![20 of 50 US States Have Privacy Laws in 2026 [Tracker]](/_astro/how-many-us-states-have-privacy-laws-in-2026.CaXY8Bln_LBQVI.webp)
20 of the 50 US states, 40% of the country, have a comprehensive consumer privacy law in effect as of 2026, according to the IAPP's US State Privacy Legislation Tracker. Four more states have enacted a law that has not yet reached its effective date, and 26 states, more than half the country, still have no comprehensive privacy law on the books at all. Below is the full breakdown: how many states are actually covered right now, how fast the count is growing, which states remain uncovered, and what share of the population that translates to.
How many US states have a privacy law right now?
Of the 50 states, 20 have a comprehensive consumer privacy law in effect, 4 have enacted one that has not yet reached its effective date, and 26 have not enacted a comprehensive privacy law at all, per the IAPP's US State Privacy Legislation Tracker, last updated 29 June 2026. "In effect" and "enacted" are not the same status: a law counts as enacted the day the governor signs it, but it counts toward the in-effect total only once its effective date has actually passed.
Figure 1: Twenty-six states, more than half the country, have not enacted a comprehensive privacy law at all. Source: IAPP US State Privacy Legislation Tracker, checked 29 June 2026.
That 26-state group is not static. Several of the largest states without a law today, including New York and Illinois, have had comprehensive privacy bills introduced in recent sessions that stalled before passage, so the 40% coverage figure is a floor rather than a ceiling for how the map looks by the end of 2026.
How fast has the number of states with a law grown?
The count went from a single state to 20 states in effect in a little over six years. California's CCPA was the only comprehensive state privacy law in effect from January 2020 until Virginia's Consumer Data Protection Act took effect on January 1, 2023, and the pace has accelerated in every year since.
Figure 2: Enacted counts track when a law was signed, not when it took effect, so 2026 already shows all 24 enacted states even though 4 are not yet in force. Source: IAPP US State Privacy Legislation Tracker, state legislative records.
Nine states reached their effective date before the end of 2024, eight more followed with 2025 effective dates, and three, Indiana, Kentucky, and Rhode Island, started on the same day, January 1, 2026. For the complete state-by-state list with exact effective dates, see our full US state privacy law tracker.
Which states still have no privacy law?
26 states have no comprehensive privacy law enacted or in effect as of this post's mid-2026 refresh. That group includes several of the largest states by population: New York, Pennsylvania, Illinois, Ohio, Georgia, North Carolina, Michigan, and Washington all remain without a comprehensive consumer privacy statute, even though several have narrower sector-specific laws, such as Illinois's biometric-data law (BIPA) or Washington's health-data-only My Health My Data Act.
Figure 3: Every year since 2021 has added at least two newly enacted states, but the pace of new enactments has not been enough to reach even half the country in six years. Source: IAPP US State Privacy Legislation Tracker, state legislative records.
None of these 26 states are guaranteed to stay uncovered. Comprehensive privacy bills have been introduced in a number of them in recent sessions, and a business serving customers nationwide should treat the 26-state gap as temporary rather than permanent when deciding how broad a privacy policy to build.
Which region has passed the most state privacy laws?
The South accounts for 10 of the 24 enacted states, the largest share of any US Census Bureau region: Virginia, Texas, Florida, Delaware, Tennessee, Maryland, and Kentucky are in effect, and Alabama, Louisiana, and Oklahoma are enacted but not yet effective. The West and Northeast each account for 5 enacted states, and the Midwest accounts for 4.
Figure 4: The South's 10 enacted states outnumber the Midwest's 4 by more than double. Source: PrivacyTerms.io regional grouping of the IAPP tracker's state list against US Census Bureau region definitions.
The regional split does not track a single obvious cause: the South's total is driven mostly by 2023 and 2026 enactments, while the West's 5 states include the earliest mover (California, 2020) and one of the newest legislative sessions to act. No single region has come close to covering all of its states, and the Midwest, the smallest group at 4 of 12 states, has the most room left to grow of any region.
What share of the US population is covered?
An estimated 50% of the US population lives in one of the 20 states with a privacy law currently in effect, based on PrivacyTerms.io's own calculation using recent Census Bureau state population estimates weighted against the IAPP tracker's in-effect state list. California and Texas, the two most populous states in the country, both have laws in effect, and together they account for roughly a fifth of the national population on their own.
| Coverage measure | Count | Share of total |
|---|---|---|
| States with a law in effect | 20 of 50 | 40% |
| States enacted (effective or not) | 24 of 50 | 48% |
| States with no comprehensive law | 26 of 50 | 52% |
| Estimated US population under an in-effect law | approx. 50% | approx. half |
Source: IAPP US State Privacy Legislation Tracker for state counts; population share is PrivacyTerms.io's calculation from Census Bureau state population estimates and should be read as an approximation, not a published Census figure.
That population estimate matters more than the raw state count for most businesses, because a company serving customers nationwide is far more likely to be reaching a resident of a covered state than the 40% headline number alone suggests, once population weighting is taken into account.
Does a state privacy law apply to a business outside that state?
Yes, in almost every case. Every comprehensive state privacy law applies based on where the consumer lives, not where the business is located, so a company with no physical presence in California, Virginia, or any of the other 20 in-effect states can still be covered the moment it collects personal data from a resident of one and meets that state's applicability threshold.
Figure 5: Location of the consumer, not the business, is what triggers most state privacy law obligations. Source: IAPP US State Privacy Legislation Tracker, state enacted bill text.
Because thresholds and required disclosures differ by state, most businesses selling to a national US audience end up needing a policy built to the strictest common denominator across every state where they have qualifying customers, rather than picking just one state's rules. A privacy policy generator built to track the growing list of state laws can update a published policy as new states reach their effective dates, without a rewrite from scratch each time.
The Bottom Line
20 of 50 US states have a privacy law in effect, 4 more are enacted and waiting on their effective dates, and 26 states, just over half the country, still have no comprehensive privacy law at all. That gap is closing every year rather than holding steady: the enacted count has grown every single year since 2021, and roughly half the US population already lives somewhere a comprehensive privacy law applies. A business that only worries about the states where it has a physical office is very likely undercounting its actual compliance obligations, since coverage now tracks where a customer lives, not where a company is headquartered.
Frequently Asked Questions
How many US states have a privacy law in 2026? 20 of the 50 US states, or 40%, have a comprehensive consumer privacy law in effect as of 2026, according to the IAPP's US State Privacy Legislation Tracker. Four more states, Alabama, Louisiana, Oklahoma, and Vermont, have enacted a law that was not yet in effect as of this post's August 2026 refresh, bringing the enacted total to 24 states, or 48%.
What percentage of the US population lives in a state with a privacy law? An estimated 50% of the US population lives in one of the 20 states with a comprehensive privacy law in effect, based on PrivacyTerms.io's calculation using Census Bureau state population estimates against the IAPP tracker's in-effect state list. California and Texas alone account for roughly a fifth of the national population and both have laws in effect.
Which US states still have no comprehensive privacy law at all? 26 states have no comprehensive consumer privacy law enacted or in effect as of mid-2026, including New York, Pennsylvania, Illinois, Ohio, Georgia, North Carolina, Michigan, and Washington, per the IAPP tracker. Several of these states have introduced comprehensive privacy bills in recent legislative sessions without passing one.
Which US region has passed the most state privacy laws? The South leads with 10 of the 24 enacted states (Virginia, Texas, Florida, Delaware, Tennessee, Maryland, Kentucky, Alabama, Louisiana, and Oklahoma), followed by the West and Northeast with 5 each and the Midwest with 4, based on PrivacyTerms.io's regional grouping of the IAPP tracker's state list against US Census Bureau region definitions.
Where the Numbers Come From
- IAPP. "US State Privacy Legislation Tracker." 20 states with a comprehensive privacy law in effect and 24 states enacted overall as of the June 29, 2026 update.
- MultiState. (2026). "All of the Comprehensive Privacy Laws That Take Effect in 2026." Confirms Indiana, Kentucky, and Rhode Island effective January 1, 2026, and the 20-state in-effect total.
- Byte Back. (2026). "U.S. State Privacy Law Landscape Expands to 24 States." Confirms Alabama, Louisiana, Oklahoma, and Vermont as the 4 most recently enacted, not-yet-effective states.
- US Census Bureau. "Population and Housing Unit Estimates." State population figures used for this post's regional grouping and population-coverage estimate.
- National Conference of State Legislatures. "State Laws Related to Digital Privacy." Tracks introduced-but-not-passed comprehensive privacy bills in states without an enacted law.
Note: All figures verified as of August 2026. The population-coverage figure in this post is PrivacyTerms.io's own calculation from published Census Bureau state estimates weighted against the IAPP tracker's state list, not a figure published directly by either source. State counts are refreshed at least twice a year to track new enactments and effective dates.
