State rankings

Privacy Laws by State

Indiana has the highest Effective Date (2026), followed by Kentucky (2026) and Rhode Island (2026). Utah has the lowest (2023).

Law50 states · 3 metricsUpdated Mar 27, 2025Original page
2 sources
Effective DateBetter directionWhether a higher or a lower value is better. A green arrow means higher is better, a red arrow means lower is better, and no arrow means neither.More in the glossary →
20 of 51 states
Compare this metricAdd to combined rankingOpen full map

Effective Date

Darker means higher. Click a place to highlight it.

Loading map…

All 20 ranked

Highest first.

Distribution Median and middle halfThe median is the middle value: half of places are above it, half below. The middle half is the range holding the central 50% of places.More in the glossary →

Each dot is one state; the lines mark the median and the middle half.

Median
2025
Middle half 2024 – 2025
Average
2024
20 states
Highest
2026
Indiana
Lowest
2023
Utah

Data

Click a column to sort, a row to highlight that place on the charts.

50 states · # = rank by Effective Date
#
1IndianaComprehensive privacy laws2026The Indiana Consumer Data Protection Act will regulate businesses that process the personal data of at least 100,000 Indiana residents, or ones that handle the information of at least 25,000 state consumers but derive more than 50% of their revenue from selling data.
1KentuckyComprehensive privacy laws2026The Kentucky Consumer Data Act (KCDPA) applies to entities that conduct business in the state or target residents and manage the personal data of at least 100,000 consumers per year. That threshold drops to 25,000 consumers if a business derives more than half its gross revenu…
1Rhode IslandComprehensive privacy laws2026Consumers will have the right to confirm what data a company collects, correct it, receive a copy, and opt out of certain uses. Companies must also secure consent before processing sensitive data.
4New JerseyComprehensive privacy laws2025The New Jersey Data Privacy Act (NJDPA) provides New Jersey residents with comprehensive privacy protections against how companies collect and use their personal information. The law applies to entities that do business in the state and handle the personal data of at least 100…
4TennesseeComprehensive privacy laws2025Backed with bipartisan support, the Tennessee Information Protection Act enables consumers to confirm that a business has collected their personal data, obtain a copy of the information, and request that inaccuracies be corrected
4MarylandComprehensive privacy laws2025Maryland’s law applies to companies that handle the personal data of at least 35,000 residents per year, or 10,000 residents if more than 20% of the company’s revenue comes from selling personal data. Children will receive heightened data privacy protections, as will sensitive…
4MinnesotaComprehensive privacy laws2025The law cover companies that handle the personal data of at least 100,000 Minnesota consumers each year. That threshold will drop to 25,000 consumers if the company makes more than a quarter of its revenue from selling personal data. Companies that fall under the federal defin…
4IowaComprehensive privacy laws2025Data Protection Act (ICDPA), is considered one of the most business-friendly so far, which privacy advocates say results in weaker data protections. Slated to go in effect Jan. 1, 2025, Iowa’s law does not grant consumers the right to delete or correct data collected by third …
4NebraskaComprehensive privacy laws2025The Nebraska Data Privacy Act (NDPA) applies to companies that do business in the state or target its residents and also process or sell personal data. The law excludes federally defined small businesses and includes numerous exemptions, such as for federally regulated financi…
4New HampshireComprehensive privacy laws2025The New Hampshire Privacy Act (NHPA) will apply to companies that handle the data of at least 35,000 state residents a year, or 10,000 if more than a quarter of their gross revenue comes from selling personal data. Consumers will have the right to know what data a company coll…
4DelawareComprehensive privacy laws2025Delaware Personal Data Privacy Act has stronger privacy rights for consumers, such as heightening protections for children’s data, broadening definitions of sensitive data, and being able to opt out of the processing of personal data for targeted advertising purposes.
12TexasComprehensive privacy laws2024Texas Data Privacy and Security Act (TDPSA) will apply to large companies that do business in Texas or sell, collect, or process personal data. Small businesses will mostly be exempt.
12FloridaComprehensive privacy laws2024The Sunshine State tackles issues related to tech platforms, like addressing alleged censorship of conservative viewpoints. The law requires search engines, such as Google, to disclose if they prioritize results based on political ideology and prohibits government-mandated con…
12OregonComprehensive privacy laws2024One of the strongest data privacy laws passed to date, the Oregon Consumer Privacy Act (OCPA) includes provisions on biometric data, sensitive and personal data, and children’s data protections, and it doesn't have the same exemptions found in other state privacy laws.
12MontanaComprehensive privacy laws2024Montana’s Consumer Data Privacy Act limits the collection of personal data to only “adequate, relevant, and reasonably necessary” information. Residents have the right to opt-out or decline the sale of their personal data.
16CaliforniaComprehensive privacy laws2023California led the charge in being the first state to enact comprehensive data privacy legislation via the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). CCPA, signed into law on June 8, 2018, and which went into effect on Jan. 1, 2020, es…
16VirginiaComprehensive privacy laws2023The law gives Virginians the right to access their data and request that their personal information be deleted by businesses. It also requires companies to conduct data protection assessments to process personal data for targeted advertising and sales purposes.
16ColoradoComprehensive privacy laws2023The Colorado Privacy Act (CPA), effective July 1, 2023, grants Colorado consumers five key rights related to their personal data: access, correction, deletion, data portability, and the ability to opt out. It protects information that can identify an individual, excluding de-i…
16ConnecticutComprehensive privacy laws2023The Connecticut Data Privacy Act (CTDPA), effective as of July 1, 2023, includes stronger data protections for children but a similar framework as its predecessors.
16UtahComprehensive privacy laws2023On March 24, 2022, Utah became the fourth state to pass comprehensive data legislation.
—New YorkNarrow Privacy Law——
—PennsylvaniaOther Applicable Law——
—IllinoisOther Applicable Law——
—OhioOther Applicable Law——
—GeorgiaOther Applicable Law——
—North CarolinaOther Applicable Law——
—MichiganNarrow Privacy Law——
—WashingtonNarrow Privacy Law——
—ArizonaOther Applicable Law——
—MassachusettsOther Applicable Law——
—MissouriOther Applicable Law——
—WisconsinOther Applicable Law——
—South CarolinaOther Applicable Law——
—AlabamaOther Applicable Law——
—LouisianaOther Applicable Law——
—OklahomaOther Applicable Law——
—NevadaNarrow Privacy Law——
—ArkansasOther Applicable Law——
—KansasOther Applicable Law——
—MississippiOther Applicable Law——
—New MexicoOther Applicable Law——
—IdahoOther Applicable Law——
—West VirginiaOther Applicable Law——
—HawaiiOther Applicable Law——
—MaineNarrow Privacy Law——
—South DakotaOther Applicable Law——
—North DakotaOther Applicable Law——
—AlaskaOther Applicable Law——
—VermontNarrow Privacy Law——
—WyomingOther Applicable Law——

What correlates with Effective Date?

Pearson r against 2,127 other state metrics sharing at least 12 states. Correlation is not causation.

Higher together

Places that have a higher Effective Date tend to score higher on these

  1. % of Pop. with High School Diploma or EquivalentMost Educated U.S. States
    r = +0.73 · very strong · n = 20
    Plot
  2. Annual Mean WageDentist Salary by State
    r = +0.68 · strong · n = 16
    Plot
  3. Hourly Mean WageDentist Salary by State
    r = +0.68 · strong · n = 16
    Plot
  4. Cancer Rate New Cases 2018 to 2022Cancer Rates by State
    r = +0.67 · strong · n = 20
    Plot
  5. Ratio of Funding to Income Taxes PaidFederal Aid by State
    r = +0.66 · strong · n = 20
    Plot
  6. Cardiovascular DiseaseHealthiest States
    r = +0.65 · strong · n = 19
    Plot

Opposite directions

Places that have a higher Effective Date tend to score lower on these

  1. Avg. Cost of Car Repair PartsAuto Repair Rates by State
    r = −0.73 · very strong · n = 20
    Plot
  2. Average Mortage DebtDebt by State
    r = −0.71 · very strong · n = 20
    Plot
  3. Average Personal DebtDebt by State
    r = −0.71 · very strong · n = 20
    Plot
  4. TrailsMountain Biking by State
    r = −0.69 · strong · n = 20
    Plot
  5. Average # of Sunny Hours per YearSunniest States in the U.S.
    r = −0.66 · strong · n = 19
    Plot
  6. Avg. Cost of Car Repair LaborAuto Repair Rates by State
    r = −0.65 · strong · n = 20
    Plot

Quick answers

Which state has the highest Effective Date?
Indiana has the highest Effective Date, at 2026, followed by Kentucky (2026) and Rhode Island (2026).
Which state has the lowest Effective Date?
Utah has the lowest Effective Date, at 2023.
What is the median Effective Date across US states?
The median is 2025 across the 20 US states with data.
Where does this privacy laws by state data come from?
Rankodex compiles it from World Population Review and the primary sources it cites: Which States Have Consumer Data Privacy Laws? - Blooberg Law; State privacy laws of the United State - Wiki.