# [U.S. Data Privacy Laws by State: Effective Dates and General Thresholds](https://usercentrics.com/us/knowledge-hub/us-state-data-privacy-effective-dates-and-thresholds/)

**Each state-level data privacy law in the United States has its own effective date and compliance thresholds involving operational data processing and/or revenue.**

*By [Celestine Bahr](https://usercentrics.com/us/person/celestine-bahr/), Director Legal, Compliance & Data Privacy, Usercentrics GmbH · Jul 11, 2025 · 3 min read*

---

## Overview

The United States does not have a single federal data privacy law. Companies must contend with a patchwork of federal and state-level laws, as well as industry-specific laws, like those regulating healthcare and the financial sector. Compliance requirements and enforcement are escalating.

While there are similarities among all the U.S. state-level data privacy laws passed to date, each has compliance thresholds, requirements, and consumers rights.

We've created an easily referenced table to help you determine which state data privacy laws you may need to comply with based on your operations and the states in which your company does business.

---

## State Data Privacy Laws: Effective Dates and General Thresholds

| **State (overview)** | **Regulation text** | **Common name** | **Effective date** | **Gross revenue threshold (USD)** | **Number of consumers whose personal data is processed annually (in state)** | **Data sale or sharing threshold** | **Other threshold(s)** |
| --- | --- | --- | --- | --- | --- | --- | --- |
| [Alabama](https://usercentrics.com/us/knowledge-hub/alabama-personal-data-protection-act-apdpa/) | [APDPA](https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf) | Alabama Personal Data Protection Act (APDPA) | 1 May 2027 | N/A | 25,000 | Derives 25% or more of annual revenues from selling consumers' personal information | |
| [California](https://usercentrics.com/knowledge-hub/california-consumer-privacy-act/) | [CCPA](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5) | California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) | 1 January 2020 | $26.2M | 100,000 | Derives 50% or more of annual revenues from selling or sharing consumers' personal information | |
| [Colorado](https://usercentrics.com/knowledge-hub/colorado-privacy-act/) | [CPA](https://coag.gov/app/uploads/2022/01/SB-21-190-CPA_Final.pdf) | Colorado Privacy Act (CPA) | 1 July 2023 | N/A | 100,000 | Derives revenue or receives a discount on the price of goods or services from the sale of personal data and processes or controls the personal data of 25,000 or more consumers | |
| [Connecticut](https://usercentrics.com/knowledge-hub/connecticut-data-privacy-act-ctdpa/) | [CTDPA](https://www.cga.ct.gov/2024/sup/chap_743jj.htm) | Connecticut Data Privacy Act (CTDPA) | 1 July 2023 | N/A | 100,000 | Derives more than 25% of gross revenue from sale of personal data and controls or processes personal data of not less than 25,000 consumers | |
| [Delaware](https://usercentrics.com/knowledge-hub/delaware-digital-personal-data-protection-act-dpdpa/) | [DPDPA](https://delcode.delaware.gov/title6/c012d/index.html) | Delaware Personal Data Privacy Act (DPDPA) | 1 January 2025 | N/A | 35,000 | Derives over 20% of gross revenue from sale of personal data and controls or processes personal data of not less than 10,000 consumers | |
| [Florida](https://usercentrics.com/knowledge-hub/florida-digital-bill-of-rights-fdbr/) | [FDBR](https://www.flsenate.gov/Session/Bill/2023/262/BillText/er/HTML) | Florida Digital Bill of Rights (FDBR) | 1 July 2024 | $1B (Plus one additional threshold) | N/A | N/A | Derives at least 50% of gross revenues from the sale of online ads, or operates a smart speaker with integrated virtual assistant, or operates an app store with at least 250,000 available apps |
| [Indiana](https://usercentrics.com/knowledge-hub/indiana-consumer-data-protection-act-incdpa/) | [INCDPA](https://iga.in.gov/laws/2024/ic/titles/24#24-15-1) | Indiana Consumer Data Protection Act (INCDPA) | 1 January 2026 | N/A | 100,000 | Derives over 50% of gross revenue from sale of personal data and controls or processes personal data of at least 25,000 consumers | |
| [Iowa](https://usercentrics.com/knowledge-hub/iowa-consumer-data-protection-act-icdpa/) | [ICDPA](https://www.legis.iowa.gov/legislation/BillBook?ga=90&ba=SF262) | Iowa Consumer Data Protection Act (ICDPA) | 1 January 2025 | N/A | 100,000 | Derives over 50% of gross revenue from sale of personal data and controls or processes personal data of 25,000 or more consumers | |
| [Kentucky](https://usercentrics.com/knowledge-hub/kentucky-consumer-data-protection-act-kcdpa/) | [KCDPA](https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=39092) | Kentucky Consumer Data Protection Act (KCDPA) | 1 January 2026 | N/A | 100,000 | Derives over 50% of gross revenue from sale of personal data and controls or processes personal data of at least 25,000 consumers | |
| [Maryland](https://usercentrics.com/knowledge-hub/maryland-online-data-privacy-act-modpa/) | [MODPA](https://mgaleg.maryland.gov/2024RS/chapters_noln/Ch_455_sb0541E.pdf) | Maryland Online Data Privacy Act (MODPA) | 1 October 2025 | N/A | 35,000 | Derives more than 20% of gross revenue from sale of personal data and controls or processes personal data of not less than 10,000 consumers | |
| [Minnesota](https://usercentrics.com/knowledge-hub/minnesota-consumer-data-privacy-act-mcdpa/) | [MCDPA](https://www.revisor.mn.gov/laws/2024/0/Session+Law/Chapter/121/) | Minnesota Consumer Data Privacy Act (MCDPA) | 31 July 2025 | N/A | 100,000 | Derives over 25% of gross revenue from sale of personal data and controls or processes personal data of 25,000 or more consumers | |
| [Montana](https://usercentrics.com/knowledge-hub/montana-consumer-data-privacy-act-mtcdpa/) | [MTCDPA](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) | Montana Consumer Data Privacy Act (MTCDPA) | 1 October 2024 | N/A | 50,000 | Derives more than 25% of gross revenue from sale of personal data and controls or processes personal data of not less than 25,000 consumers | |
| [Nebraska](https://usercentrics.com/knowledge-hub/nebraska-data-privacy-act-ndpa/) | [NDPA](https://nebraskalegislature.gov/FloorDocs/108/PDF/Slip/LB1074.pdf) | Nebraska Data Privacy Act (NDPA) | 1 January 2025 | N/A | N/A | N/A | Processes or engages in sale of personal data and is not a small business as defined by US Small Business Administration |
| [New Hampshire](https://usercentrics.com/knowledge-hub/new-hampshire-data-privacy-act-nhpa/) | [NHDPA](https://gc.nh.gov/rsa/html/NHTOC/NHTOC-LII-507-H.htm) | New Hampshire Data Privacy Act (NHDPA) | 1 January 2025 | N/A | 35,000 | Derives more than 25% of gross revenue from sale of personal data and controls or processes personal data of not less than 10,000 consumers | |
| [New Jersey](https://usercentrics.com/knowledge-hub/new-jersey-data-privacy-act-njdpa/) | [NJDPA](https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM) | New Jersey Privacy Act (NJDPA) | 15 January 2025 | N/A | 100,000 | Derives revenue or receives a discount on the price of goods or services from the sale of personal data and controls or processes personal data of 25,000 or more consumers | |
| [Oklahoma](https://usercentrics.com/knowledge-hub/oklahoma-consumer-data-privacy-act-ocdpa/) | [OCDPA](https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.PDF) | Oklahoma Consumer Data Privacy Act (OCDPA) | 1 January 2027 | N/A | 100,000 | Derives 50% or more of annual gross revenue from sale of personal data or controls or processes personal data of 25,000 or more consumers | |
| [Oregon](https://usercentrics.com/knowledge-hub/oregon-consumer-privacy-act-ocpa/) | [OCPA](https://olis.oregonlegislature.gov/liz/2023R1/Downloads/MeasureDocument/SB619/Enrolled) | Oregon Consumer Privacy Act (OCPA) | 1 July 2025 | N/A | 100,000 | Derives 25% or more of annual gross revenue from sale of personal data and controls or processes personal data of 25,000 or more consumers | |
| [Rhode Island](https://usercentrics.com/knowledge-hub/rhode-island-data-transparency-and-privacy-protection-act-ridtppa/) | [RIDTPPA](https://webserver.rilegislature.gov/BillText24/HouseText24/H7787A.htm) | Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) | 1 January 2026 | N/A | 35,000 | Derives more than 20% of gross revenue from sale of personal data and controls or processes personal data of not less than 10,000 customers | |
| [Tennessee](https://usercentrics.com/knowledge-hub/tennessee-information-protection-act-tipa/) | [TIPA](https://www.capitol.tn.gov/Bills/113/Bill/HB1181.pdf) | Tennessee Information Protection Act (TIPA) | 1 July 2025 | $25M (Plus one additional threshold) | 175,000 | Derives over 50% of gross revenue from sale of personal data and controls or processes personal data of 25,000 or more consumers | |
| [Texas](https://usercentrics.com/knowledge-hub/texas-data-privacy-and-security-act/) | [TDPSA](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm#541.055) | Texas Data Privacy and Security Act (TDPSA) | 1 July 2024 | N/A | N/A | N/A | Processes or engages in sale of personal data and is not a small business as defined by U.S. Small Business Administration |
| [Utah](https://usercentrics.com/knowledge-hub/utah-consumer-privacy-act-ucpa/) | [UCPA](https://le.utah.gov/xcode/Title13/Chapter61/13-61.html) | Utah Consumer Privacy Act (UCPA) | 31 December 2023 | $25M (Plus one additional threshold) | 100,000 | Derives over 50% of gross revenue from sale of personal data and controls or processes personal data of 25,000 or more consumers | |
| [Virginia](https://usercentrics.com/knowledge-hub/virginia-consumer-data-protection-act-vcdpa/) | [VCDPA](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/) | Virginia Consumer Data Protection Act (VCDPA) | 1 January 2023 | N/A | 100,000 | Derives over 50% of gross revenue from sale of personal data and controls or processes personal data of at least 25,000 consumers | |

---

Subscribe to our newsletter

Get our monthly newsletter with insightful articles, industry news, and event invites.

Subscribe

Email address

Subscribe

By subscribing to the Usercentrics Newsletter, you agree that your data may be used for information related to the products and services offered by Usercentrics. You can revoke your consent by using the unsubscribe link in a newsletter email or by sending your request to unsubscribe@usercentrics.com. [See Privacy Policy](https://usercentrics.com/privacy-policy/)

Products

[Usercentrics Web CMP](https://usercentrics.com/us/website-consent-management/) [Usercentrics App CMP](https://usercentrics.com/us/in-app-sdk/) [Usercentrics CTV CMP](https://usercentrics.com/us/usercentrics-ctv-cmp/) [Usercentrics Privacy Policy Generator](https://usercentrics.com/us/privacy-policy-generator/) [Server-side Tagging Solution](https://usercentrics.com/us/server-side-tracking-solution/) [Usercentrics Preference Manager](https://usercentrics.com/us/preference-management/) [Audience Unlocker](https://usercentrics.com/us/audience-unlocker/) [Integrations](https://usercentrics.com/us/integrations/) [Web compliance scan](https://usercentrics.com/us/privacy-compliance-scanner/) [App compliance scan](https://usercentrics.com/us/app-data-privacy-audit/) [ROAS calculator](https://usercentrics.com/roas-calculator/)

Solutions

[Data Privacy Regulatory Compliance](https://usercentrics.com/us/data-privacy-regulatory-compliance/) [Marketing Performance Optimization](https://usercentrics.com/us/marketing-performance-optimization/) [Migration](https://usercentrics.com/us/migration/) [Media & Publishing](https://usercentrics.com/us/media-publishing/) [Retail & Ecommerce](https://usercentrics.com/us/retail-ecommerce/) [Banking, Finance & Insurance](https://usercentrics.com/us/banking-finance-insurance/) [Healthcare & Pharmaceuticals](https://usercentrics.com/us/healthcare-pharmaceuticals/) [Gaming](https://usercentrics.com/us/gaming/) [Education](https://usercentrics.com/us/education/) [Automotive](https://usercentrics.com/us/automotive/) [Travel & Hospitality](https://usercentrics.com/us/travel/)

Regulations

[CCPA (California)](https://usercentrics.com/us/ccpa/) [GDPR (EU)](https://usercentrics.com/us/gdpr/) [CPRA (California)](https://usercentrics.com/us/cpra) [CPA (Colorado)](https://usercentrics.com/us/cpa/) [DMA (EU)](https://usercentrics.com/us/digital-markets-act-dma/) [FADP (Switzerland)](https://usercentrics.com/us/fadp/) [PIPEDA (Canada)](https://usercentrics.com/us/pipeda/) [TCF v2.3 (IAB)](https://usercentrics.com/us/cmp-for-publishers/) [Google Consent Mode (EU)](https://usercentrics.com/us/usercentrics-cmp-and-google-consent-mode-v2/) [Microsoft UET Consent Mode (EU)](https://usercentrics.com/us/usercentrics-cmp-and-microsoft-consent-mode/) [View all regulations](https://usercentrics.com/us/regulations-and-frameworks/)

Resources

[Blog](https://usercentrics.com/us/knowledge-hub/) [Whitepapers](https://usercentrics.com/us/whitepapers/) [Checklists](https://usercentrics.com/us/checklists/) [Courses](https://courses.usercentrics.com) [Case studies](https://usercentrics.com/us/case-studies/) [Privacy-Led Marketing](https://usercentrics.com/us/privacy-led-marketing/) [Events](https://usercentrics.com/us/webinar/) [CONSENTED podcast](https://usercentrics.com/us/consented/) [Guides](https://usercentrics.com/us/guides/) [Release notes](https://releases.usercentrics.com/en) [Developer documentation](https://usercentrics.com/docs/) [RFI template](https://usercentrics.com/us/resources/usercentrics-rfi-template/) [Customer directory](https://usercentrics.com/us/usercentrics-customer-directory/)

Company

[About us](https://usercentrics.com/us/about-us/) [Press](https://usercentrics.com/us/press/) [Our offices](https://usercentrics.com/us/contact/) [Trust center](https://trust.usercentrics.com/) [Careers](https://usercentrics.com/us/career/) [Open positions](https://apply.workable.com/usercentrics/) [Diversity and inclusion](https://usercentrics.com/us/dei/)

Support

[General support](https://support.usercentrics.com/hc/en-us) [Contact sales](https://usercentrics.com/us/book-a-consultation/) [Technical support](https://support.usercentrics.com/hc/en-us/requests/new) [Billing and account](https://support.usercentrics.com/hc/en-us/categories/12253804608156-Account-and-billing) [Suggest a feature](https://support.usercentrics.com/hc/en-us/requests/new?ticket_form_id=10610312381340) [Partner login](https://partnerportal.usercentrics.com/) [Partner program](https://usercentrics.com/us/partner-program-overview/) [Affiliate program](https://usercentrics.com/us/affiliates/)

© Copyright 2026 Usercentrics GmbH

 [Terms & Conditions](https://usercentrics.com/terms-and-conditions/) [Terms & Conditions USA](https://usercentrics.com/terms-and-conditions-usa/) [Privacy Policy](https://usercentrics.com/us/privacy-policy/) [Legal Notice](https://usercentrics.com/us/legal-notice/) [Legal Documents](https://usercentrics.com/us/legal-documents/) [Do not sell or share my personal information](javascript:ucResolveCmp().then(cmp=>cmp.showFirstLayer())) [Manage Your Preferences](https://app-preference.preference-management.usercentrics.eu/login/d240b988-65ab-4b2e-8134-4b86e597fc34?lng=en) [Data Subject Requests](javascript:void(0)) [Accessibility Statement](https://usercentrics.com/accessibility-statement-wcag-compliance/)

English (US)

[English](https://usercentrics.com/)[English (US)](https://usercentrics.com/us/)[Deutsch](https://usercentrics.com/de/)[Español](https://usercentrics.com/es/)[Français](https://usercentrics.com/fr/)[Italiano](https://usercentrics.com/it/)[Português](https://usercentrics.com/pt/)

new Uc_Dropdown(document.getElementById("dropdown_6a20435765b04"), {"placeholder":"Select","direct_links":false});

Euro (EUR - €)

Euro (EUR - €)

US Dollar (USD - $)

British Pound (GBP - £)

Danish krone (DKK - kr.)

Norwegian krone (NOK - kr.)

Swedish krona (SEK - kr.)

Polish złoty (PLN - zl)

Swiss franc (CHF - CHF)

new Uc_Dropdown(document.getElementById("dropdown_6a20435765ddb"), {"placeholder":"Select","direct_links":false});

[![What is a Google-certified consent management platform and why do you need one?](https://usercentrics.com/us/wp-content/uploads/sites/7/2024/08/CMP_Badge.svg?v=e6751ec6b1d333a1)](https://usercentrics.com/knowledge-hub/google-cmp-partner-program-usercentrics/ "What is a Google-certified consent management platform and why do you need one) [![Usercentrics G2 Reviews](https://usercentrics.com/us/wp-content/uploads/sites/7/2026/06/Five-badges-G2.svg?v=f9126d18efb7d043)](https://www.g2.com/products/usercentrics/reviews "Usercentrics G2 Reviews") [![Secure your ad revenue with the TCF v2.2](https://usercentrics.com/us/wp-content/uploads/sites/7/2024/08/iab-badge.svg?v=10cba6175b6b8696)](https://usercentrics.com/cmp-for-publishers/ "Secure your ad revenue with the TCF v2.2") [![Patent badge](https://usercentrics.com/us/wp-content/uploads/sites/7/2024/08/uc-patented.svg?v=848b60886c9c1555)](https://usercentrics.com/ "Usercentrics") [![BVDW](https://usercentrics.com/us/wp-content/uploads/sites/7/2024/08/bvdw.png)](https://www.bvdw.org/ "BVDW") [![IAPP](https://usercentrics.com/us/wp-content/uploads/sites/7/2024/08/iapp-bronze-member.png)](https://iapp.org/ "IAPP") [![Accessibility for everyone](https://usercentrics.com/us/wp-content/uploads/sites/7/2025/08/WCAG_22_logo.svg?v=a197f4270c40b01a)](https://usercentrics.com/wcag-accessibility/ "Accessibility for everyone") [![Capterra](https://usercentrics.com/wp-content/uploads/img/8_AuGanFPBGefC2G.svg?t=fa1f52ca)](https://www.capterra.com/p/179357/Usercentrics/reviews/ "Capterra") [![Proficert](https://usercentrics.com/us/wp-content/uploads/sites/7/2025/09/ISO_IEC-27001_2022-1-1.png)](https://trust.usercentrics.com/ "Proficert") [![SOC 2 Type 2 Compliant](https://usercentrics.com/us/wp-content/uploads/sites/7/2025/08/SOC-Badge.png)](https://usercentrics.com/press/usercentrics-cookiebot-achieve-soc-type-2-hipaa-compliance/ "SOC 2 Type 2 Compliant") [![HIPAA Compliant](https://usercentrics.com/us/wp-content/uploads/sites/7/2025/08/HIPAA-Badge-1.png)](https://usercentrics.com/press/usercentrics-cookiebot-achieve-soc-type-2-hipaa-compliance/ "HIPAA Compliant")