Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

US state privacy laws and effective dates

Every state comprehensive consumer privacy law, plus state AI, biometric, health data and cybersecurity laws.

FewerMore laws

29 states with tracked laws. Tap one to open it.

State privacy law effective dates

StateLawEffective
IllinoisIllinois BIPAOct 3, 2008
CaliforniaCCPA / CPRAJan 1, 2020
VirginiaVirginia VCDPAJan 1, 2023
ColoradoColorado Privacy Act (CPA)Jul 1, 2023
ConnecticutConnecticut Data Privacy Act (CTDPA)Jul 1, 2023
UtahUtah UCPADec 31, 2023
CaliforniaCalifornia Delete Act / DROPJan 1, 2024
NevadaNevada consumer health data lawMar 31, 2024
WashingtonWashington My Health My Data ActMar 31, 2024
FloridaFlorida Digital Bill of RightsJul 1, 2024
OregonOregon OCPAJul 1, 2024
TennesseeTennessee ELVIS ActJul 1, 2024
TexasTexas TDPSAJul 1, 2024
MarylandMaryland Kids CodeOct 1, 2024
MontanaMontana Consumer Data Privacy Act (MCDPA)Oct 1, 2024
DelawareDelaware Personal Data Privacy Act (DPDPA)Jan 1, 2025
IowaIowa Consumer Data Protection Act (ICDPA)Jan 1, 2025
NebraskaNebraska NDPAJan 1, 2025
New HampshireNew Hampshire Privacy ActJan 1, 2025
New JerseyNew Jersey NJDPAJan 15, 2025
UtahUtah App Store Accountability ActMay 7, 2025
New YorkNY Child Data Protection ActJun 20, 2025
TennesseeTennessee TIPAJul 1, 2025
MinnesotaMinnesota Consumer Data Privacy Act (MCDPA)Jul 31, 2025
MarylandMaryland Online Data Privacy Act (MODPA)Oct 1, 2025
New YorkNY Algorithmic Pricing Disclosure ActNov 10, 2025
CaliforniaCalifornia AB 2013 (AI training data transparency)Jan 1, 2026
CaliforniaCalifornia social media account deletionJan 1, 2026
IndianaIndiana Consumer Data Protection Act (ICDPA)Jan 1, 2026
KentuckyKentucky Consumer Data Protection Act (KCDPA)Jan 1, 2026
NebraskaNebraska Kids CodeJan 1, 2026
Rhode IslandRhode Island RIDTPPAJan 1, 2026
TexasTexas App Store Accountability ActJan 1, 2026
ArkansasArkansas COPPA 2.0Jul 1, 2026
LouisianaLouisiana app store age verification lawJul 1, 2026
CaliforniaCalifornia Digital Age Assurance ActJan 1, 2027
ColoradoColorado AI ActJan 1, 2027
LouisianaLouisiana Data Privacy ActJan 1, 2027
OklahomaOklahoma OKCDPAJan 1, 2027
VermontVermont Kids CodeJan 1, 2027
AlabamaAlabama Personal Data Protection Act (APDPA)May 1, 2027
VermontVermont VDPOSAJan 1, 2028

Regulations

Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics
In forceUtah
Utah App Store Accountability ActApp stores must verify each user's age category, obtain parental consent for minor accounts and share age and consent status with developers. Developers must check age and consent through the app store and cannot enforce contracts against minors without consent. Parents of harmed minors can sue.Next: Dec 31 Private right of action begins · in 2 months
EnactedCalifornia
California AI Auditor RegistryCreates a state registry for AI auditors run by the Government Operations Agency. From 2029 only registered auditors may offer, sell or conduct covered AI audits, and they must show their registration number in advertising. Registered auditors must file information and follow conduct rules.Next: Jan 1, 2027 Act takes effect · in 2 months
AmendedCalifornia
California AI Transparency Act (SB 942)Covered generative AI providers must offer a free AI-content detection tool, give users the option of a visible (manifest) disclosure on AI-generated image, video or audio, and embed a latent, machine-readable provenance disclosure. Licensees must keep those disclosures intact, and providers must revoke a license within 96 hours of learning a licensee disabled them. AB 853 delayed the operative date to August 2, 2026 and extends duties to large online platforms and GenAI hosting platforms from 2027 and to capture-device makers from 2028.Next: Jan 1, 2027 Large online platform and hosting platform duties · in 2 months
EnactedCalifornia
California Digital Age Assurance ActOperating system providers must ask for a user's birth date or age at device account setup and send an age-bracket signal to apps through an API. App developers must request that signal when an app is downloaded and launched. The signal may only be used for age compliance and not shared for other purposes.Next: Jan 1, 2027 Age signal duties begin · in 2 months
In forceCalifornia
California SB 53 (TFAIA)Frontier AI developers must publish transparency reports when deploying new or substantially modified frontier models and report critical safety incidents to the Office of Emergency Services (OES). Large frontier developers must also write, implement and publish a frontier AI framework for catastrophic risk, update it annually, and send OES quarterly summaries of their catastrophic-risk assessments. The act also adds whistleblower protections and creates the CalCompute public computing consortium.Next: Jan 1, 2027 First OES anonymized incident report and CDT definition review · in 2 months
In forceCalifornia
California SB 976 addictive feedsBars addictive, personalized feeds for known minors without verifiable parental consent, and limits notifications to minors at night and during school hours. From 2027 operators must reasonably determine a user is not a minor before serving an addictive feed. The Attorney General must adopt age assurance and parental consent rules.Next: Jan 1, 2027 Age assurance duty and AG rules · in 2 months
AmendedCalifornia
CCPA / CPRAGives California residents (including employees and B2B contacts) rights to know, delete, correct, and opt out of sale/sharing of personal information and to limit use of sensitive personal information. CPPA regulations approved Sept 22, 2025 (effective Jan 1, 2026) add automated decisionmaking technology (ADMT) rights, mandatory risk assessments with submissions to the agency, and annual independent cybersecurity audits. AB 566 (2025) requires browsers to offer an opt-out preference signal from Jan 1, 2027.Next: Jan 1, 2027 ADMT requirements compliance date · in 2 months
EnactedColorado
Colorado AI ActColorado's 2024 high-risk AI law (risk-management programs, impact assessments) never took effect: it was delayed to June 30, 2026 and then repealed and reenacted by SB 26-189, signed May 14, 2026, as a narrower automated decision-making technology (ADMT) law. From January 1, 2027, developers must give deployers technical documentation (intended uses, training data categories, limitations) and deployers must notify consumers at the point of interaction, explain ADMT's role within 30 days after an adverse outcome, and offer data correction and meaningful human review. Impact-assessment and risk-management-program mandates were dropped; 3-year record retention remains.Next: Jan 1, 2027 ADMT obligations apply · in 2 months
AmendedConnecticut
Connecticut Data Privacy Act (CTDPA)Comprehensive privacy law with access, correction, deletion, portability and opt-out rights. PA 25-113 (effective July 1, 2026) sharply lowered applicability thresholds, broadened sensitive data, added profiling impact assessments, and requires disclosure of whether personal data is used to train large language models. PA 26-64 (effective Oct 1, 2026) bans the sale of precise geolocation data and creates a data broker registry (registration required from Jan 1, 2027) and a state deletion mechanism brokers must honor from Oct 1, 2028.Next: Jan 1, 2027 Data broker registration required · in 2 months
AmendedDelaware
Delaware Personal Data Privacy Act (DPDPA)Comprehensive privacy law with low applicability thresholds and no exemption for nonprofits. Grants rights to access, correct, delete, port, and opt out of targeted advertising, sale and profiling, and requires honoring opt-out preference signals from Jan 1, 2026. A 2026 amendment (85 Del. Laws c. 463) lowers thresholds further and adds third-party duties from Jan 1, 2027.Next: Jan 1, 2027 Amended thresholds and third-party duties take effect · in 2 months
EnactedLouisiana
Louisiana Data Privacy ActLouisiana's comprehensive privacy law, signed May 29, 2026, gives consumers access, deletion, correction, portability and opt-out rights and requires conspicuous notice when sensitive or biometric data is sold. It uses CCPA-style applicability thresholds, including a $25M revenue trigger.Next: Jan 1, 2027 Louisiana Data Privacy Act takes effect · in 2 months
AmendedNew Hampshire
New Hampshire Privacy ActComprehensive consumer privacy law giving New Hampshire residents access, correction, deletion, portability and opt-out rights (sale, targeted ads, profiling), with opt-in consent for sensitive data, universal opt-out signal support and data protection assessments. A 2026 amendment (HB 1460) bans selling the personal data of children under 13 starting in 2027.Next: Jan 1, 2027 Ban on selling personal data of children under 13 (HB 1460) · in 2 months
EnactedNew York
NY RAISE ActFrontier AI developers must publish transparency reports when they deploy models and report critical safety incidents to a new DFS oversight office within 72 hours, or within 24 hours to authorities where there is imminent risk of death or injury. Large frontier developers must also publish and annually update a Frontier AI Framework, submit catastrophic-risk assessments, file disclosure statements with DFS every two years, and pay a share of the office's costs. The March 2026 chapter amendment realigned the law closely with California SB 53.Next: Jan 1, 2027 RAISE Act takes effect · in 2 months
EnactedOklahoma
Oklahoma OKCDPANew Virginia-style comprehensive privacy law: consumers get access, correction, deletion, portability and opt-out rights (sale, targeted ads, profiling), with opt-in consent for sensitive data, privacy notices and data protection assessments. It treats pseudonymous data as personal data and lets controllers authenticate opt-out requests.Next: Jan 1, 2027 Oklahoma Consumer Data Privacy Act takes effect · in 2 months
AmendedUtah
Utah UCPABusiness-friendly comprehensive privacy law with access, deletion, portability and opt-out rights (targeted advertising, sale); sensitive data needs notice and a chance to opt out rather than opt-in consent, and data protection assessments are not required. A right to correct was added from July 1, 2026, and from Jan 1, 2027 the law covers motor vehicle manufacturers regardless of thresholds.Next: Jan 1, 2027 UCPA extends to motor vehicle manufacturers · in 2 months
EnactedVermont
Vermont Kids CodeCovered online businesses owe minors a minimum duty of care, must set high-privacy defaults and offer tools, and must avoid prohibited data and design practices. Age assurance data has privacy limits.Next: Jan 1, 2027 Takes effect · in 2 months
EnactedNew York
NY SAFE for Kids ActSocial media platforms may not show algorithmically personalized feeds to users under 18, or send them notifications between midnight and 6 a.m., without parental consent. The AG's final rules set age assurance accuracy standards, certification and parental consent methods.Next: Jan 25, 2027 Act and rules take effect · in 3 months
In forceCalifornia
California Delete Act / DROPRequires data brokers to register annually with the California Privacy Protection Agency and to process consumer deletion requests submitted through the agency's Delete Request and Opt-out Platform (DROP). DROP opened to consumers Jan 1, 2026; from Aug 1, 2026 brokers must pull and process requests at least every 45 days. Brokers face independent compliance audits every three years from 2028.Next: Jan 31, 2027 Annual data broker registration deadline · in 3 months
AmendedMaryland
Maryland Online Data Privacy Act (MODPA)The strictest US state comprehensive privacy law: imposes data minimization limited to what is strictly necessary, bans the sale of sensitive data outright, and bans targeted advertising to and sale of data of consumers under 18 (known or should have known). Took effect Oct 1, 2025 but does not apply to personal data processing activities before April 1, 2026.Next: Apr 1, 2027 Discretionary 60-day cure period ends · in 5 months
EnactedAlabama
Alabama Personal Data Protection Act (APDPA)Alabama's comprehensive privacy law, enacted April 2026, grants rights to confirm, correct, delete, port and opt out of targeted advertising, sale and profiling. Unusually, it does not require data protection assessments, generally excludes analytics and certain marketing disclosures from 'sale', and broadly exempts small businesses that don't sell data.Next: May 1, 2027 APDPA takes effect · in 6 months
In forceCalifornia
California SB 243 (companion chatbots)Operators of companion chatbot platforms must clearly disclose that the chatbot is AI where a user could reasonably think they are talking to a human. They must keep and publish protocols that prevent suicidal-ideation and self-harm content and refer users to crisis services. For known minors, operators must disclose AI use, remind them every three hours to take a break, and block sexually explicit content. Annual reports to the Office of Suicide Prevention begin July 1, 2027.Next: Jul 1, 2027 First annual report to Office of Suicide Prevention · in 8 months
AmendedUtah
Utah AI Policy ActMakes businesses liable under Utah consumer protection law for deceptive acts committed through generative AI. Businesses must disclose generative AI use when a consumer clearly and unequivocally asks, and must disclose it proactively in high-risk interactions and regulated-occupation services. The act created the Office of Artificial Intelligence Policy and a regulatory learning lab. In 2025, SB 226 narrowed the disclosure duties and added a safe harbor, and SB 332 moved the act's repeal date to July 1, 2027.Next: Jul 1, 2027 Scheduled repeal of Title 13, Ch. 72 · in 8 months
EnactedVermont
Vermont VDPOSANew comprehensive privacy law with low applicability thresholds, broad consumer health data provisions that apply to all businesses, an expanded sensitive data definition, profiling and automated-decision transparency, and a disclosure requirement for using personal data to train AI models. Consumers get the usual access, correction, deletion, portability and opt-out rights.Next: Jan 1, 2028 Vermont Data Privacy and Online Surveillance Act takes effect · in 14 months
In forceMinnesota
Minnesota Consumer Data Privacy Act (MCDPA)Comprehensive privacy law with distinctive rights to question the result of profiling decisions and to obtain a list of specific third parties that received the consumer's data. Requires data inventories, documented privacy policies and procedures, and data protection assessments.Next: Jul 31, 2029 Postsecondary institutions must comply · in 2.8 years
In forceArkansas
Arkansas COPPA 2.0State COPPA-style law that extends protections to teens. Operators of sites and apps directed to children or teens, or with knowledge of their age, face limits on collecting and using their personal information and on targeted advertising.In effect since Jul 1, 2026
In forceCalifornia
California AB 2013 (AI training data transparency)Developers of generative AI systems made publicly available to Californians must post documentation of the training data on their websites. It must cover a high-level summary of the datasets, their sources and owners, the number of data points, the types of data, whether the data includes copyrighted material or personal information, whether it was licensed or purchased, cleaning and processing steps, collection periods, and whether synthetic data was used.In effect since Jan 1, 2026
In forceCalifornia
California ADS employment regulationsClarifies that using an automated-decision system in hiring or other employment decisions can violate the Fair Employment and Housing Act if it discriminates on protected traits. Employers must keep automated-decision data and employment records for at least four years. AI assessments that elicit disability information can be unlawful medical inquiries.In effect since Oct 1, 2025
In forceCalifornia
California AI autonomous-harm defense banA defendant that developed, modified or used AI cannot argue in a civil case that the AI acted autonomously and so caused the harm on its own. Other defenses such as causation and comparative fault remain.In effect since Jan 1, 2026
EnactedUnverifiedCalifornia
California Senate Bill 813Establishes a framework for independent verification organizations to assess AI systems and models for compliance with state law.No date set
In forceCalifornia
California social media account deletionSocial media platforms must offer a clear and conspicuous button to delete an account and must not obstruct deletion. A request to delete an account counts as a CCPA request to delete the user's personal information.In effect since Jan 1, 2026
AmendedColorado
Colorado Privacy Act (CPA)Comprehensive privacy law giving Colorado consumers rights to access, correct, delete, port and opt out of targeted advertising, sale and certain profiling, with mandatory recognition of universal opt-out mechanisms and data protection assessments for high-risk processing. 2024 amendments added biometric identifier duties (July 1, 2025) and heightened protections for minors under 18 (Oct 1, 2025); 2025's SB 25-276 expanded precise geolocation rules and requires consent before selling sensitive data.In effect since Jul 1, 2023
In forceFlorida
Florida Digital Bill of RightsPrivacy law aimed at very large tech companies: access, correction, deletion, portability and opt-out rights (sale, targeted ads, profiling), opt-in consent for sensitive data, voice/face recognition limits, data retention schedules and protections for known children. Separately, any for-profit business that sells sensitive data must post a notice, and the sale-of-sensitive-data consent rule applies beyond the big-tech controllers.In effect since Jul 1, 2024
In forceIllinois
Illinois AI in Employment Law (HB 3773)Makes it a civil-rights violation for an employer to use AI that has the effect of discriminating against employees or applicants on the basis of a protected class in recruitment, hiring, promotion, discipline, discharge or the terms of employment. It also bars using ZIP codes as a proxy for a protected class. Employers must notify employees when they use AI for these decisions; IDHR is to set the notice rules.In effect since Jan 1, 2026
AmendedIllinois
Illinois BIPAPrivate entities must publish a biometric retention and destruction policy, give written notice, and obtain a written release before collecting biometric identifiers such as fingerprints, face geometry or voiceprints. They may not sell or profit from biometric data and need consent to disclose it. The 2024 SB 2979 amendment treats repeated collection or disclosure from the same person by the same method as a single violation and allows electronic signatures for consent. The Seventh Circuit held on April 1, 2026 that the amendment applies retroactively to pending cases.In effect since Oct 3, 2008
In forceIndiana
Indiana Consumer Data Protection Act (ICDPA)Virginia-style comprehensive privacy law granting rights to confirm, access, correct, delete, obtain a copy of, and opt out of targeted advertising, sale and profiling. Requires consent for sensitive data processing and data protection impact assessments for high-risk processing.In effect since Jan 1, 2026
In forceIowa
Iowa Consumer Data Protection Act (ICDPA)Business-friendly comprehensive privacy law giving rights to confirm, access, delete, obtain a copy of, and opt out of sale and targeted advertising (no correction right, no profiling opt-out). Sensitive data requires notice and an opt-out opportunity rather than opt-in consent.In effect since Jan 1, 2025
In forceKentucky
Kentucky Consumer Data Protection Act (KCDPA)Virginia-style comprehensive privacy law granting rights to confirm, access, correct, delete, obtain a copy of, and opt out of targeted advertising, sale and profiling. Requires opt-in consent for sensitive data and data protection assessments for high-risk processing.In effect since Jan 1, 2026
In forceLouisiana
Louisiana app store age verification lawApp stores must use age verification methods, affiliate minor accounts with a parent account and give parents consent disclosures before minors use apps. Developers have matching duties to use age and consent data and protect it.In effect since Jul 1, 2026
In forceMaryland
Maryland Kids CodeOnline products reasonably likely to be accessed by children must be designed in the best interests of children, use high-privacy defaults and avoid certain data collection and profiling. Covered entities must complete data protection impact assessments.In effect since Oct 1, 2024
AmendedMontana
Montana Consumer Data Privacy Act (MCDPA)Comprehensive privacy law with access, correction, deletion, portability and opt-out rights and mandatory recognition of opt-out preference signals. SB 297 (2025) lowered thresholds, removed the cure period, added minors' protections that apply regardless of size, and lets the AG demand data protection assessments in investigations.In effect since Oct 1, 2024
In forceNebraska
Nebraska Kids CodeCovered online services must use reasonable care to avoid harms to minors from design features, provide default privacy and safety tools, and designate a compliance officer.In effect since Jan 1, 2026
In forceNebraska
Nebraska NDPAComprehensive consumer privacy law modeled on the Texas TDPSA: consumers get access, correction, deletion, portability and opt-out rights (targeted ads, sale, profiling). Controllers must post privacy notices, obtain opt-in consent for sensitive data, honor universal opt-out signals and run data protection assessments.In effect since Jan 1, 2025
In forceNevada
Nevada consumer health data lawWashington-style consumer health data law. Regulated entities need consent to collect and share consumer health data, must publish a health data privacy policy, honor access and deletion rights, and cannot geofence health care facilities. Selling consumer health data needs written authorization.In effect since Mar 31, 2024
AmendedNew Jersey
New Jersey NJDPAComprehensive consumer privacy law with access, correction, deletion, portability and opt-out rights, opt-in consent for sensitive data, consent for targeted advertising/sale/profiling of known 13-17 year olds, universal opt-out signal support and data protection assessments. It has no revenue-share floor for the smaller threshold, and the Division of Consumer Affairs has rulemaking authority. A June 2026 law (A5328) bans selling sensitive data and creates a data broker registry.In effect since Jan 15, 2025
In forceNew York
NY Algorithmic Pricing Disclosure ActAny business that sets a price using personalized algorithmic pricing must show the disclosure 'THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA' next to the price. Insurers, GLBA financial institutions and certain subscription prices are exempt.In effect since Nov 10, 2025
In forceNew York
NY Child Data Protection ActOnline operators may not collect, use, share or sell personal data of users under 18 unless it is strictly necessary for the service or they obtain informed consent. It covers sites and apps directed to minors or with actual knowledge that a user is a minor.In effect since Jun 20, 2025
In forceNew York City, New York
NYC Local Law 144 (AEDT)Employers and employment agencies may not use an automated employment decision tool (AEDT) to screen candidates or employees for hiring or promotion unless the tool has had an independent bias audit within the past year. They must publish a summary of the audit results and give candidates at least 10 business days' notice that an AEDT will be used.In effect since Jul 5, 2023
AmendedNew York
NYDFS Cybersecurity Regulation (Part 500)DFS-licensed financial companies must keep a risk-based cybersecurity program, CISO, policies, access controls, MFA, encryption, an asset inventory, and incident response and business continuity plans. They must notify DFS within 72 hours of a cybersecurity event and within 24 hours of any extortion payment, and certify compliance or acknowledge non-compliance each April 15. The 2023 Second Amendment added governance duties, Class A company requirements and phased controls through November 1, 2025.In effect since Mar 1, 2017
AmendedOregon
Oregon OCPAComprehensive consumer privacy law with access (including a list of specific third parties data was shared with), correction, deletion, portability and opt-out rights, opt-in consent for sensitive data, universal opt-out signals and data protection assessments. Unusually, it covers nonprofits. 2025 amendments ban selling precise geolocation data and data of consumers under 16, and bring all motor vehicle manufacturers into scope.In effect since Jul 1, 2024
In forceRhode Island
Rhode Island RIDTPPAComprehensive consumer privacy law giving access, correction, deletion, portability and opt-out rights, requiring opt-in consent for sensitive data and data protection assessments. A notable extra: any commercial website or ISP that sells personally identifiable information must disclose the categories collected and every third party it has sold or may sell data to, whatever its size.In effect since Jan 1, 2026
In forceTennessee
Tennessee ELVIS ActReplaces the Personal Rights Protection Act of 1984 and adds voice to the protected property right in name, photograph and likeness. It targets unauthorized AI voice clones and deepfakes, including liability for distributing tools whose primary purpose is producing unauthorized voice or likeness.In effect since Jul 1, 2024
In forceTennessee
Tennessee TIPAComprehensive consumer privacy law with access, correction, deletion, portability and opt-out rights (sale, targeted ads, profiling), opt-in consent for sensitive data and data protection assessments. Controllers must keep a written privacy program that reasonably conforms to the NIST Privacy Framework, which also serves as an affirmative defense.In effect since Jul 1, 2025
EnactedTexas
Texas App Store Accountability ActApp stores must verify user ages, link minor accounts to a parent and obtain parental consent before minors download or buy apps. Developers must use the app store's age and consent signals. A federal court has preliminarily enjoined enforcement.In effect since Jan 1, 2026
In forceTexas
Texas TDPSAComprehensive consumer privacy law with access, correction, deletion, portability and opt-out rights, opt-in consent for sensitive data, data protection assessments and a universal opt-out signal requirement. Scope turns on the SBA small-business definition instead of consumer-count thresholds, so it reaches most non-small businesses.In effect since Jul 1, 2024
In forceTexas
TRAIGABans developing or deploying AI with the intent to incite self-harm or crime, to unlawfully discriminate against a protected class, to produce child sexual abuse material or unlawful sexual deepfakes, or to infringe constitutional rights. Government agencies must also disclose AI use and may not use it for social scoring or biometric identification without consent. Creates a Texas AI regulatory sandbox, where approved participants can test systems for up to 36 months, and a Texas AI Council. Liability generally turns on intent, not disparate impact alone.In effect since Jan 1, 2026
AmendedVirginia
Virginia VCDPAThe second US comprehensive state privacy law: access, correction, deletion, portability and opt-out rights (targeted ads, sale, profiling), opt-in consent for sensitive data and data protection assessments. SB 854 (2025) added a 1-hour-per-day default social media limit for users under 16, effective Jan 1, 2026, but a federal court has preliminarily enjoined it. SB 338 (2026) bans selling precise geolocation data from July 1, 2026.In effect since Jan 1, 2023
In forceWashington
Washington My Health My Data ActRegulated entities must publish a consumer health data privacy policy linked from their homepage and get opt-in consent to collect or share consumer health data. Selling it requires a signed authorization. Consumers get rights to access, delete and withdraw consent. Geofencing within 2,000 feet of health care facilities is banned. 'Consumer health data' is defined broadly and includes inferences from non-health data.In effect since Mar 31, 2024

Upcoming deadlines

EnforcementDec 31 · in 2 months
Utah App Store Accountability ActPrivate right of action beginsSection 13-75-401 takes effect.Utah
Takes effectJan 1, 2027 · in 2 months
California AI Auditor RegistryAct takes effectDefault effective date for 2026 regular-session statutes.California
ComplianceJan 1, 2027 · in 2 months
California AI Transparency Act (SB 942)Large online platform and hosting platform dutiesLarge online platforms and GenAI hosting platforms must meet the provenance duties added by AB 853.California
Takes effectJan 1, 2027 · in 2 months
California Digital Age Assurance ActAge signal duties beginOS providers must offer the age interface at account setup and developers must request signals.California
ReportingJan 1, 2027 · in 2 months
California SB 53 (TFAIA)First OES anonymized incident report and CDT definition reviewOES begins publishing annual anonymized incident summaries and the Department of Technology begins annual review of the act's definitions; the CalCompute framework report is due to the Legislature.California
ComplianceJan 1, 2027 · in 2 months
California SB 976 addictive feedsAge assurance duty and AG rulesOperators must reasonably determine users are not minors; AG regulations on age assurance and parental consent due.California
ComplianceJan 1, 2027 · in 2 months
CCPA / CPRAADMT requirements compliance dateBusinesses using ADMT for significant decisions must comply with Article 11 (pre-use notice, opt-out, access rights) by this date (11 CCR 7200(b)).California
ComplianceJan 1, 2027 · in 2 months
CCPA / CPRABrowsers must support opt-out preference signal (AB 566)Businesses that develop or maintain a browser must include consumer-configurable functionality to send an opt-out preference signal (Civ. Code 1798.136, operative Jan 1, 2027).California
Takes effectJan 1, 2027 · in 2 months
Colorado AI ActADMT obligations applyDeveloper documentation, consumer notices, post-adverse-outcome disclosure, correction and human-review rights take effect.Colorado
ComplianceJan 1, 2027 · in 2 months
Colorado AI ActAG rules dueAttorney General must adopt rules clarifying the post-adverse-outcome disclosure requirements.Colorado
ComplianceJan 1, 2027 · in 2 months
Connecticut Data Privacy Act (CTDPA)Data broker registration requiredData brokers may not sell or license brokered personal data in Connecticut unless registered with the Department of Consumer Protection ($2,500 initial fee).Connecticut
Takes effectJan 1, 2027 · in 2 months
Delaware Personal Data Privacy Act (DPDPA)Amended thresholds and third-party duties take effectApplicability drops to 10,000 consumers (or 5,000 + 20% revenue from sale) and new third-party duties (12D-107A) apply.Delaware
Takes effectJan 1, 2027 · in 2 months
Louisiana Data Privacy ActLouisiana Data Privacy Act takes effectConsumer rights and controller duties apply (Act 502, Section 2); data protection assessment requirements apply to processing from this date.Louisiana
Takes effectJan 1, 2027 · in 2 months
New Hampshire Privacy ActBan on selling personal data of children under 13 (HB 1460)HB 1460 (2026, ch. 168) prohibits controllers from selling the personal data of a child under 13.New Hampshire
Takes effectJan 1, 2027 · in 2 months
NY RAISE ActRAISE Act takes effectTransparency reports, frontier AI frameworks, incident reporting and DFS disclosure filings apply.New York
Takes effectJan 1, 2027 · in 2 months
Oklahoma OKCDPAOklahoma Consumer Data Privacy Act takes effectAll OKCDPA obligations and consumer rights apply.Oklahoma
Takes effectJan 1, 2027 · in 2 months
Utah UCPAUCPA extends to motor vehicle manufacturersMotor vehicle manufacturers whose vehicles are sold or leased in Utah and that collect personal data through vehicle data systems are covered regardless of the revenue and consumer thresholds (13-61-102, as amended by Laws 2026, ch. 193).Utah
Takes effectJan 1, 2027 · in 2 months
Vermont Kids CodeTakes effect9 V.S.A. sections 2449a to 2449j effective.Vermont
Takes effectJan 25, 2027 · in 3 months
NY SAFE for Kids ActAct and rules take effect180 days after State Register publication.New York
ReportingJan 31, 2027 · in 3 months
California Delete Act / DROPAnnual data broker registration deadlineData brokers must renew registration with CalPrivacy by January 31 following each year they meet the definition.California
EnforcementApr 1, 2027 · in 5 months
Maryland Online Data Privacy Act (MODPA)Discretionary 60-day cure period endsThe Division's discretionary notice-and-cure (at least 60 days) applies only to violations occurring on or before April 1, 2027 (Com. Law 14-4614).Maryland
Takes effectMay 1, 2027 · in 6 months
Alabama Personal Data Protection Act (APDPA)APDPA takes effectConsumer rights and controller/processor obligations apply (HB 351 section 12).Alabama
ComplianceJul 1, 2027 · in 8 months
California Digital Age Assurance ActDeadline for existing devices and appsOS providers must offer the age interface for accounts set up before 2027, and developers must request signals for earlier installs.California
ReportingJul 1, 2027 · in 8 months
California SB 243 (companion chatbots)First annual report to Office of Suicide PreventionOperators begin annual reporting on crisis referrals and detection protocols.California
SunsetJul 1, 2027 · in 8 months
Utah AI Policy ActScheduled repeal of Title 13, Ch. 72SB 332 extends the AI Policy Act repeal date from May 1, 2025 to July 1, 2027.Utah
EnforcementJul 31, 2027 · in 9 months
Louisiana Data Privacy Act30-day cure period expiresAG's obligation to give 30-day notice and allow cure before investigating applies only from Jan 1 through July 31, 2027 (R.S. 51:1780.5(D)).Louisiana
ComplianceDec 31, 2027 · in 14 months
CCPA / CPRARisk assessments for pre-existing processing dueRisk assessments must be completed and documented for high-risk processing that began before Jan 1, 2026 and continues after (11 CCR 7155(b)).California
ComplianceJan 1, 2028 · in 14 months
California AI Transparency Act (SB 942)Capture device manufacturer dutiesCapture device manufacturer provenance requirements become operative.California
ComplianceJan 1, 2028 · in 14 months
California Delete Act / DROPIndependent third-party audits beginBeginning Jan 1, 2028 and every 3 years thereafter, data brokers must undergo an independent audit of Delete Act compliance.California
Takes effectJan 1, 2028 · in 14 months
Vermont VDPOSAVermont Data Privacy and Online Surveillance Act takes effectAll obligations under Act 145 apply (sec. 4).Vermont
ReportingApr 1, 2028 · in 17 months
CCPA / CPRAFirst risk assessment submission to CPPABusinesses must submit required risk assessment information and attestation for assessments conducted in 2026 and 2027 (11 CCR 7157(a)(1)); annually by April 1 thereafter.California
ReportingApr 1, 2028 · in 17 months
CCPA / CPRACybersecurity audit due: revenue over $100MFirst cybersecurity audit report (covering Jan 1, 2027 - Jan 1, 2028) and certification due for businesses with 2026 annual gross revenue over $100M (11 CCR 7121(a)(1)).California
ComplianceOct 1, 2028 · in 23 months
Connecticut Data Privacy Act (CTDPA)Data brokers must process state deletion mechanism requestsRegistered data brokers must access the DCP accessible deletion mechanism at least every 45 days and process deletion requests.Connecticut
ComplianceJan 1, 2029 · in 2.2 years
California AI Auditor RegistryRegistry opens and registration requiredAgency must launch the AI Auditor Registry; unregistered persons may not offer or conduct covered AI audits.California
ReportingApr 1, 2029 · in 2.4 years
CCPA / CPRACybersecurity audit due: revenue $50M-$100MFirst cybersecurity audit report (covering 2028) due for businesses with 2027 annual gross revenue between $50M and $100M (11 CCR 7121(a)(2)).California
EnforcementJun 30, 2029 · in 2.7 years
Vermont VDPOSAMandatory 60-day cure period expiresThe AG's duty to issue a cure notice before enforcement ends June 30, 2029 (Act 145 sec. 3).Vermont
ComplianceJul 31, 2029 · in 2.8 years
Minnesota Consumer Data Privacy Act (MCDPA)Postsecondary institutions must complyPostsecondary institutions regulated by the Office of Higher Education must comply by July 31, 2029.Minnesota
SunsetJan 1, 2030 · in 3.2 years
Colorado AI ActMandatory cure period endsThe AG's obligation to offer a 60-day notice-and-cure period expires.Colorado
ReportingApr 1, 2030 · in 3.4 years
CCPA / CPRACybersecurity audit due: revenue under $50MFirst cybersecurity audit report (covering 2029) due for covered businesses with 2028 annual gross revenue under $50M (11 CCR 7121(a)(3)); annual by April 1 thereafter.California

Past deadlines

Takes effectOct 1 · 26 days ago
Connecticut Data Privacy Act (CTDPA)PA 26-64 (SB 4) amendments take effectProhibits controllers and third parties from selling precise geolocation data and enacts data broker and other consumer protection provisions.Connecticut
MilestoneUnverifiedSep 9 · 48 days ago
California Senate Bill 813Signed by GovernorGovernor Gavin Newsom signed Senate Bill 813, establishing a framework for independent verification organizations to assess AI systems and models for compliance with state law.California
MilestoneSep 9 · 48 days ago
California AI Auditor RegistrySigned by GovernorChaptered as Chapter 178, Statutes of 2026.California
Takes effectAug 2 · 3 months ago
California AI Transparency Act (SB 942)Covered provider duties applyDetection tool, manifest and latent disclosures, and license-revocation duties become operative.California
ComplianceAug 1 · 3 months ago
Connecticut Data Privacy Act (CTDPA)Profiling impact assessments applyImpact assessment requirements apply to profiling activities created or generated on or after Aug 1, 2026 (Conn. Gen. Stat. 42-522 as amended).Connecticut
ComplianceAug 1 · 3 months ago
California Delete Act / DROPData brokers must begin processing DROP deletion requestsBrokers must access DROP at least every 45 days, process verified deletion requests within 45 days, and treat unverified requests as opt-outs of sale/sharing.California
MilestoneJul 29 · 3 months ago
NY SAFE for Kids ActRules published in State RegisterStarts the 180-day clock.New York
Transition endsJul 28 · 3 months ago
NY SAFE for Kids ActFinal SAFE for Kids rules releasedAG releases final 13 NYCRR Part 700 rules.New York
Takes effectJul 1 · 4 months ago
Virginia VCDPABan on selling precise geolocation data (SB 338)Controllers may not sell consumers' precise geolocation data (1,750-ft radius), replacing the prior consent-based treatment.Virginia
Takes effectJul 1 · 4 months ago
Utah UCPARight to correct takes effectConsumers may ask controllers to correct inaccurate personal data (13-61-201(4), as amended by Laws 2025, ch. 468).Utah
EnforcementJul 1 · 4 months ago
New Jersey NJDPAMandatory 30-day cure period expiresThe Division's duty to issue a cure notice before enforcement ends on the first day of the 18th month after the effective date (N.J.S.A. 56:8-166.17(b)).New Jersey
EnforcementJul 1 · 4 months ago
Nebraska Kids CodeCivil penalties availableAG may begin actions to recover civil penalties.Nebraska
Takes effectJul 1 · 4 months ago
Louisiana app store age verification lawTakes effectSection 5: act effective July 1, 2026.Louisiana
Takes effectJul 1 · 4 months ago
Connecticut Data Privacy Act (CTDPA)PA 25-113 (SB 1295) amendments take effectThresholds drop to 35,000 consumers or any sensitive-data processing or data sale; expanded sensitive data, minors' protections, and LLM-training disclosure in privacy notices.Connecticut
Takes effectJul 1 · 4 months ago
Arkansas COPPA 2.0Takes effectSection 3: effective on and after July 1, 2026.Arkansas
Takes effectJun 30 · 4 months ago
New Jersey NJDPAA5328 sensitive data sale ban takes effectA5328, signed June 30, 2026, prohibits selling sensitive personal data; the ban took effect on signing.New Jersey
Transition endsJun 30 · 4 months ago
Colorado AI ActDelayed effective date (superseded)SB 25B-004 date; superseded by SB 26-189 before it arrived, so no obligations applied.Colorado
MilestoneJun 2 · 5 months ago
Illinois AI in Employment Law (HB 3773)IDHR withdraws and postpones proposed rulesIDHR withdraws the Subpart J proposal and postpones the June 10, 2026 hearing; no new date announced.Illinois
MilestoneMay 15 · 5 months ago
Illinois AI in Employment Law (HB 3773)IDHR proposed notice rules publishedIDHR publishes proposed Subpart J rules on AI notice in the Illinois Register.Illinois
MilestoneMay 14 · 5 months ago
Colorado AI ActSB 26-189 signed (repeal and reenact)SB 26-189 replaces SB 24-205 with a narrower ADMT disclosure framework and moves the effective date to January 1, 2027.Colorado
ComplianceMay 6 · 6 months ago
Utah App Store Accountability ActApp store and developer duties applySections 13-75-201 and 13-75-202 take effect.Utah
EnforcementMay 6 · 6 months ago
Texas App Store Accountability ActStay pending appeal deniedDistrict court keeps the injunction in place during the state's appeal.Texas
ReportingApr 15 · 6 months ago
NYDFS Cybersecurity Regulation (Part 500)Annual compliance notificationAnnual certification or acknowledgment covering calendar year 2025 due.New York
ComplianceApr 1 · 7 months ago
Maryland Online Data Privacy Act (MODPA)MODPA applies to personal data processingThe act applies to personal data processing activities from April 1, 2026 (Section 2 of ch. 455).Maryland
ComplianceApr 1 · 7 months ago
Maryland Kids CodeData protection impact assessments dueCovered entities must complete DPIAs by this date.Maryland
Transition endsApr 1 · 7 months ago
Illinois BIPASeventh Circuit: amendment applies retroactivelyClay v. Union Pacific (No. 25-2185) holds the damages amendment is remedial and applies to pending cases.Illinois
MilestoneMar 27 · 7 months ago
NY RAISE ActChapter amendment S8828 signedChapter amendment (ch. 96) finalizes the RAISE Act text.New York
MilestoneFeb 27 · 8 months ago
Virginia VCDPASB 854 preliminarily enjoined (NetChoice v. Jones)E.D. Va. preliminarily enjoined enforcement of the SB 854 social media time-limit provisions on First Amendment grounds; Virginia has appealed.Virginia
Transition endsFeb 1 · 9 months ago
Colorado AI ActOriginal effective date (superseded)Original SB 24-205 date; postponed by SB 25B-004, so no obligations applied.Colorado
EnforcementJan 31 · 9 months ago
Minnesota Consumer Data Privacy Act (MCDPA)30-day cure period expiresThe requirement that the AG send a warning letter and allow 30 days to cure before suing expires Jan 31, 2026 (325M.20(a)).Minnesota
ReportingJan 31 · 9 months ago
California Delete Act / DROPAnnual data broker registration deadlineData brokers must register with CalPrivacy and pay the annual fee ($6,000 for 2026) by January 31.California
Takes effectJan 1 · 10 months ago
Virginia VCDPAUnder-16 social media time limit (SB 854) takes effectSocial media platforms must use commercially reasonable age determination and cap users under 16 at 1 hour/day unless a parent consents. A preliminary injunction issued Feb 27, 2026 bars enforcement.Virginia
Takes effectJan 1 · 10 months ago
TRAIGATRAIGA takes effectProhibited-practice rules, AG enforcement, sandbox program and government AI disclosure duties apply.Texas
Takes effectJan 1 · 10 months ago
Texas App Store Accountability ActScheduled effective date (enjoined)Statutory effective date; not enforceable while the injunction stands.Texas
Takes effectJan 1 · 10 months ago
Rhode Island RIDTPPARIDTPPA takes effectAll provisions of R.I. Gen. Laws ch. 6-48.1 apply (P.L. 2024, ch. 430/453, effective Jan 1, 2026).Rhode Island
Takes effectJan 1 · 10 months ago
Oregon OCPASale ban on precise geolocation and under-16 data (HB 2008)Selling precise geolocation (1,750-ft radius) and the personal data of consumers the controller knows or willfully disregards are under 16 is prohibited.Oregon
ComplianceJan 1 · 10 months ago
Oregon OCPAUniversal opt-out signals must be honoredControllers must honor opt-out preference signals such as Global Privacy Control.Oregon
EnforcementJan 1 · 10 months ago
Oregon OCPACure period sunsetsThe AG's 30-day notice-and-cure requirement expires; enforcement can proceed without a cure opportunity.Oregon
EnforcementJan 1 · 10 months ago
New Hampshire Privacy ActMandatory 60-day cure period expiresThe AG's obligation to issue a cure notice ended Dec 31, 2025; from Jan 1, 2026 cure opportunities are discretionary (RSA 507-H:11 II-III).New Hampshire
Takes effectJan 1 · 10 months ago
Nebraska Kids CodeOperative dateAct becomes operative.Nebraska