{"id":380,"date":"2025-02-07T10:05:00","date_gmt":"2025-02-07T09:05:00","guid":{"rendered":"https:\/\/stage.usercentrics.com\/?post_type=knowledge&p=29039"},"modified":"2026-03-29T20:58:44","modified_gmt":"2026-03-29T18:58:44","slug":"us-data-privacy-laws-by-state","status":"publish","type":"knowledge","link":"https:\/\/usercentrics.com\/us\/knowledge-hub\/us-data-privacy-laws-by-state\/","title":{"rendered":"U.S. data privacy laws by state: rights and requirements"},"content":{"rendered":"\n

California passed the first U.S. state data privacy law in 2018 with the California Consumer Privacy Act (CCPA)<\/a>, the same year the General Data Protection Regulation (GDPR)<\/a> came into force. Progress beyond that state was slow for the next several years, with the Virginia Consumer Data Protection Act (VCDPA)<\/a> being the main state-level regulation passed.<\/p>\n\n\n\n

New momentum started in 2023, with six states passing laws. The European Union and United States also replaced the struck-down Privacy Shield with their new data privacy framework<\/a>: the EU-U.S. Data Privacy Framework.<\/p>\n\n\n\n

The momentum continued into 2024, with seven more U.S. state privacy laws being passed and federal legislation being made public for review. Eight state privacy laws are currently scheduled to come into effect in 2025, and three more in 2026. More state-level data privacy laws are expected to be passed, and some states are already enacting updates to their existing laws. Federal legislation has not made progress, which is expected to continue to be the case.<\/p>\n\n\n\n

We also expect to see more topical or industry-specific laws being proposed or passed in the U.S., like the Washington My Health My Data Act<\/a>, and the AI Act in Colorado<\/a>.<\/p>\n\n\n\n

What are the states with privacy laws?<\/h2>\n\n\n\n

There is a long way to go before U.S. states with data privacy laws are the majority, or a federal law is passed that supplants them. However, momentum is growing, and states drafting legislation now have a substantial number of implemented regulations to draw from, as well as a wealth of evolving thought regarding data privacy, technology, and consumers\u2019 rights.<\/p>\n\n\n\n

To date, all the data privacy laws in the U.S. at a state level have implemented an opt-out consent model, so in most cases personal data can be collected and processed without consent, though individuals have the right to opt-out of sale, sharing, targeted advertising, and\/or profiling, depending on the specific regulation. California remains the only state to enable a private right of action, allowing consumers to directly sue companies for damages if they are involved in a data breach or other violation.<\/p>\n\n\n\n

\"Illustration<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Which modern U.S. state privacy laws are considered comprehensive?<\/h3>\n\n\n\n

Due to its somewhat more narrow focus and broader exclusions, the Florida Digital Bill of Rights (FDBR) is not considered among the comprehensive modern data privacy laws in the US. The same goes for the Nevada Privacy of Information Collected on the Internet from Consumers Act (NPICICA) and Amendment SB-260, though that law is older and predates even California\u2019s CCPA.<\/p>\n\n\n\n

What are the compliance requirements for U.S. state privacy laws?<\/h3>\n\n\n\n

Compliance threshold standards vary across states, with thresholds like company revenue not being included in more recently passed laws. We are also seeing advancements in technology and social issues being reflected in the laws, e.g. with more explicit considerations for \u201cautomated decision-making\u201d (e.g. AI tools) and inclusion of information like gender identity under the category of sensitive data.<\/p>\n\n\n\n

While some of the U.S. states with privacy laws tout themselves as being more \u201cbusiness-friendly\u201d or more strict, they all remain fairly similar. It is important, however, to consult with qualified legal counsel or a data privacy expert to ensure that your business meets the requirements for all states where it\u2019s required to comply with regulations.<\/p>\n\n\n\n

Let\u2019s look at a comparison of the U.S. data privacy laws at the state level and what they mean for businesses and consumers.<\/p>\n\n\n

\n \n
\n
\n
\n
\n \"Video <\/div>\n