Privacy across the U.S.

56 jurisdictions, sorted by the privacy their laws provide.

The fifty states, the District of Columbia, and the five inhabited U.S. territories — grouped into seven tiers, in two directions: what a state does to protect you from companies, and what it does (or doesn’t) to limit its own surveillance. There is no federal privacy law, so where you live is most of the answer.

How to read this — and what it is yet. This page is the structure; the ratings are being compiled now. Every jurisdiction will sit in one of seven tiers on each axis, by how much privacy its law provides in practice. Until a cell is confirmed against its primary source — the statute, the constitutional provision, the court ruling — it reads Verify. Nothing here is estimated or assumed; a cell is either sourced or openly marked pending. State privacy law is moving fast, so every confirmed cell will be dated to the instrument behind it. General information, not legal advice.

Structure built July 18, 2026 · ratings in progress

How the tiers work

Seven tiers, strongest to weakest

The tiers describe the level of privacy protection a person effectively has. The meter shows the tier at a glance — more filled bars mean more protection. The columns carry the mechanism — whether a right exists, whether a warrant is required, whether a power is checked.

Comprehensive protections. Strong law on both fronts: a comprehensive consumer-privacy statute and enforceable limits on state surveillance, ideally anchored by a constitutional privacy guarantee.
Strong protections. Robust protections with real enforcement; only narrow shortfalls in either consumer rights or surveillance limits.
Substantial protections. Solid protections in most areas, with one significant shortfall — a missing right, a weak regulator, or an unchecked surveillance power.
Moderate protections. Real protections on the books, but partial coverage or thin enforcement leaves meaningful exposure.
Limited protections. A few specific protections — a biometric law, a warrant rule — against a backdrop of little general privacy law.
Weak protections. Minimal statutory privacy protection; residents rely largely on the federal floor.
Minimal protections. No meaningful state privacy law, and broad, largely unchecked government access.

Two directions, one scale. Each axis — against companies and against the state — is scored on this same seven-tier scale. The precise cut-lines for each are being finalized alongside the data.

The first table

Rated against the state

Government surveillance and civil liberties — warrant rules for your digital life and location, automated license-plate and face-recognition limits, whether the state constitution guarantees privacy, and shield laws for reproductive and gender-care data. Sort by tier or A–Z, or filter to a single tier.

The public-surveillance columns. The ALPR-retention and face-recognition columns track how far a state limits cameras that watch everyone. How those systems work, how secure they are, and whether they actually cut crime is on our cameras & sensors page.

No state is comprehensive. The top tier is held in reserve. Even the two strongest — California and Washington — fall short: California has no statute limiting government face recognition; Washington has no digital-data-warrant law and leans on its constitution instead; and no jurisdiction at all restricts geofence or reverse-keyword warrants.

Protection from the state56 jurisdictions · rated

Sort Tier

Jurisdiction	Protection from the state	Constitutional privacy	Digital-data warrant	Geofence & keyword warrants	ALPR retention	Face recognition	Repro & gender-care shield	Trend
ALAlabamaSouth	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	——
AKAlaskaWest	Moderate	Yes^{Art. I, §22}	No^b	No^c	No^d	No^e	No^f	——
ASAmerican SamoaTerritory	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	——
AZArizonaWest	Moderate	Yes^{Art. II, §8}	No^b	No^c	No^d	No^e	No^f	——
ARArkansasSouth	Weak	No^a	No^b	No^c	Yes^§12-12-1805	No^e	No^f	——
CACaliforniaWest	Strong	State constitution^{Art. I, §1}	CalECPA^§1546	No^c	SB 34^§1798.90.5	No^e	AB 1242^§1546.5	——
COColoradoWest	Substantial	No^a	No^b	No^c	Yes^§24-72-113	Yes^SB 22-113	Yes^SB 23-188	——
CTConnecticutNortheast	Weak	No^a	No^b	No^c	No^d	No^e	Yes^§52-571m	——
DEDelawareSouth	Weak	No^a	No^b	No^c	No^d	No^e	Yes^§611	——
DCDistrict of ColumbiaFederal district	Weak	No^a	No^b	No^c	No^d	No^e	Yes^{D.C. Law 24-257}	——
FLFloridaSouth	Substantial	Yes^{Art. I, §23}	No^b	No^c	Yes^§316.0778	No^e	No^f	——
GAGeorgiaSouth	Weak	No^a	No^b	No^c	Yes^§35-1-22	No^e	No^f	——
GUGuamTerritory	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	——
HIHawaiiWest	Substantial	Yes^{Art. I, §6}	No^b	No^c	No^d	No^e	Yes^{Act 2 (2023)}	——
IDIdahoWest	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	——
ILIllinoisMidwest	Substantial	Yes^{Art. I, §6}	No^b	No^c	No^d	No^e	Yes^{735 ILCS 40}	——
INIndianaMidwest	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	——
IAIowaMidwest	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	——
KSKansasMidwest	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	——
KYKentuckySouth	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	——
LALouisianaSouth	Moderate	Yes^{Art. I, §5}	No^b	No^c	No^d	No^e	No^f	——
MEMaineNortheast	Substantial	No^a	No^b	No^c	Yes^§2117-A	Yes^§6001	Yes^{LD 227 (2024)}	——
MDMarylandSouth	Moderate	No^a	No^b	No^c	No^d	Yes^{Md. Crim. Proc. §2-501}	Yes^{Md. Crim. Proc. §9-106}	——
MAMassachusettsNortheast	Moderate	No^a	No^b	No^c	No^d	Yes^{G.L. c. 6, §220}	Yes^{G.L. c. 12, §11I½}	——
MIMichiganMidwest	Weak	No^a	No^b	No^c	No^d	No^e	Repro only^{Exec. Order (2022)}	——
MNMinnesotaMidwest	Strong	No^a	Yes^§626A.42	No^c	Yes^§13.824	Body cams^§626.8473	Yes^§604.415	——
MSMississippiSouth	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	——
MOMissouriMidwest	Moderate	No^a	Yes^{Mo. Const. Art. I, §15}	No^c	No^d	No^e	No^f	——
MTMontanaWest	Strong	Yes^{Art. II, §10}	Yes^§46-5-110	No^c	No^d	Yes^{SB 397 (2023)}	No^f	——
NENebraskaMidwest	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	——
NVNevadaWest	Weak	No^a	No^b	No^c	No^d	No^e	Repro only^§232.0088	——
NHNew HampshireNortheast	Substantial	Yes^{Pt. I, Art. 2-b}	No^b	No^c	Yes^§261:75-b	Body cams^§105-D:2	No^f	——
NJNew JerseyNortheast	Limited	No^a	No^b	No^c	Policy^{AG Dir. 2022-12}	No^e	Yes^{N.J. Stat. §2A:84A-22.18}	——
NMNew MexicoWest	Weak	No^a	No^b	No^c	No^d	No^e	Yes^{N.M. Stat. §24-35-1}	——
NYNew YorkNortheast	Weak	No^a	No^b	No^c	No^d	No^e	Yes^Shield Law	——
NCNorth CarolinaSouth	Limited	No^a	No^b	No^c	Yes^§20-183.32	No^e	Repro only^{Exec. Order 8 (2025)}	——
NDNorth DakotaMidwest	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	——
MPNorthern Mariana IslandsTerritory	Moderate	Yes^{Art. I, §10}	No^b	No^c	No^d	No^e	No^f	——
OHOhioMidwest	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	——
OKOklahomaSouth	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	——
OROregonWest	Limited	No^a	No^b	No^c	No^d	Body cams^§133.741	Yes^{HB 2002 (2023)}	——
PAPennsylvaniaNortheast	Weak	No^a	No^b	No^c	No^d	No^e	Repro only^{Exec. Order (2022)}	——
PRPuerto RicoTerritory	Moderate	Yes^{Art. II, §8}	No^b	No^c	No^d	No^e	No^f	——
RIRhode IslandNortheast	Weak	No^a	No^b	No^c	No^d	No^e	Yes^{R.I. Gen. Laws §23-101}	——
SCSouth CarolinaSouth	Moderate	Yes^{Art. I, §10}	No^b	No^c	No^d	No^e	No^f	——
SDSouth DakotaMidwest	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	——
TNTennesseeSouth	Weak	No^a	No^b	No^c	Yes^§55-10-302	No^e	No^f	——
TXTexasSouth	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	——
VIU.S. Virgin IslandsTerritory	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	——
UTUtahWest	Strong	No^a	Yes^§77-23c-102	No^c	Yes^§41-6a-2004	Yes^§77-23e-103	No^f	——
VTVermontNortheast	Substantial	No^a	No^b	No^c	Yes^{23 V.S.A. §1607}	Yes^{20 V.S.A. §4622}	Yes^{12 V.S.A. §7306}	——
VAVirginiaSouth	Moderate	No^a	No^b	No^c	Yes^§2.2-5517	Yes^{§15.2-1723.2}	Repro only^§19.2-60.2	——
WAWashingtonWest	Strong	Yes^{Art. I, §7}	No^b	No^c	Yes^{SB 6002 (2026)}	Yes^RCW 43.386	Yes^{HB 1469 (2023)}	——
WVWest VirginiaSouth	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	——
WIWisconsinMidwest	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	——
WYWyomingWest	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	——

No jurisdictions match.

Every cell traces to a primary source. Constitutional text, statute, or court ruling — with the source dated. Cells shown as Verify are not yet compiled; none are estimated.

Sources & confirmed absences

Every cell traces to a source. A Yes cites the constitutional provision or statute directly, linked in the cell. A cell reading No is a confirmed absence, cited to a per-topic note below listing the jurisdictions where no such protection was found — those lists grow as the ratings are compiled. Every finding is dated.

Puerto Rico. The constitutional-privacy cell links the official Spanish text of the Constitution (Art. II, §8), published by the Judicial Branch of Puerto Rico; a public English translation is available here.

No protection found — confirmed absences, checked July 2026 and growing as jurisdictions are added.

No explicit constitutional privacy. The state constitution contains no express right to privacy; residents rely on the Fourth Amendment and whatever privacy doctrine the courts have read into it. Alabama, American Samoa, Arkansas, Colorado, Connecticut, Delaware, District of Columbia, Georgia, Guam, Idaho, Indiana, Iowa, Kansas, Kentucky, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Nebraska, Nevada, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Dakota, Tennessee, Texas, U.S. Virgin Islands, Utah, Vermont, Virginia, West Virginia, Wisconsin, Wyoming.
No digital-data warrant statute. No state law requires a warrant for electronic-communications content, location, or device data above the federal floor. Alabama, Alaska, American Samoa, Arizona, Arkansas, Colorado, Connecticut, Delaware, District of Columbia, Florida, Georgia, Guam, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Mississippi, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, New York, North Carolina, North Dakota, Northern Mariana Islands, Ohio, Oklahoma, Oregon, Pennsylvania, Puerto Rico, Rhode Island, South Carolina, South Dakota, Tennessee, Texas, U.S. Virgin Islands, Vermont, Virginia, Washington, West Virginia, Wisconsin, Wyoming.
No geofence or keyword-warrant limit. No statute or binding ruling restricts geofence or reverse-keyword warrants. Alabama, Alaska, American Samoa, Arizona, Arkansas, California, Colorado, Connecticut, Delaware, District of Columbia, Florida, Georgia, Guam, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, New York, North Carolina, North Dakota, Northern Mariana Islands, Ohio, Oklahoma, Oregon, Pennsylvania, Puerto Rico, Rhode Island, South Carolina, South Dakota, Tennessee, Texas, U.S. Virgin Islands, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin, Wyoming.
No ALPR retention cap. No statute limits how long automated license-plate-reader data may be kept. Alabama, Alaska, American Samoa, Arizona, Connecticut, Delaware, District of Columbia, Guam, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maryland, Massachusetts, Michigan, Mississippi, Missouri, Montana, Nebraska, Nevada, New Mexico, New York, North Dakota, Northern Mariana Islands, Ohio, Oklahoma, Oregon, Pennsylvania, Puerto Rico, Rhode Island, South Carolina, South Dakota, Texas, U.S. Virgin Islands, West Virginia, Wisconsin, Wyoming.
No government face-recognition law. No statute restricts state or local government use of face recognition. Alabama, Alaska, American Samoa, Arizona, Arkansas, California, Connecticut, Delaware, District of Columbia, Florida, Georgia, Guam, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Michigan, Mississippi, Missouri, Nebraska, Nevada, New Jersey, New Mexico, New York, North Carolina, North Dakota, Northern Mariana Islands, Ohio, Oklahoma, Pennsylvania, Puerto Rico, Rhode Island, South Carolina, South Dakota, Tennessee, Texas, U.S. Virgin Islands, West Virginia, Wisconsin, Wyoming.
No reproductive or gender-care shield. No shield law protects reproductive or gender-affirming-care data from out-of-state investigations or legal demands. Alabama, Alaska, American Samoa, Arizona, Arkansas, Florida, Georgia, Guam, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Mississippi, Missouri, Montana, Nebraska, New Hampshire, North Dakota, Northern Mariana Islands, Ohio, Oklahoma, Puerto Rico, South Carolina, South Dakota, Tennessee, Texas, U.S. Virgin Islands, Utah, West Virginia, Wisconsin, Wyoming.

The second table

Rated against companies

Consumer data law — whether the state has a comprehensive privacy statute, your rights to see and delete your data, to opt out of sale and targeted ads, protections for sensitive data and minors, whether you can sue on your own, biometric law, and data-broker registration. Ranked by tier by default; sort A–Z or filter to a single tier.

One practice these columns don’t yet capture: surveillance pricing — being charged by your data. Almost no state regulates it directly; the closest is California’s rulemaking on automated decision-making technology. We cover it on the financial privacy page.

Protection from companies56 jurisdictions · ratings pending

Sort Tier

Jurisdiction	Protection from companies	Comprehensive law	Access & deletion	Opt-out (sale/ads)	Sensitive data & minors	Private right of action	Biometric law	Data-broker registry	Trend
ALAlabamaSouth	Weak	Enacted¹	Enacted¹	Enacted¹	Enacted¹	No^e	Enacted¹	No^g	↑Law incoming
AKAlaskaWest	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
ASAmerican SamoaTerritory	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
AZArizonaWest	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
ARArkansasSouth	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
CACaliforniaWest	Comprehensive	CCPA / CPRA^§1798.100	CCPA^{§1798.100 · §1798.105}	CCPA^§1798.120	CCPA^{§1798.121 · §1798.120}	Breaches only^§1798.150	Sensitive PI^§1798.140	Delete Act^§1798.99.82	↑Expanding
COColoradoWest	Comprehensive	CPA^§6-1-1306	CPA^§6-1-1306	CPA^§6-1-1308	CPA^§6-1-1308	No^e	Yes^HB 24-1130	No^g	↑Expanding
CTConnecticutNortheast	Strong	CTDPA^§42-517	CTDPA^§42-518	CTDPA^§42-518	CTDPA^§42-520	No^e	Sensitive data^§42-520	No^g	↑Expanding
DEDelawareSouth	Strong	DPDPA^§12D-103	DPDPA^§12D-104	DPDPA^§12D-104	DPDPA^§12D-106	No^e	Sensitive data^§12D-106	No^g	↑Expanding
DCDistrict of ColumbiaFederal district	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
FLFloridaSouth	Substantial	Big tech only^§501.702	Big tech only^§501.705	Big tech only^§501.705	Big tech only^§501.715	No^e	Big tech only^§501.715	No^g	——
GAGeorgiaSouth	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
GUGuamTerritory	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
HIHawaiiWest	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
IDIdahoWest	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
ILIllinoisMidwest	Limited	No^a	No^b	No^c	No^d	Biometric only^§20	Yes^§15	No^g	——
INIndianaMidwest	Strong	Yes^§24-15-1-1	Yes^§24-15-3-1	Yes^§24-15-3-1	Yes^§24-15-4-1	No^e	Sensitive data^§24-15-4-1	No^g	——
IAIowaMidwest	Substantial	Yes^§715D.2	Yes^§715D.3	Sale only^§715D.3	Opt-out^§715D.4	No^e	Sensitive data^§715D.4	No^g	——
KSKansasMidwest	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
KYKentuckySouth	Strong	Yes^§367.3613	Yes^§367.3615	Yes^§367.3615	Yes^§367.3617	No^e	Sensitive data^§367.3617	No^g	——
LALouisianaSouth	Weak	Enacted¹²	Enacted¹²	Enacted¹²	Enacted¹²	No^e	Enacted¹²	No^g	↑Law incoming
MEMaineNortheast	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
MDMarylandSouth	Strong	MODPA^§14-4602	MODPA^§14-4605	MODPA^§14-4605	MODPA^§14-4607	No^e	Sensitive data^§14-4607	No^g	——
MAMassachusettsNortheast	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
MIMichiganMidwest	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
MNMinnesotaMidwest	Strong	Yes^§325M.12	Yes^§325M.14	Yes^§325M.14	Yes^§325M.16	No^e	Sensitive data^§325M.16	No^g	——
MSMississippiSouth	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
MOMissouriMidwest	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
MTMontanaWest	Strong	Yes^§30-14-2803	Yes^§30-14-2804	Yes^§30-14-2808	Yes^{§30-14-2812 · §30-14-2818}	No^e	Sensitive data^§30-14-2812	No^g	——
NENebraskaMidwest	Strong	Yes^§87-1101	Yes^§87-1107	Yes^§87-1107	Yes^§87-1112	No^e	Sensitive data^§87-1112	No^g	——
NVNevadaWest	Limited	No^a	No^b	Sale only^§603A.345	No^d	No^e	No^f	No^g	——
NHNew HampshireNortheast	Strong	Yes^§507-H:2	Yes^§507-H:4	Yes^§507-H:4	Yes^§507-H:6	No^e	Sensitive data^§507-H:6	No^g	——
NJNew JerseyNortheast	Strong	Yes^§56:8-166.5	Yes^{§56:8-166.10}	Yes^{§56:8-166.10}	Yes^{§56:8-166.12}	No^e	Sensitive data^{§56:8-166.12}	No^g	——
NMNew MexicoWest	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
NYNew YorkNortheast	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
NCNorth CarolinaSouth	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
NDNorth DakotaMidwest	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
MPNorthern Mariana IslandsTerritory	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
OHOhioMidwest	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
OKOklahomaSouth	Weak	Enacted²⁰	Enacted²⁰	Enacted²⁰	Enacted²⁰	No^e	Enacted²⁰	No^g	↑Law incoming
OROregonWest	Comprehensive	OCPA^§646A.572	OCPA^§646A.574	OCPA^§646A.574	OCPA^§646A.578	No^e	Sensitive data^§646A.578	Yes^§646A.593	——
PAPennsylvaniaNortheast	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
PRPuerto RicoTerritory	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
RIRhode IslandNortheast	Strong	Yes^§6-48.1-1	Yes^§6-48.1-5	Yes^§6-48.1-5	Yes^§6-48.1-4	No^e	Sensitive data^§6-48.1-4	No^g	——
SCSouth CarolinaSouth	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
SDSouth DakotaMidwest	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
TNTennesseeSouth	Strong	Yes^§47-18-3202	Yes^§47-18-3203	Yes^§47-18-3203	Yes^§47-18-3204	No^e	Sensitive data^§47-18-3204	No^g	——
TXTexasSouth	Comprehensive	TDPSA^§541.002	TDPSA^§541.051	TDPSA^§541.051	TDPSA^§541.101	No^e	Yes^§503.001	Yes^§509.004	——
VIU.S. Virgin IslandsTerritory	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
UTUtahWest	Substantial	UCPA^§13-61-102	UCPA^§13-61-201	UCPA^§13-61-201	Opt-out^§13-61-302	No^e	Sensitive data^§13-61-302	No^g	——
VTVermontNortheast	Moderate	Enacted²⁶	Enacted²⁶	Enacted²⁶	Enacted²⁶	No^e	Enacted²⁶	Yes^§2446	↑Law incoming
VAVirginiaSouth	Strong	VCDPA^§59.1-576	VCDPA^§59.1-577	VCDPA^§59.1-577	VCDPA^§59.1-578	No^e	Sensitive data^§59.1-578	No^g	↑Expanding
WAWashingtonWest	Limited	No^a	Health data^§19.373.040	Health data^§19.373.070	Health data^§19.373.030	Health data^§19.373.090	Yes^§19.375.020	No^g	——
WVWest VirginiaSouth	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
WIWisconsinMidwest	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——
WYWyomingWest	Minimal	No^a	No^b	No^c	No^d	No^e	No^f	No^g	——

No jurisdictions match.

The consumer-privacy patchwork moves quickly. A wave of comprehensive state laws took effect across 2024–25, with more pending. Each confirmed cell will be dated to the statute in force.

Sources & primary instruments

Every cell traces to a source. A full or qualified mark cites the enacted instrument, numbered below. A cell reading No is a confirmed absence, cited to a per-topic note listing the jurisdictions where no such law was found — those lists grow as the ratings are compiled. Every finding is dated.

Enacted instruments

Alabama Personal Data Protection Act (HB 351). Signed April 17, 2026; takes effect May 1, 2027. Grants access, correction, deletion and portability; opt-out of sale and targeted advertising; opt-in consent for sensitive data, including biometric data, precise geolocation and data of known children. Attorney-general enforcement, no private right of action. Enrolled text — Alabama Legislature
California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020. Cal. Civ. Code §§ 1798.100 et seq. Access and deletion (§§ 1798.100, 1798.105), correction (§ 1798.106), opt-out of sale and sharing (§ 1798.120), a right to limit sensitive personal information — which includes biometric data (§§ 1798.121, 1798.140) — opt-in for consumers under 16 (§ 1798.120(c)), and a private right of action limited to certain data breaches (§ 1798.150).
California Delete Act (SB 362). Cal. Civ. Code §§ 1798.99.80 et seq. Requires data brokers to register annually with the California Privacy Protection Agency and to honor deletion requests through the state’s Delete Request and Opt-out Platform (DROP), which opened to consumers January 1, 2026.
Colorado Privacy Act. C.R.S. §§ 6-1-1301 et seq. (SB 21-190, eff. July 1, 2023). Access, correction, deletion, portability; opt-out of sale, targeted advertising and profiling, honored through a universal opt-out signal; opt-in for sensitive data. Later amended to add dedicated biometric-identifier protections (HB 24-1130, eff. July 1, 2025) and heightened protections for minors’ data (SB 24-041, eff. Oct. 1, 2025). Attorney-general enforcement, no private right of action.
Connecticut Data Privacy Act. Conn. Gen. Stat. §§ 42-515 to 42-525 (Public Act 22-15, eff. July 1, 2023). Access, correction, deletion, portability; opt-out of sale, targeted advertising and profiling, with universal-opt-out recognition since January 1, 2025; opt-in for sensitive data; and no sale or targeted advertising of the data of consumers under 18. Attorney-general enforcement.
Delaware Personal Data Privacy Act. 6 Del. C. ch. 12D (HB 154, eff. January 1, 2025; universal-opt-out recognition from January 1, 2026). Access, correction, deletion, portability; opt-out of sale, targeted advertising and profiling; opt-in for sensitive data; and protections for the data of known children. Attorney-general enforcement, no private right of action.
Florida Digital Bill of Rights. Fla. Stat. §§ 501.701–501.722 (SB 262, ch. 2023-201, eff. July 1, 2024). Grants access, correction, deletion, portability and opt-out rights and requires opt-in for the sale of sensitive data — but the core obligations reach only for-profit controllers with more than $1 billion in global gross annual revenue that also meet an online-advertising, smart-speaker or app-store prong, the narrowest scope of any U.S. state privacy law. Enforced by the Department of Legal Affairs, no private right of action.
Illinois Biometric Information Privacy Act. 740 ILCS 14 (P.A. 95-994, eff. October 3, 2008). Requires written notice and consent before a private entity collects a biometric identifier — fingerprint, face or iris scan, voiceprint — and bars its sale. Section 20 is the only biometric private right of action in the country: any aggrieved person may sue for $1,000 per negligent or $5,000 per intentional violation, without proving separate harm (Rosenbach v. Six Flags, 2019). Illinois has no comprehensive consumer-privacy statute.
Indiana Consumer Data Protection Act (SB 5). Ind. Code art. 24-15 (eff. January 1, 2026). Applies to persons controlling or processing the data of at least 100,000 Indiana consumers, or 25,000 if more than half of revenue comes from selling personal data. Grants access, correction, deletion and portability; opt-out of sale, targeted advertising and profiling; opt-in consent for sensitive data, which includes biometric data. Modeled closely on Virginia. Attorney-general enforcement, no private right of action.
Iowa Consumer Data Protection Act (SF 262). Iowa Code ch. 715D (eff. January 1, 2025). Among the narrowest of the comprehensive laws: it grants access, deletion and portability but no right of correction; opt-out of the sale of data but not of targeted advertising; and for sensitive data requires only notice and an opportunity to opt out rather than opt-in consent. Attorney-general enforcement, no private right of action.
Kentucky Consumer Data Protection Act (HB 15). Ky. Rev. Stat. §§ 367.3611–367.3629 (eff. January 1, 2026; amended before taking effect by HB 473). Applies to persons controlling or processing the data of at least 100,000 Kentucky consumers, or 25,000 if more than half of revenue comes from selling personal data. Grants access, correction, deletion and portability; opt-out of sale, targeted advertising and profiling; opt-in consent for sensitive data, which includes biometric data. Attorney-general enforcement, no private right of action.
Louisiana Data Privacy Act (Act 502, SB 386). La. R.S. 51:1780.1–1780.5, enacting Chapter 20-B of Title 51; signed May 29, 2026, effective January 1, 2027. Grants access, correction, deletion and portability; opt-out of sale and targeted advertising, honored through a universal opt-out signal; and opt-in consent before the sale of sensitive data, which includes biometric data. Enforced solely by the attorney general as an unfair trade practice under the Louisiana Unfair Trade Practices and Consumer Protection Law; no private right of action.
Maryland Online Data Privacy Act (SB 541). Md. Code, Com. Law §§ 14-4601 et seq. (eff. October 1, 2025). Notable for the strictest data-minimization rule of any state law — collection is limited to what is reasonably necessary to provide the product or service the consumer requests — and for an outright ban on the sale of sensitive data. Grants access, correction, deletion and portability; opt-out of sale, targeted advertising and profiling; opt-in consent for sensitive data, which includes biometric data. Attorney-general enforcement, no private right of action.
Minnesota Consumer Data Privacy Act (HF 4757). Minn. Stat. ch. 325M (eff. July 31, 2025). Adds a right, unusual among state laws, to question the result of profiling and to review the data used in it. Grants access, correction, deletion and portability; opt-out of sale, targeted advertising and profiling; opt-in consent for sensitive data, which includes biometric data. Attorney-general enforcement, no private right of action.
Montana Consumer Data Privacy Act (SB 384). Mont. Code Ann. §§ 30-14-2801 et seq. (eff. October 1, 2024; thresholds lowered in 2025 by SB 297). Grants access, correction, deletion and portability; opt-out of sale, targeted advertising and profiling, honored through a universal opt-out signal; opt-in consent for sensitive data, which includes biometric data. Attorney-general enforcement, no private right of action.
Nebraska Data Privacy Act (LB 1074). Neb. Rev. Stat. §§ 87-1101 et seq. (eff. January 1, 2025). Modeled on the Texas act: it sets no revenue or data-volume threshold, reaching any business that is not a small business under the federal definition and that processes or sells personal data. Grants access, correction, deletion and portability; opt-out of sale, targeted advertising and profiling; opt-in consent for sensitive data, which includes biometric data. Attorney-general enforcement, no private right of action.
Nevada — opt-out of the sale of covered information (SB 220). Nev. Rev. Stat. §§ 603A.300–603A.360 (eff. October 1, 2019). Not a comprehensive statute: it grants only the right to submit a verified request that an operator not sell the covered information it has collected, and carries no access, deletion, correction or sensitive-data rights. Attorney-general enforcement, no private right of action.
New Hampshire Privacy Act (SB 255). N.H. Rev. Stat. ch. 507-H (eff. January 1, 2025). Applies at a low threshold of 35,000 consumers. Grants access, correction, deletion and portability; opt-out of sale, targeted advertising and profiling; opt-in consent for sensitive data, which includes biometric data. Attorney-general enforcement, no private right of action.
New Jersey Data Privacy Act (SB 332). N.J. Stat. §§ 56:8-166.4 et seq. (eff. January 15, 2025). One of the few state laws to grant a regulator — the Division of Consumer Affairs — authority to write implementing rules. Grants access, correction, deletion and portability; opt-out of sale, targeted advertising and profiling, honored through a universal opt-out signal; opt-in consent for sensitive data, which includes biometric data. Attorney-general enforcement, no private right of action.
Oklahoma Consumer Data Privacy Act (SB 546). Signed March 20, 2026; effective January 1, 2027. Grants access, correction, deletion and portability; opt-out of the sale of personal data, targeted advertising and profiling; and opt-in consent before processing sensitive data, which includes biometric data. Enforced solely by the attorney general with a permanent 30-day cure period; no private right of action. Oklahoma House of Representatives
Oregon Consumer Privacy Act (SB 619). Or. Rev. Stat. §§ 646A.570–646A.589 (eff. July 1, 2024; amended in 2025 by HB 2008 to restrict the sale of minors’ and precise-geolocation data). Broader than most: it reaches certain nonprofits and lets a consumer request the specific third parties — not merely the categories — to which their data has been disclosed. Grants access, correction, deletion and portability; opt-out of sale, targeted advertising and profiling; opt-in consent for sensitive data, which includes biometric data. Oregon separately requires data brokers to register (§646A.593). Attorney-general enforcement, no private right of action.
Rhode Island Data Transparency and Privacy Protection Act (SB 2500 / HB 7787). R.I. Gen. Laws ch. 6-48.1 (eff. January 1, 2026). Applies at a low threshold — 35,000 consumers, or 10,000 if more than a fifth of revenue comes from selling data — and adds an unusual transparency duty: a controller that sells personal data must identify in its privacy notice the third parties to which it may be sold. Grants access, correction, deletion and portability; opt-out of sale, targeted advertising and profiling; opt-in consent for sensitive data, which includes biometric data. Attorney-general enforcement, no private right of action.
Tennessee Information Protection Act (HB 1181). Tenn. Code §§ 47-18-3201 et seq. (eff. July 1, 2025). Unique in offering an affirmative defense: a controller that maintains a written privacy program conforming to the NIST Privacy Framework may invoke it against an enforcement action. Grants access, correction, deletion and portability; opt-out of sale, targeted advertising and profiling; opt-in consent for sensitive data, which includes biometric data. Attorney-general enforcement, no private right of action.
Texas Data Privacy and Security Act (HB 4). Tex. Bus. & Com. Code ch. 541 (eff. July 1, 2024). Applies to any person conducting business in Texas that processes or sells personal data and is not a small business under the federal definition (§541.002). Access, correction, deletion and portability, and opt-out of sale, targeted advertising and profiling (§541.051); opt-in consent before processing sensitive data, which includes biometric data (§541.101); heightened transparency for the sale of data and for targeted advertising (§541.103). Enforced solely by the attorney general (§541.151); no private right of action. Texas separately maintains a biometric-privacy statute (Capture or Use of Biometric Identifier Act, §503.001) and a data-broker registry (ch. 509).
Utah Consumer Privacy Act (SB 227). Utah Code ch. 13-61 (eff. Dec. 31, 2023). Applies to controllers with at least $25 million in annual revenue that meet a data-volume threshold (§13-61-102). Access, deletion and portability, and opt-out of the sale of personal data and of targeted advertising (§13-61-201). For sensitive data it requires only notice and an opportunity to opt out rather than opt-in consent (§13-61-302) — the model that, with Iowa, makes it among the narrowest of the comprehensive laws. Enforced by the attorney general (§13-61-402); no private right of action (§13-61-305).
Vermont Data Privacy and Online Surveillance Act (S.71, Act 145). Enacted as 9 V.S.A. chapter 61A; signed June 16, 2026, effective January 1, 2028. Grants access, correction, deletion and portability; opt-out of sale, targeted advertising and profiling; and opt-in consent before processing sensitive data, which includes biometric data. Modeled on the Connecticut Data Privacy Act, with consumer health-data provisions that reach more broadly. Enforced solely by the attorney general; no private right of action.
Virginia Consumer Data Protection Act (SB 1392). Va. Code §§ 59.1-575 et seq. (eff. Jan. 1, 2023) — the template most later state laws followed. Applies to persons controlling or processing the data of at least 100,000 Virginia consumers, or 25,000 if more than half of revenue comes from selling personal data (§59.1-576). Access, correction, deletion and portability, and opt-out of sale, targeted advertising and profiling (§59.1-577); opt-in consent before processing sensitive data, which includes biometric data (§59.1-578). Amended in 2025 to add protections for the data of minors and for reproductive or sexual-health information (§59.1-577.1). Enforced solely by the attorney general (§59.1-584); no private right of action.
Washington My Health My Data Act (HB 1155). Wash. Rev. Code ch. 19.373 (eff. March 31, 2024). Not a comprehensive statute: it governs consumer health data specifically — defined far more broadly than under HIPAA — requiring opt-in consent to collect or share it (§19.373.030), granting rights to access, delete and withdraw consent (§19.373.040), and requiring signed authorization before it may be sold (§19.373.070). A violation is a per se violation of the state Consumer Protection Act (§19.373.090), which carries a private right of action — one of the few in the country, though confined to health data. Washington also maintains a standalone biometric-privacy statute (ch. 19.375); no comprehensive consumer-privacy law has passed.

No law found — confirmed absences, checked July 2026 and growing as jurisdictions are added.

No comprehensive consumer-privacy statute. Residents rely on the federal sectoral floor — HIPAA, GLBA, FCRA, COPPA — and the state’s general consumer-protection law. Alaska, American Samoa, Arizona, Arkansas, District of Columbia, Georgia, Guam, Hawaii, Idaho, Illinois, Kansas, Maine, Massachusetts, Michigan, Mississippi, Missouri, Nevada, New Mexico, New York, North Carolina, North Dakota, Northern Mariana Islands, Ohio, Pennsylvania, Puerto Rico, South Carolina, South Dakota, U.S. Virgin Islands, Washington, West Virginia, Wisconsin, Wyoming.
No right to access or delete. No statutory right to see or delete the personal data a business holds. Alaska, American Samoa, Arizona, Arkansas, District of Columbia, Georgia, Guam, Hawaii, Idaho, Illinois, Kansas, Maine, Massachusetts, Michigan, Mississippi, Missouri, Nevada, New Mexico, New York, North Carolina, North Dakota, Northern Mariana Islands, Ohio, Pennsylvania, Puerto Rico, South Carolina, South Dakota, U.S. Virgin Islands, West Virginia, Wisconsin, Wyoming.
No opt-out of sale or targeted ads. No statutory right to stop the sale of personal data or its use for targeted advertising. Alaska, American Samoa, Arizona, Arkansas, District of Columbia, Georgia, Guam, Hawaii, Idaho, Illinois, Kansas, Maine, Massachusetts, Michigan, Mississippi, Missouri, New Mexico, New York, North Carolina, North Dakota, Northern Mariana Islands, Ohio, Pennsylvania, Puerto Rico, South Carolina, South Dakota, U.S. Virgin Islands, West Virginia, Wisconsin, Wyoming.
No general sensitive-data or minor protections. No general statutory limit on sensitive data and no broad protection for minors’ data beyond the federal COPPA floor; any coverage is sector-specific and appears in its own column. Alaska, American Samoa, Arizona, Arkansas, District of Columbia, Georgia, Guam, Hawaii, Idaho, Illinois, Kansas, Maine, Massachusetts, Michigan, Mississippi, Missouri, Nevada, New Mexico, New York, North Carolina, North Dakota, Northern Mariana Islands, Ohio, Pennsylvania, Puerto Rico, South Carolina, South Dakota, U.S. Virgin Islands, West Virginia, Wisconsin, Wyoming.
No private right of action. Individuals cannot sue over a privacy violation; enforcement rests with the state attorney general. Alabama, Alaska, American Samoa, Arizona, Arkansas, Colorado, Connecticut, Delaware, District of Columbia, Florida, Georgia, Guam, Hawaii, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, New York, North Carolina, North Dakota, Northern Mariana Islands, Ohio, Oklahoma, Oregon, Pennsylvania, Puerto Rico, Rhode Island, South Carolina, South Dakota, Tennessee, Texas, U.S. Virgin Islands, Utah, Vermont, Virginia, West Virginia, Wisconsin, Wyoming.
No biometric-privacy law. No standalone biometric statute of the Illinois, Texas or Washington type, and no dedicated biometric regime under a broader law. Alaska, American Samoa, Arizona, Arkansas, District of Columbia, Georgia, Guam, Hawaii, Idaho, Kansas, Maine, Massachusetts, Michigan, Mississippi, Missouri, Nevada, New Mexico, New York, North Carolina, North Dakota, Northern Mariana Islands, Ohio, Pennsylvania, Puerto Rico, South Carolina, South Dakota, U.S. Virgin Islands, West Virginia, Wisconsin, Wyoming.
No data-broker registry. No requirement that data brokers register with the state. Alabama, Alaska, American Samoa, Arizona, Arkansas, Colorado, Connecticut, Delaware, District of Columbia, Florida, Georgia, Guam, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, New York, North Carolina, North Dakota, Northern Mariana Islands, Ohio, Oklahoma, Pennsylvania, Puerto Rico, Rhode Island, South Carolina, South Dakota, Tennessee, U.S. Virgin Islands, Utah, Virginia, Washington, West Virginia, Wisconsin, Wyoming.

What’s coming

Still to take effect

Twenty comprehensive state laws are in force as of mid-2026. Four more are already signed — waiting only on the date each takes hold.

Vermont’s is the furthest out, and the broadest: it takes effect once its new chapter is codified, and folds in neural and other emerging data types.

The point

A patchwork is still a map you can read.

Because Congress has passed no general privacy law, your rights begin and end at a state line — strong in one place, absent a few miles away. This page exists to make that visible: not to rank states for its own sake, but to show where the protections are real, where they are thin, and where the shortfall is worth closing.

Companion Privacy by Country → Protect yourself Tools we recommend →

Get involved

It’s free, open to everyone at Pitt, and joining takes about a minute.

No dues, no experience needed. Come to a meeting, or leave your name and we’ll tell you when the next one is.

Join the club See upcoming meetings →