23 state privacy laws. One central software solution to keep you compliant.
One clear view of what applies next. Track enacted comprehensive U.S. privacy laws, effective dates, opt-out requirements, sensitive-data rules, cure periods and legislation awaiting final action — in one maintained view. Includes 23 comprehensive state laws; Florida’s narrower Digital Bill of Rights is tracked separately. No credit card required: get a practical view of the trackers, pixels, cookies and consent signals visible on your website.
Where U.S. state privacy law stands
Enacted comprehensive consumer privacy statutes, counted using the IAPP state legislation tracker methodology.
Already operative today, from California in 2020 through Indiana, Kentucky and Rhode Island in January 2026.
Oklahoma, Louisiana, Alabama and Vermont were enacted during 2026 with later effective dates.
Florida’s Digital Bill of Rights is narrower, so it sits outside the count of 23 along with other general privacy laws being used for litigation purposes.
Similar laws — but not interchangeable.
Applicability depends on more than where a company is located. Consumer volume, revenue, data-sale activity, entity type and the categories of data processed can all change the answer. Use this as a starting point, then evaluate your actual processing activities and statutory exemptions. General information only, not legal advice.
Applicability
Consumer thresholds, revenue tests, data-sale activity, entity type and exemptions vary considerably between states.
Universal opt-out signals
Some states require businesses to recognize qualifying browser-based opt-out signals. Others do not, or apply the requirement from a later date.
Sensitive data
Definitions and consent requirements can cover precise geolocation, biometric data, health information, children’s data, citizenship and other protected characteristics.
Consumer rights
Access, deletion, correction, portability, opt-out and appeal rights differ by jurisdiction, as do response periods.
Assessments and governance
Some laws require data-protection assessments for targeted advertising, sales, profiling, sensitive data or other high-risk processing.
Enforcement and cure periods
Enforcement authority, penalty structures, cure opportunities and cure-period sunset dates are not uniform.
What is effective now — and what comes next.
Nineteen of the 23 comprehensive laws are already operative. Four more, all enacted during 2026, phase in between 2027 and 2028. Effective dates are only one part of readiness: rulemaking, amendments, opt-out-mechanism deadlines and cure-period sunsets can run on different clocks, so a law being “in force” is rarely the only date that matters.
Talk with a privacy specialist- Already effective — Indiana, Kentucky and Rhode Island, Jan 1, 2026
- Jan 1, 2027 — Oklahoma and Louisiana
- May 1, 2027 — Alabama
- Jan 1, 2028 — Vermont
- Tracked separately — Florida Digital Bill of Rights, Jul 1, 2024
Turn a changing patchwork into an operating program.
- One state’s setup copied everywhere
- Opt-out signals handled inconsistently
- Effective dates tracked in a spreadsheet
- Assessments rewritten from scratch each time
- Notices out of step with state disclosures
- No record of who decided what, or when
- State applicability and obligation mapping
- Consent and universal opt-out signal handling
- Consumer-rights request workflows
- Privacy notices and state disclosures
- Data inventories and protection assessments
- Ongoing monitoring for trackers and privacy risk
The US patchwork, answered plainly.
How many states have comprehensive privacy laws?+
Does every state privacy law apply to every business?+
Which new state privacy laws take effect next?+
Do all states require businesses to honor Global Privacy Control?+
What is a universal opt-out mechanism?+
How quickly must a business respond to a privacy request?+
Can a website scan determine whether my company is compliant?+
How often is this tracker updated?+
See what your website may be sharing.
Scan your site for visible trackers, cookies, pixels, consent behavior and privacy signals, then use the results to prioritize your next steps. A scan is a technical starting point where we can help remediate your privacy gaps.
Run a free privacy audit Talk with a privacy expert