with others, determines the purpose and means of collecting, processing, sharing, or selling of consumer health data.

Applicable to Employees and Business Contacts?

No

Statutory Penalties

Via the Nevada Deceptive Trade Practices Act which can impose, among other things, a civil penalty of up to $12,500 per violation.

Private Right of Action

No

McDermott Resources

Nevada and Connecticut pass consumer health data laws, June 28, 2023

New Hampshire

Click below to download a full summary of the law.

Download now

At a glance:

Title of Law (and Acronym)

New Hampshire Data Privacy Act (NHDPA)

Statute Cite

N.H. REV. STAT. ANN. §§ 507-H:1 to H:12 (2023)

Regulation Cite

N/A

Effective Date

01/01/2025

Applicability Thresholds

Businesses or persons that produce products or services that are targeted to residents of New Hampshire that, during a one-year period:

(1) Controlled or processed the personal data of not less than 35,000 unique consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or

(2) Controlled or processed the personal data of not less than 10,000 unique consumers and derived more than 25% of their gross revenue from the sale of personal data.

Applicable to Employees and Business Contacts?

No

Statutory Penalties

Up to $10,000 per violation

Private Right of Action

No

McDermott Resources

And another: New Hampshire passes new consumer privacy law, January 24, 2024

New Jersey

Click below to download a full summary of the law.

Download now

At a glance:

Title of Law (and Acronym)

New Jersey Data Privacy Act (NJDPA)

Statute Cite

N.J. STAT ANN. §§ 56:8-166.4 to -166.19 (2023)

Regulation Cite

N/A

Effective Date

01/15/2025

Applicability Thresholds

Any person that conducts business in New Jersey or provides products or services to New Jersey residents and:

(1) Controls or processes personal data of 100,000 or more New Jersey consumers (excluding data controlled or processed solely for the purpose of completing a payment transaction); or

(2) Controls or processes personal data of 25,000 or more New Jersey consumers and derives revenue or receives a discount on the price of any good or services from the sale of data.

Applicable to Employees and Business Contacts?

No

Statutory Penalties

Up to $10,000 per violation

Private Right of Action

No

McDermott Resources

And we’re back: New Jersey kicks off 2024 with new consumer privacy law, January 10, 2024

New York

Click below to download a full summary of the law.

Download now

At a glance:

Title of Law (and Acronym)

New York Health Information Privacy Act (NYHIPA)

Statute Cite

S.B. S929

Regulation Cite

N/A

Effective Date

To be determined (awaiting signature by the governor)

Applicability Thresholds

Any legal entity that:

(1) Controls the processing of regulated health information of an individual who is a New York resident;

(2) Controls the processing of regulated health information of an individual who is physically present in New York while that individual is in New York; or

(3) Is located in New York and controls the processing of regulated health information.

Applicable to Employees and Business Contacts?

Yes

Statutory Penalties

Up to $15,000 per violation, or 20% of revenue obtained from New York consumers within the past fiscal year, whichever is greater, as well as other forms of relief.

Private Right of Action

Yes

McDermott Resources

New York Assembly passes restrictive Health Information Privacy Act, January 24, 2025

Oregon

Click below to download a full summary of the law.

Download now

At a glance:

Title of Law (and Acronym)

Oregon Consumer Privacy Act (OCPA)

Statute Cite

OR. REV. STAT. §§ 646A.570–589 (2023)

Regulation Cite

N/A

Effective Date

07/01/2024 (HB 2008 effective 01/01/2026)

Applicability Thresholds

Any person that conducts business in Oregon or provides products/services to Oregon residents and:

(1) Controls or processes personal data of 100,000 or more Oregon consumers (excluding personal data controlled or processed solely for the purpose of completing a payment transaction); or

(2) Controls or processes personal data of 25,000 or more Oregon consumers and derives over 25% of gross revenue from the sale of that data.

Applicable to Employees and Business Contacts?

No

Statutory Penalties

Up to $7,500 per violation

Private Right of Action

No

McDermott Resources

Oregon joins the consumer privacy trend, June 26, 2023

Rhode Island

Click below to download a full summary of the law.

Download now

At a glance:

Title of Law (and Acronym)

Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)

Statute Cite

R.I. G.L. 6-48.1-1 et. seq

Regulation Cite

N/A

Effective Date

01/01/2026

Applicability Thresholds

Website privacy policy requirements:

Tennessee

Texas

Utah

Vermont

Virginia

Washington

California rulemaking activity

Colorado rulemaking activity

New Jersey rulemaking activity