Skip to content

US state privacy laws and effective dates

Every state comprehensive consumer privacy law, plus state AI, biometric, health data and cybersecurity laws.

FewerMore laws

29 states with tracked laws. Tap one to open it.

State privacy law effective dates

StateLawEffective
IllinoisIllinois BIPAOct 3, 2008
CaliforniaCCPA / CPRAJan 1, 2020
VirginiaVirginia VCDPAJan 1, 2023
ColoradoColorado Privacy Act (CPA)Jul 1, 2023
ConnecticutConnecticut Data Privacy Act (CTDPA)Jul 1, 2023
UtahUtah UCPADec 31, 2023
CaliforniaCalifornia Delete Act / DROPJan 1, 2024
NevadaNevada consumer health data lawMar 31, 2024
WashingtonWashington My Health My Data ActMar 31, 2024
FloridaFlorida Digital Bill of RightsJul 1, 2024
OregonOregon OCPAJul 1, 2024
TennesseeTennessee ELVIS ActJul 1, 2024
TexasTexas TDPSAJul 1, 2024
MarylandMaryland Kids CodeOct 1, 2024
MontanaMontana Consumer Data Privacy Act (MCDPA)Oct 1, 2024
DelawareDelaware Personal Data Privacy Act (DPDPA)Jan 1, 2025
IowaIowa Consumer Data Protection Act (ICDPA)Jan 1, 2025
NebraskaNebraska NDPAJan 1, 2025
New HampshireNew Hampshire Privacy ActJan 1, 2025
New JerseyNew Jersey NJDPAJan 15, 2025
UtahUtah App Store Accountability ActMay 7, 2025
New YorkNY Child Data Protection ActJun 20, 2025
TennesseeTennessee TIPAJul 1, 2025
MinnesotaMinnesota Consumer Data Privacy Act (MCDPA)Jul 31, 2025
MarylandMaryland Online Data Privacy Act (MODPA)Oct 1, 2025
New YorkNY Algorithmic Pricing Disclosure ActNov 10, 2025
CaliforniaCalifornia AB 2013 (AI training data transparency)Jan 1, 2026
CaliforniaCalifornia social media account deletionJan 1, 2026
IndianaIndiana Consumer Data Protection Act (ICDPA)Jan 1, 2026
KentuckyKentucky Consumer Data Protection Act (KCDPA)Jan 1, 2026
NebraskaNebraska Kids CodeJan 1, 2026
Rhode IslandRhode Island RIDTPPAJan 1, 2026
TexasTexas App Store Accountability ActJan 1, 2026
ArkansasArkansas COPPA 2.0Jul 1, 2026
LouisianaLouisiana app store age verification lawJul 1, 2026
CaliforniaCalifornia Digital Age Assurance ActJan 1, 2027
ColoradoColorado AI ActJan 1, 2027
LouisianaLouisiana Data Privacy ActJan 1, 2027
OklahomaOklahoma OKCDPAJan 1, 2027
VermontVermont Kids CodeJan 1, 2027
AlabamaAlabama Personal Data Protection Act (APDPA)May 1, 2027
VermontVermont VDPOSAJan 1, 2028

56 of 56 regulations

Upcoming deadlines

DateRegulation
in 5 daysCTDPA

PA 26-64 (SB 4) amendments take effect

in 3 monthsUtah App Store Accountability Act

Private right of action begins

in 3 monthsCalifornia AI Auditor Registry

Act takes effect

in 3 monthsCA SB 942

Large online platform and hosting platform duties

in 3 monthsCalifornia Digital Age Assurance Act

Age signal duties begin

in 3 monthsCA SB 53

First OES anonymized incident report and CDT definition review

in 3 monthsCalifornia SB 976 addictive feeds

Age assurance duty and AG rules

in 3 monthsCCPA / CPRA

ADMT requirements compliance date

in 3 monthsCCPA / CPRA

Browsers must support opt-out preference signal (AB 566)

in 3 monthsColorado AI Act

ADMT obligations apply

in 3 monthsColorado AI Act

AG rules due

in 3 monthsCTDPA

Data broker registration required

in 3 monthsDelaware DPDPA

Amended thresholds and third-party duties take effect

in 3 monthsLouisiana LDPA

Louisiana Data Privacy Act takes effect

in 3 monthsNH Privacy Act

Ban on selling personal data of children under 13 (HB 1460)

in 3 monthsNY RAISE Act

RAISE Act takes effect

in 3 monthsOKCDPA

Oklahoma Consumer Data Privacy Act takes effect

in 3 monthsUtah UCPA

UCPA extends to motor vehicle manufacturers

in 3 monthsVermont Kids Code

Takes effect

in 4 monthsNY SAFE for Kids Act

Act and rules take effect

in 4 monthsCA Delete Act

Annual data broker registration deadline

in 6 monthsMaryland MODPA

Discretionary 60-day cure period ends

in 7 monthsAlabama APDPA

APDPA takes effect

in 9 monthsCalifornia Digital Age Assurance Act

Deadline for existing devices and apps

in 9 monthsCA SB 243

First annual report to Office of Suicide Prevention

in 9 monthsUtah AIPA

Scheduled repeal of Title 13, Ch. 72

in 10 monthsLouisiana LDPA

30-day cure period expires

in 1 yearCCPA / CPRA

Risk assessments for pre-existing processing due

in 1 yearCA SB 942

Capture device manufacturer duties

in 1 yearCA Delete Act

Independent third-party audits begin

in 1 yearVermont VDPOSA

Vermont Data Privacy and Online Surveillance Act takes effect

in 1 yearCCPA / CPRA

First risk assessment submission to CPPA

in 1 yearCCPA / CPRA

Cybersecurity audit due: revenue over $100M

in 2 yearsCTDPA

Data brokers must process state deletion mechanism requests

in 2 yearsCalifornia AI Auditor Registry

Registry opens and registration required

in 2 yearsCCPA / CPRA

Cybersecurity audit due: revenue $50M-$100M

in 2 yearsVermont VDPOSA

Mandatory 60-day cure period expires

in 2 yearsMinnesota MCDPA

Postsecondary institutions must comply

in 3 yearsColorado AI Act

Mandatory cure period ends

in 3 yearsCCPA / CPRA

Cybersecurity audit due: revenue under $50M

Past deadlines

DateRegulation
2 weeks agoCalifornia AI Auditor Registry

Signed by Governor

7 weeks agoCA SB 942

Covered provider duties apply

8 weeks agoCTDPA

Profiling impact assessments apply

8 weeks agoCA Delete Act

Data brokers must begin processing DROP deletion requests

8 weeks agoNY SAFE for Kids Act

Rules published in State Register

2 months agoNY SAFE for Kids Act

Final SAFE for Kids rules released

2 months agoVirginia VCDPA

Ban on selling precise geolocation data (SB 338)

2 months agoUtah UCPA

Right to correct takes effect

2 months agoNJDPA

Mandatory 30-day cure period expires

2 months agoNebraska Kids Code

Civil penalties available

2 months agoLouisiana app store age verification law

Takes effect

2 months agoCTDPA

PA 25-113 (SB 1295) amendments take effect

2 months agoArkansas COPPA 2.0

Takes effect

2 months agoNJDPA

A5328 sensitive data sale ban takes effect

2 months agoColorado AI Act

Delayed effective date (superseded)

3 months agoIllinois HB 3773

IDHR withdraws and postpones proposed rules

4 months agoIllinois HB 3773

IDHR proposed notice rules published

4 months agoColorado AI Act

SB 26-189 signed (repeal and reenact)

4 months agoUtah App Store Accountability Act

App store and developer duties apply

4 months agoTexas App Store Accountability Act

Stay pending appeal denied

5 months agoNYDFS Part 500

Annual compliance notification

5 months agoMaryland MODPA

MODPA applies to personal data processing

5 months agoMaryland Kids Code

Data protection impact assessments due

5 months agoIllinois BIPA

Seventh Circuit: amendment applies retroactively

6 months agoNY RAISE Act

Chapter amendment S8828 signed

7 months agoVirginia VCDPA

SB 854 preliminarily enjoined (NetChoice v. Jones)

7 months agoColorado AI Act

Original effective date (superseded)

7 months agoMinnesota MCDPA

30-day cure period expires

7 months agoCA Delete Act

Annual data broker registration deadline

8 months agoVirginia VCDPA

Under-16 social media time limit (SB 854) takes effect

8 months agoTRAIGA

TRAIGA takes effect

8 months agoTexas App Store Accountability Act

Scheduled effective date (enjoined)

8 months agoRIDTPPA

RIDTPPA takes effect

8 months agoOregon OCPA

Sale ban on precise geolocation and under-16 data (HB 2008)

8 months agoOregon OCPA

Universal opt-out signals must be honored

8 months agoOregon OCPA

Cure period sunsets

8 months agoNH Privacy Act

Mandatory 60-day cure period expires

8 months agoNebraska Kids Code

Operative date

8 months agoKentucky KCDPA

KCDPA takes effect

8 months agoIndiana ICDPA

ICDPA takes effect

Rule changes by email

The morning after a new data, privacy or AI law, or a deadline change; nothing in quiet weeks.

Double opt-in. Unsubscribe any time.