An estimated 171 million Americans, or 50.2% of the country, live in one of the 20 US states with a comprehensive consumer privacy law in effect as of 2026. That figure comes from PrivacyTerms.io's own calculation, combining US Census Bureau Vintage 2025 state population estimates with the IAPP's US State Privacy Legislation Tracker's list of states with a law currently in force. Population coverage runs several points ahead of state coverage, because the covered states include the three most populous in the country.
How many Americans are covered by a state privacy law right now?
Roughly 171 million Americans, 50.2% of the national population, live in a state where a comprehensive consumer privacy law is currently in effect. PrivacyTerms.io calculated this by summing US Census Bureau Vintage 2025 population estimates (as of July 1, 2025, released June 2026) for the 20 states the IAPP's tracker lists as in effect, then dividing by the Census Bureau's official national total of 341,784,857.
Census Bureau figures are estimates, not a full recount, and the IAPP's in-effect state list can change the moment a new state's effective date passes. Both inputs are named, dated, and publicly documented, but treat the 50.2% figure as PrivacyTerms.io's own computed estimate rather than an official government statistic, since no single agency publishes a combined population-coverage number.
Which populous states are covered, and which aren't?
Population coverage is lopsided because California, Texas, and Florida, the first, second, and third most populous states in the country, all have a comprehensive privacy law in effect. Those three alone hold more than a quarter of the national population and push the coverage percentage well above the 40% figure that a simple state count (20 of 50) would suggest.
Figure 1: The six most populous states among the 20 with a privacy law in effect, by 2025 Census population. Source: US Census Bureau Vintage 2025 state population estimates.
| State | Law | Population (2025) | Share of US population |
|---|---|---|---|
| California | CCPA (amended by CPRA) | 39,355,309 | 11.5% |
| Texas | Data Privacy and Security Act | 31,709,821 | 9.3% |
| Florida | Digital Bill of Rights | 23,462,518 | 6.9% |
| New Jersey | Data Privacy Act | 9,548,215 | 2.8% |
| Virginia | Consumer Data Protection Act | 8,880,107 | 2.6% |
| Tennessee | Information Protection Act | 7,315,076 | 2.1% |
Source: US Census Bureau Vintage 2025 state population estimates; IAPP US State Privacy Legislation Tracker for law names and in-effect status. On the other side of the ledger, New York, Pennsylvania, Illinois, Ohio, and Georgia remain without a comprehensive privacy law despite ranking among the ten most populous states in the country, a gap covered in more detail below.
Why does population coverage outpace state-count coverage?
20 of 50 states, 40% by simple count, have a privacy law in effect, but 50.2% of Americans are covered. The gap exists because state privacy law adoption has not tracked population size. Nine of the ten least populous states still have no comprehensive law, while the three largest states in the country all do.
Figure 2: Just over half the country's population sits in a covered state, while 45.6% remains in a state with no comprehensive law at all. Source: PrivacyTerms.io calculation from US Census Bureau Vintage 2025 estimates and the IAPP tracker.
Four more states, Alabama, Louisiana, Oklahoma, and Vermont, have enacted a comprehensive privacy law that has not yet reached its effective date as of this post's mid-2026 refresh. Their combined population is 14.6 million, or 4.3% of the country. If all four laws take effect on schedule, total population coverage would climb to roughly 54.4%, without a single additional state needing to pass new legislation, generate a compliant privacy policy for the states already covered rather than waiting for that number to move.
Which uncovered states would move the needle most?
New York, Pennsylvania, Illinois, Ohio, and Georgia are the five most populous US states with no comprehensive privacy law in effect or enacted as of mid-2026. Together they hold 68,984,258 people, 20.2% of the national population, more than the combined population of every state currently enacted but not yet in effect.
Figure 3: A single New York bill, if enacted and in effect, would add more population coverage than any state that has passed a law so far except California, Texas, or Florida. Source: US Census Bureau Vintage 2025 state population estimates.
New York has introduced comprehensive privacy legislation in recent legislative sessions without passing one, and the same is true of several other states in this group. Passage of even one of these five bills would shift the national coverage percentage more than most of the smaller states that have already enacted a law.
How fast has population coverage grown since 2020?
Population coverage went from a single state to just over half the country in a little over six years, and it did not grow evenly. The 2024 cohort alone, four states including Texas and Florida, added more covered population than the three prior years combined.
Figure 4: Texas and Florida's 2024 effective dates did more to move the population-coverage number than any other single year. Source: PrivacyTerms.io calculation from US Census Bureau Vintage 2025 estimates and the IAPP tracker's effective-date history.
The pattern holds a lesson for forecasting future coverage: the next state to pass a law matters less for this statistic than which state does. One large uncovered state, such as New York or Pennsylvania, would move the population-coverage number more than several smaller states passing laws in the same year.
Does your business need to comply based on where your customers live?
A state privacy law applies based on where a business's customers or site visitors live, not where the business itself is based, so a company with no physical presence in California, Texas, or Florida can still fall under all three laws if it serves consumers there and meets each state's applicability threshold.
Figure 5: Coverage is determined by customer location, not headquarters location, which is why the population-coverage number matters more to most online businesses than the state-count number. Source: State privacy law applicability provisions as enacted through 2026.
Because 50.2% of the country is already covered by at least one comprehensive privacy law, most businesses with a US-wide customer base already need a privacy policy that addresses at least one state's requirements, whether or not the business is headquartered in a covered state.
The Bottom Line
Population coverage tells a different story than the simple state count. 20 of 50 states, 40%, have a comprehensive privacy law in effect, but because those 20 states include California, Texas, and Florida, the actual population coverage is 50.2%, or roughly 171 million Americans. That gap will likely keep widening rather than closing evenly, since the next large state to pass a law, whether New York, Pennsylvania, or another populous holdout, would move the coverage percentage more than several smaller states combined. For any business serving customers across state lines, the practical reality is that a majority of the US population is already covered by at least one state's disclosure, access, deletion, and opt-out requirements, which makes building a privacy policy against the applicable state laws a current compliance need rather than a future one.
Frequently Asked Questions
How many Americans are covered by a state privacy law in 2026? An estimated 171 million Americans, or 50.2% of the country, live in one of the 20 states with a comprehensive consumer privacy law in effect as of 2026, based on PrivacyTerms.io's calculation using US Census Bureau Vintage 2025 population estimates against the IAPP's US State Privacy Legislation Tracker.
What percentage of Americans have no state privacy law protection? About 49.8% of Americans, roughly 170 million people, live in a state with no comprehensive privacy law in effect as of 2026. That includes residents of New York, Pennsylvania, Illinois, Ohio, and Georgia, the five most populous states without one.
Will population coverage grow if the newly enacted state laws take effect? Yes. Alabama, Louisiana, Oklahoma, and Vermont have enacted comprehensive privacy laws that were not yet in effect as of mid-2026. Adding their combined 14.6 million residents would bring total coverage to roughly 54.4% of the US population once all four laws take effect.
Which state accounts for the largest share of privacy law coverage? California alone accounts for 11.5% of the entire US population, more than any other single covered state, according to US Census Bureau Vintage 2025 estimates. California, Texas, and Florida together account for more than a quarter of the country's total population.
Where the Numbers Come From
- US Census Bureau. "State Population Totals and Components of Change: 2020-2025." Vintage 2025 state population estimates as of July 1, 2025, used for every individual state population figure in this post.
- US Census Bureau. (2026). "Vintage 2025 Population Estimates." National population total of 341,784,857 as of July 1, 2025, released June 25, 2026.
- IAPP. "US State Privacy Legislation Tracker." 20 states with a comprehensive privacy law in effect as of 2026, last updated 29 June 2026.
- MultiState. (2026). "All of the Comprehensive Privacy Laws That Take Effect in 2026." Confirms Indiana, Kentucky, and Rhode Island effective dates of January 1, 2026.
- Byte Back. (2026). "U.S. State Privacy Law Landscape Expands to 24 States." Confirms Alabama, Louisiana, Oklahoma, and Vermont as enacted but not yet effective as of mid-2026.
Note: All figures verified as of August 2026. Population coverage is a PrivacyTerms.io calculation, not an official government statistic, and will shift as new states pass laws, as enacted laws reach their effective dates, and as the Census Bureau publishes newer population vintages; this post is refreshed at least twice a year.
