Explore. Learn. Grow.

The Virginia Consumer Data Protection Act (VCDPA), signed on March 2, 2021, was the second comprehensive U.S. state privacy law. It has applied since January 1, 2023, and amendments have since added protections for children’s data and, from July 1, 2026, a ban on selling precise geolocation data. This overview covers who the law applies to, consumer rights, sensitive data, and enforcement.

The Delaware Personal Data Privacy Act (DPDPA), signed on September 11, 2023, is the twelfth comprehensive U.S. state privacy law. It took effect on January 1, 2025, and House Bill 380 expands its scope from January 1, 2027. This overview covers who the law applies to, consumer rights, sensitive data, opt-out signals, and enforcement.

The Iowa Consumer Data Protection Act (ICDPA) has been in effect since January 1, 2025. It gives Iowa residents four data rights and relies on notice and opt-out, which makes it one of the lighter-touch U.S. state privacy laws. This guide covers who must comply, consumer rights, controller duties, and enforcement, including the 90-day cure period.

The Montana Consumer Data Privacy Act (MTCDPA) took effect on October 1, 2024, and SB 297 amended it effective October 1, 2025. The amendments lowered applicability thresholds, added duties for minors’ data, removed the cure period, and introduced civil penalties of up to USD 7,500 per violation.

The Oregon Consumer Privacy Act (OCPA), in effect since July 1, 2024, sets rules for how businesses collect, share, and protect Oregon residents’ personal data. Amendments that took effect on January 1, 2026 added a universal opt-out requirement, ended the mandatory cure period, and tightened protections for minors and precise geolocation data.

The Utah Consumer Privacy Act (UCPA) gives Utah residents the right to access, delete, correct, and obtain a copy of their personal data, and to opt out of its sale or use for targeted advertising. This overview covers who must comply, what controllers must do, how the law is enforced, and recent changes, including the right to correct that took effect July 1, 2026.

The California Consumer Privacy Act (CCPA), in effect since 2020 and expanded by the CPRA, governs how covered businesses collect, use, sell, and share Californians’ personal information. This guide explains who must comply, what rights consumers hold, and what businesses must do, including the 2026 rules on automated decision-making, risk assessments, and cybersecurity audits, and the SB 923 changes taking effect in 2027.

The California Privacy Rights Act (CPRA) amended the California Consumer Privacy Act (CCPA), and two regulators now enforce it with fines and settlements that reach into the millions of dollars. New rules on opt-out signals, automated decision-making, deletion requests, and website tracking lawsuits take effect in 2027.