Twenty US states have a comprehensive consumer privacy law in effect as of January 2026, according to the IAPP's US State Privacy Legislation Tracker, with Indiana, Kentucky, and Rhode Island joining the list on January 1, 2026. Four additional states passed their own laws during 2026 that had not yet taken effect as of this post's July 2026 refresh. There is still no single federal privacy law, so the state-by-state list below is the actual compliance map most businesses have to work from.
How many states have a comprehensive privacy law right now?
20 states have a comprehensive consumer privacy law in effect as of January 2026, per the IAPP's tracker, which counts a law once its effective date has passed rather than once it is signed. That is up from 19 states in effect through the end of 2025, with Indiana, Kentucky, and Rhode Island each starting enforcement on January 1, 2026.
Figure 1: California stood alone for three years before Virginia, Colorado, Connecticut, and Utah followed in 2023. Source: IAPP US State Privacy Legislation Tracker, effective-date count as of July 2026.
Growth has not slowed. Nine states passed a law effective before the end of 2024, eight more followed with 2025 effective dates, and three started in the first week of 2026 alone. If a state has not passed a law yet, that is now the exception rather than the rule for states with sizable populations or tech-sector employers.
Which states have a privacy law and when did it take effect?
Every one of the 20 states in effect follows the same broad model first set by Virginia in 2023: consumer rights to access, delete, and correct personal data, an opt-out right for targeted advertising and data sales, and a revenue or data-volume threshold that exempts the smallest businesses. The exact thresholds and enforcement mechanics vary by state.
| State | Law | Effective date |
|---|---|---|
| California | CCPA (amended by CPRA) | January 1, 2020 |
| Virginia | Consumer Data Protection Act | January 1, 2023 |
| Colorado | Colorado Privacy Act | July 1, 2023 |
| Connecticut | Data Privacy Act | July 1, 2023 |
| Utah | Consumer Privacy Act | December 31, 2023 |
| Texas | Data Privacy and Security Act | July 1, 2024 |
| Oregon | Consumer Privacy Act | July 1, 2024 |
| Montana | Consumer Data Privacy Act | October 1, 2024 |
| Florida | Digital Bill of Rights | July 1, 2024 |
| Delaware | Personal Data Privacy Act | January 1, 2025 |
| Iowa | Consumer Data Protection Act | January 1, 2025 |
| Nebraska | Data Privacy Act | January 1, 2025 |
| New Hampshire | Privacy Act | January 1, 2025 |
| New Jersey | Data Privacy Act | January 15, 2025 |
| Tennessee | Information Protection Act | July 1, 2025 |
| Minnesota | Consumer Data Privacy Act | July 31, 2025 |
| Maryland | Online Data Privacy Act | October 1, 2025 |
| Indiana | Consumer Data Protection Act | January 1, 2026 |
| Kentucky | Consumer Data Protection Act | January 1, 2026 |
| Rhode Island | Data Transparency and Privacy Protection Act | January 1, 2026 |
Source: IAPP US State Privacy Legislation Tracker and MultiState's 2026 comprehensive-law roundup, cross-checked against each state's enacted bill text. Florida's Digital Bill of Rights is included here because most trackers count it among the 20, though IAPP itself has noted its $1 billion revenue threshold makes it narrower in practice than the other 19 laws, applying only to a small number of very large platforms rather than the broader small-and-mid-size business base the other state laws reach.
Figure 2: Six years, twenty effective dates, no sign of the pace slowing. Source: IAPP US State Privacy Legislation Tracker, MultiState 2026 roundup.
A business handling personal data from residents of even a handful of these states now needs a privacy policy generator built to track CCPA and the newer state laws, since each new effective date can quietly change what a policy has to disclose.
What does it take for the CCPA to apply to a business?
A business must meet at least one of three thresholds before the CCPA applies: annual gross revenue exceeding $26,625,000, deriving 50% or more of annual revenue from selling or sharing personal information, or processing the personal information of 100,000 or more California consumers or households per year. The California Privacy Protection Agency adjusts the revenue figure for inflation every other year.
Figure 3: The three independent CCPA applicability tests; meeting any one is enough. Source: California Privacy Protection Agency, CCPA regulations as amended through 2026.
The $26,625,000 figure replaced the original $25,000,000 threshold set when CCPA passed in 2018, after the CPPA's December 2024 inflation adjustment took effect January 1, 2025 and carries through 2026. Most other state privacy laws use a lower data-volume threshold instead of a revenue test, commonly 100,000 consumers, which pulls in more mid-sized businesses than CCPA's revenue-first design.
How do state privacy law penalties compare?
California carries the highest statutory exposure of any state law with an active private right of action, though that right of action is narrow. Civil penalties for a general CCPA violation now run up to $2,663 per violation, or $7,988 for an intentional violation or one involving a consumer under 16, per the CPPA's 2025 adjustment. For a closer look at how those caps translate into real settlements, see our CCPA enforcement statistics for 2026, which tracks the actual fines California has collected case by case.
| State | Max civil penalty per violation | Private right of action | Cure period |
|---|---|---|---|
| California | $2,663 ($7,988 intentional/minor) | Yes, breach-related only | None (removed 2023) |
| Colorado | $20,000 | No | None (expired Jan 2025) |
| Connecticut | $5,000 | No | None (expired Dec 2024) |
| Virginia | $7,500 | No | 30 days |
| Texas | $7,500 | No | 30 days |
Source: California Privacy Protection Agency 2025 fine adjustment; state attorney general enforcement guidance for Colorado, Connecticut, Virginia, and Texas, as summarized in each state's enacted bill text and 2025-2026 amendments.
Figure 4: California's per-violation cap is the lowest of these five states, but its intentional-violation cap of $7,988 and its narrow private right of action add exposure the flat caps do not. Source: California Privacy Protection Agency 2025 adjustment; state attorney general guidance.
California's own 30-day cure period expired at the start of 2023, and Colorado's and Connecticut's cure periods have since expired too, which means regulators in all three states can now fine a business for a first violation without giving it a chance to fix the problem first. Virginia and Texas still offer a 30-day window as of mid-2026, but every state that has revisited its original cure period has shortened or eliminated it rather than extended it.
Figure 5: 2025 was the single biggest year for new effective dates, with eight states starting enforcement that year alone. Source: IAPP US State Privacy Legislation Tracker, MultiState 2026 roundup.
The Bottom Line
20 states with a live privacy law and 4 more enacted but not yet effective means a business collecting personal data from US consumers can no longer treat this as a California-only problem. The thresholds differ, the cure periods are disappearing, and the penalty structures range from Connecticut's flat $5,000 cap to Colorado's $20,000 maximum, but the underlying consumer rights, access, deletion, correction, and opt-out, are now similar enough across all 20 laws that a single well-built privacy policy can cover most of them at once if it is kept current as new states reach their effective dates.
Frequently Asked Questions
How many US states have a comprehensive privacy law in 2026? 20 states have a comprehensive consumer privacy law in effect as of January 2026, according to the IAPP's US State Privacy Legislation Tracker. Four more states, Alabama, Louisiana, Oklahoma, and Vermont, passed comprehensive privacy laws during 2026 that were not yet in effect as of this post's July 2026 refresh, bringing the total enacted to 24.
Which state privacy law was the first to take effect? California's original CCPA took effect on January 1, 2020, making it the first comprehensive state consumer privacy law in the country. Virginia's Consumer Data Protection Act followed on January 1, 2023, as the second state law and the first to pass after California.
What is the CCPA revenue threshold for 2026? A business must have annual gross revenue exceeding 26,625,000 dollars to meet one of the three CCPA applicability thresholds in 2025 and 2026, according to the California Privacy Protection Agency's December 2024 inflation adjustment announcement, up from the original 25,000,000 dollar figure set in 2020.
Do any state privacy laws let consumers sue businesses directly? California is the only comprehensive state privacy law with a private right of action, and it is limited to certain data breaches rather than general violations, carrying statutory damages of 107 to 799 dollars per consumer per incident as of the CPPA's 2025 inflation adjustment. Washington's My Health My Data Act, a narrower health-data law rather than a comprehensive privacy law, also carries a private right of action.
Where the Numbers Come From
- IAPP. "US State Privacy Legislation Tracker." 20 states with a comprehensive privacy law in effect as of January 2026, last updated 29 June 2026.
- California Privacy Protection Agency. (2024). "CCPA Monetary Threshold Adjustments." Revenue threshold raised to $26,625,000; civil penalties raised to $2,663 ($7,988 intentional or minor violations); private right of action damages raised to $107 to $799 per consumer per incident, effective January 1, 2025.
- MultiState. (2026). "All of the Comprehensive Privacy Laws That Take Effect in 2026." Indiana, Kentucky, and Rhode Island effective January 1, 2026; twenty states with laws on the books.
- Byte Back. (2026). "U.S. State Privacy Law Landscape Expands to 24 States." Alabama, Louisiana, Oklahoma, and Vermont enacted in 2026, not all yet effective.
- Troutman Pepper Locke. (2023). "U.S. State Privacy Laws in 2023: California, Colorado, Connecticut, Utah and Virginia." Confirms 2023 effective dates for the first five-state cohort.
Note: All figures verified as of July 2026. State privacy law counts change frequently as new bills pass and prior laws reach their effective dates; this post is refreshed at least twice a year to track the IAPP tracker and new state enactments.
![Biggest Data Breaches of All Time: Top 40 Ranked [2026]](/_astro/biggest-data-breaches-all-time.BQZgtXr2_Zv0Kc1.webp)
![Biggest GDPR Fines of All Time: Top 50 Ranked [2026]](/_astro/biggest-gdpr-fines-all-time.BJNzFfK6_1fYRB.webp)
![Consent Management Platform Market Size [2026 Report]](/_astro/consent-management-platform-market-size-2026.DJutyAo2_ZUTC5m.webp)
![How Many Websites Have a Privacy Policy? [2026 Data]](/_astro/how-many-websites-have-a-privacy-policy.CQaJvRxz_1ksqAi.webp)
