🆕  Migrate from OneTrust seamlessly with Ketch Switch. Exclusive offer through 4/30/2025.
KetchResourcesRegulations

Navigate data
privacy laws effectively

Ketch’s comprehensive resources on GDPR, CCPA and all major regulations in the US and worldwide.
Try Ketch for Free
Request Regulatory Guidance
With Matt George, Data Protection Officer at Ketch
Matt George, Data Protection Officer at Ketch
U.S. Data Privacy Laws
Global Data Privacy Laws
New
2025 U.S. State Privacy Laws: what you need to know

Stay informed about the latest in US privacy laws and how they impact your business operations.

Effective
LGPD (Brazil)

General Personal Data Protection Law

Effective:

August 1, 2021

Effective
LGPD (Brazil)

General Personal Data Protection Law

Effective:

August 1, 2021

Effective
DPA (United Kingdom)

The Data Protection Act

Effective:

May 25, 2018

Effective
DPA (United Kingdom)

The Data Protection Act

Effective:

May 25, 2018

Effective
Law 25 (Canada)

Quebec residents

Effective:

September 22, 2023

Effective
Law 25 (Canada)

Quebec residents

Effective:

September 22, 2023

Effective
PIPEDA (Canada)

Personal Information Protection and Electronic Documents Act

Effective:

April 13, 2000

Effective
PIPEDA (Canada)

Personal Information Protection and Electronic Documents Act

Effective:

April 13, 2000

Effective
GDPR (European Union)

General Data Protection Regulation

Effective:

May 25, 2018

Effective
GDPR (European Union)

General Data Protection Regulation

Effective:

May 25, 2018

Effective
CPA

Colorado Privacy Act

Effective:

July 1, 2023

Effective
CPA

Colorado Privacy Act

Effective:

July 1, 2023

Effective
CTDPA

Connecticut Data Privacy Act

Effective:

July 1, 2023

Effective
CTDPA

Connecticut Data Privacy Act

Effective:

July 1, 2023

Effective
CCPA/CPRA

California Consumer Privacy Act

Effective:

January 1, 2020

Effective
CCPA/CPRA

California Consumer Privacy Act

Effective:

January 1, 2020

Signed
INCDPA

Indiana Consumer Data Protection Act

Effective:

January 1, 2026

Signed
INCDPA

Indiana Consumer Data Protection Act

Effective:

January 1, 2026

Effective
ICDPA

Iowa Consumer Data Protection Act

Effective:

January 1, 2025

Effective
ICDPA

Iowa Consumer Data Protection Act

Effective:

January 1, 2025

Signed
KCDPA

Kentucky Consumer Data Protection Act

Effective:

January 1, 2026

Signed
KCDPA

Kentucky Consumer Data Protection Act

Effective:

January 1, 2026

Signed
MODPA

Maryland Online Data Privacy Act

Effective:

October 1, 2025

Signed
MODPA

Maryland Online Data Privacy Act

Effective:

October 1, 2025

Signed
MNCDPA

Minnesota Consumer Data Privacy Act

Effective:

July 31, 2025

Signed
MNCDPA

Minnesota Consumer Data Privacy Act

Effective:

July 31, 2025

Effective
NDPA

Nebraska Data Privacy Act

Effective:

January 1, 2025

Effective
NDPA

Nebraska Data Privacy Act

Effective:

January 1, 2025

Inactive
North Carolina

Effective:

Inactive
North Carolina

Effective:

Inactive
Wyoming

Effective:

Inactive
Wyoming

Effective:

Effective
DPDPA

Delaware Personal Data Privacy Act

Effective:

January 1, 2025

Effective
DPDPA

Delaware Personal Data Privacy Act

Effective:

January 1, 2025

Effective
MCDPA

Montana Consumer Data Protection Act

Effective:

October 1, 2024

Effective
MCDPA

Montana Consumer Data Protection Act

Effective:

October 1, 2024

Introduced
Michigan

Personal Data Privacy Act

Effective:

Introduced
Michigan

Personal Data Privacy Act

Effective:

Effective
NHPA

New Hampshire Privacy Act

Effective:

January 1, 2025

Effective
NHPA

New Hampshire Privacy Act

Effective:

January 1, 2025

Effective
NJDPA

New Jersey Data Privacy Act

Effective:

January 15, 2025

Effective
NJDPA

New Jersey Data Privacy Act

Effective:

January 15, 2025

Introduced
Oklahoma

Oklahoma Computer Data Privacy Act

Effective:

Introduced
Oklahoma

Oklahoma Computer Data Privacy Act

Effective:

Introduced
Ohio

Ohio Personal Privacy Act X

Effective:

Introduced
Ohio

Ohio Personal Privacy Act X

Effective:

Effective
OCPA

Oregon Consumer Privacy Act

Effective:

July 1, 2024

Effective
OCPA

Oregon Consumer Privacy Act

Effective:

July 1, 2024

Introduced
PCDPA

Pennsylvania Consumer Data Privacy Act

Effective:

Introduced
PCDPA

Pennsylvania Consumer Data Privacy Act

Effective:

Signed
RIDTPPA

Rhode Island Data Transparency and Privacy Protection Act

Effective:

January 1, 2026

Signed
RIDTPPA

Rhode Island Data Transparency and Privacy Protection Act

Effective:

January 1, 2026

Effective
TDPSA

Texas Data Privacy And Security Act

Effective:

July 1, 2024

Effective
TDPSA

Texas Data Privacy And Security Act

Effective:

July 1, 2024

Effective
UCPA

Utah Consumer Privacy Act

Effective:

December 31, 2023

Effective
UCPA

Utah Consumer Privacy Act

Effective:

December 31, 2023

Signed
TIPA

Tennessee Information Protection Act

Effective:

July 1, 2025

Signed
TIPA

Tennessee Information Protection Act

Effective:

July 1, 2025

Effective
VCDPA

Virginia Consumer Data Protection Act

Effective:

January 1, 2023

Effective
VCDPA

Virginia Consumer Data Protection Act

Effective:

January 1, 2023

Effective
LGPD (Brazil)

General Personal Data Protection Law

Effective:

August 1, 2021

Effective
LGPD (Brazil)

General Personal Data Protection Law

Effective:

August 1, 2021

Effective
DPA (United Kingdom)

The Data Protection Act

Effective:

May 25, 2018

Effective
DPA (United Kingdom)

The Data Protection Act

Effective:

May 25, 2018

Effective
Law 25 (Canada)

Quebec residents

Effective:

September 22, 2023

Effective
Law 25 (Canada)

Quebec residents

Effective:

September 22, 2023

Effective
PIPEDA (Canada)

Personal Information Protection and Electronic Documents Act

Effective:

April 13, 2000

Effective
PIPEDA (Canada)

Personal Information Protection and Electronic Documents Act

Effective:

April 13, 2000

Effective
GDPR (European Union)

General Data Protection Regulation

Effective:

May 25, 2018

Effective
GDPR (European Union)

General Data Protection Regulation

Effective:

May 25, 2018

Effective
CPA

Colorado Privacy Act

Effective:

July 1, 2023

Effective
CPA

Colorado Privacy Act

Effective:

July 1, 2023

Effective
CTDPA

Connecticut Data Privacy Act

Effective:

July 1, 2023

Effective
CTDPA

Connecticut Data Privacy Act

Effective:

July 1, 2023

Effective
CCPA/CPRA

California Consumer Privacy Act

Effective:

January 1, 2020

Effective
CCPA/CPRA

California Consumer Privacy Act

Effective:

January 1, 2020

Signed
INCDPA

Indiana Consumer Data Protection Act

Effective:

January 1, 2026

Signed
INCDPA

Indiana Consumer Data Protection Act

Effective:

January 1, 2026

Effective
ICDPA

Iowa Consumer Data Protection Act

Effective:

January 1, 2025

Effective
ICDPA

Iowa Consumer Data Protection Act

Effective:

January 1, 2025

Signed
KCDPA

Kentucky Consumer Data Protection Act

Effective:

January 1, 2026

Signed
KCDPA

Kentucky Consumer Data Protection Act

Effective:

January 1, 2026

Signed
MODPA

Maryland Online Data Privacy Act

Effective:

October 1, 2025

Signed
MODPA

Maryland Online Data Privacy Act

Effective:

October 1, 2025

Signed
MNCDPA

Minnesota Consumer Data Privacy Act

Effective:

July 31, 2025

Signed
MNCDPA

Minnesota Consumer Data Privacy Act

Effective:

July 31, 2025

Effective
NDPA

Nebraska Data Privacy Act

Effective:

January 1, 2025

Effective
NDPA

Nebraska Data Privacy Act

Effective:

January 1, 2025

Inactive
North Carolina

Effective:

Inactive
North Carolina

Effective:

Inactive
Wyoming

Effective:

Inactive
Wyoming

Effective:

Effective
DPDPA

Delaware Personal Data Privacy Act

Effective:

January 1, 2025

Effective
DPDPA

Delaware Personal Data Privacy Act

Effective:

January 1, 2025

Effective
MCDPA

Montana Consumer Data Protection Act

Effective:

October 1, 2024

Effective
MCDPA

Montana Consumer Data Protection Act

Effective:

October 1, 2024

Introduced
Michigan

Personal Data Privacy Act

Effective:

Introduced
Michigan

Personal Data Privacy Act

Effective:

Effective
NHPA

New Hampshire Privacy Act

Effective:

January 1, 2025

Effective
NHPA

New Hampshire Privacy Act

Effective:

January 1, 2025

Effective
NJDPA

New Jersey Data Privacy Act

Effective:

January 15, 2025

Effective
NJDPA

New Jersey Data Privacy Act

Effective:

January 15, 2025

Introduced
Oklahoma

Oklahoma Computer Data Privacy Act

Effective:

Introduced
Oklahoma

Oklahoma Computer Data Privacy Act

Effective:

Introduced
Ohio

Ohio Personal Privacy Act X

Effective:

Introduced
Ohio

Ohio Personal Privacy Act X

Effective:

Effective
OCPA

Oregon Consumer Privacy Act

Effective:

July 1, 2024

Effective
OCPA

Oregon Consumer Privacy Act

Effective:

July 1, 2024

Introduced
PCDPA

Pennsylvania Consumer Data Privacy Act

Effective:

Introduced
PCDPA

Pennsylvania Consumer Data Privacy Act

Effective:

Signed
RIDTPPA

Rhode Island Data Transparency and Privacy Protection Act

Effective:

January 1, 2026

Signed
RIDTPPA

Rhode Island Data Transparency and Privacy Protection Act

Effective:

January 1, 2026

Effective
TDPSA

Texas Data Privacy And Security Act

Effective:

July 1, 2024

Effective
TDPSA

Texas Data Privacy And Security Act

Effective:

July 1, 2024

Effective
UCPA

Utah Consumer Privacy Act

Effective:

December 31, 2023

Effective
UCPA

Utah Consumer Privacy Act

Effective:

December 31, 2023

Signed
TIPA

Tennessee Information Protection Act

Effective:

July 1, 2025

Signed
TIPA

Tennessee Information Protection Act

Effective:

July 1, 2025

Effective
VCDPA

Virginia Consumer Data Protection Act

Effective:

January 1, 2023

Effective
VCDPA

Virginia Consumer Data Protection Act

Effective:

January 1, 2023

Statute/bill legislative status:
Effective
Signed
Introduced
Inactive
Regulations
Unique features
Penalties
Effective
Effective

CCPA/CPRA

California Consumer Privacy Act
Gives Californians strong privacy rights (access to personal data, deletion, and the right to opt out of data sales)—rights that were groundbreaking when introduced. Defines "sale" broadly to include sharing personal information for any valuable consideration, not just monetary transactions.
Up to $7,500 per intentional violation.
January 1, 2020
Learn More

VCDPA

Virginia Consumer Data Protection Act
Adopts a GDPR-like model, clearly distinguishing between "controllers" and "processors," setting specific obligations for each, requires opt-in consent for processing sensitive data such as race, health, and precise geolocation, offering stronger protections in these areas compared to many U.S. state privacy laws.
Up to $7,500 per violation.
January 1, 2023
Learn More

CTDPA

Connecticut Data Privacy Act
Strong opt-out rights with extended grace period
Up to $5,000 per violation.
July 1, 2023
Learn More

CPA

Colorado Privacy Act
Requires businesses to provide a user-friendly global opt-out mechanism for data sales and targeted advertising, a first among U.S. state privacy laws.
Up to $20,000 per violation
July 1, 2023
Learn More

UCPA

Utah Consumer Privacy Act
Higher applicability thresholds than most U.S. state privacy laws, applying only to businesses generating $25 million+ in revenue and processing data of 100,000+ consumers.
Up to $7,500 per violation.
December 31, 2023
Learn More

TDPSA

Texas Data Privacy And Security Act
Exempts "small businesses" as defined by the U.S. Small Business Administration.
Up to $7,500 per violation.
July 1, 2024
Learn More

OCPA

Oregon Consumer Privacy Act
Applies to certain nonprofit organizations, expanding its scope beyond for-profit entities.
Up to $7,500 per violation.
July 1, 2024
Learn More

MCDPA

Montana Consumer Data Protection Act
Mandates assessments for processing activities that pose significant consumer risks. Grants access, correction, deletion, and data portability rights.
Up to $7,500 per violation.
October 1, 2024
Learn More

NHPA

New Hampshire Privacy Act
Requires businesses to honor universal opt-out signals, including the Global Privacy Control (GPC), and mandates clear, accessible privacy notices.
Up to $5,000 per violation.
January 1, 2025
Learn More

DPDPA

Delaware Personal Data Privacy Act
Applies to certain nonprofit organizations, and requires parental consent for processing personal data of consumers under 18.
Up to $10,000 per violation.
January 1, 2025
Learn More

NDPA

Nebraska Data Privacy Act
Covers businesses of all sizes, including those not classified under the federal Small Business Act.
Up to $7,500 per violation.
January 1, 2025
Learn More

ICDPA

Iowa Consumer Data Protection Act
Requires businesses to provide clear notice and an opt-out option and limits consumer rights to correct inaccuracies.
Up to $7,500 per violation.
January 1, 2025
Learn More

NJDPA

New Jersey Data Privacy Act
Requires businesses to process opt-out requests within 15 days, faster than most state privacy laws and applies to nonprofits and educational institutions.
Up to $10,000 per violation.
January 15, 2025
Learn More
Signed

TIPA

Tennessee Information Protection Act
Allows consumers to opt out of targeted advertising and data sales and strengthens breach notification requirements.
Up to $7,500 per violation.
July 1, 2025
Learn More

MNCDPA

Minnesota Consumer Data Privacy Act
Requires opt-in consent for processing sensitive personal data and imposes strong data security obligations on businesses.
Up to $7,500 per violation.
July 31, 2025
Learn More

MODPA

Maryland Online Data Privacy Act
Covers various types of online data collection and use and strengthens privacy rules for minors under 16.
Up to $10,000 per violation.
October 1, 2025
Learn More

RIDTPPA

Rhode Island Data Transparency and Privacy Protection Act
Demands clear privacy disclosures for consumers and allows consumers to opt out of data sales and targeted advertising.
Up to $5,000 per violation.
January 1, 2026
Learn More

KCDPA

Kentucky Consumer Data Protection Act
Provides comprehensive data rights and requires agreements outlining processors’ data-handling obligations.
Up to $7,500 per violation.
January 1, 2026
Learn More

INCDPA

Indiana Consumer Data Protection Act
Targets large-scale data processors with significant revenue or data volume with robust data protection and breach notification rules.
Up to $7,500 per violation.
January 1, 2026
Learn More
Introduced
Play button
Overview

Michigan

Personal Data Privacy Act
Play button
Overview

Oklahoma

Oklahoma Computer Data Privacy Act
Play button
Overview

Ohio

Ohio Personal Privacy Act X
Play button
Overview

PCDPA

Pennsylvania Consumer Data Privacy Act
New
GDPR vs CCPA vs CPRA: what's the difference? 📢

Stay informed about the latest the latest in the privacy laws worldwide and how they impact your business operations.

Regulations
Unique features
Penalties
Effective
Effective

GDPR (European Union)

General Data Protection Regulation
Applies to businesses worldwide if they process EU residents' data.
Up to €20 million
May 25, 2018
Learn More

PIPEDA (Canada)

Personal Information Protection and Electronic Documents Act
Requires businesses to ensure adequate data protection when transferring data internationally.
Up to CAD $100,000 per violation.
April 13, 2000
Learn More

DPA (United Kingdom)

The Data Protection Act
Implements GDPR-like provisions with UK-specific adjustments post-Brexit.
Up to £17.5 million or 4% of global annual revenue.
May 25, 2018
Learn More

LGPD (Brazil)

General Personal Data Protection Law
Covers all personal data processing, including offline data, overseed by National privacy authority (ANPD).
Up to R$50 million per violation.
August 1, 2021
Learn More

Law 25 (Canada)

Quebec residents
In addition to explicit consent requirement, organizations must appoint a privacy officer.
Up to CAD $25 million or 4% of global annual revenue
September 22, 2023
Learn More
Ketch regulatory on-demand guidance for businesses of any size
Request Regulatory Guidance
Expert legal support to address any regulatory question, from GDPR to local frameworks.
Global coverage with expertise across all major privacy and AI laws.
Tailored guidance to your unique needs.
How to comply?

Meet Ketch: one platform, every regulation. Zero headaches.

Most privacy software tools make data privacy law compliance a costly game of add-on modules for each new law. We think that’s a ridiculous expectation in today’s changing regulatory landscape.
We’ve developed privacy primitives like processing purpose, legal bases, and rights to customize and reassemble for each jurisdiction. Create your own, or use our pre-configured templates.
Tour Jurisdictions in Ketch

Automate your privacy compliance with Ketch 


The Ketch Data Permissioning Platform helps you comply with any data law, now and in the future.
Try Ketch for Free
Book a Demo
Ketch has been voted best CMP for small businesses in G2
ziprecruiter is a customer of Ketchpc richard and son is a customer of KetchParamount is a customer of Ketchforbes is a customer of Ketchpurple is a customer of Ketchdollar shave club is a customer of Ketchwhiteclaw is a customer of Ketchdunkin donuts is a customer of Ketchdish is a customer of Ketchbaskin robbins is a customer of Ketchhasbro is a customer of Ketchimax is a customer of Ketchcavenders is a customer of Ketchgrindr is a customer of Ketchseatgeek is a customer of Ketchpret a manger is a customer of Ketchremitly is a customer of Ketchinchcape is a customer of KetchREA Group is a customer of Ketchrenaissance is a customer of Ketchthe globe and mail is a customer of data privacy software Ketchkse is a customer of Ketchthe realreal is a customer of Ketchutility warehouse is a customer of Ketchgorjana is a customer of Ketchfrancesca's is a customer of Ketchfortune brands is a customer of Ketchazul is a customer of Ketchdefinity is a customer of Ketchallsup is a customer of Ketchbetterment is a customer of Ketchchipotle is a customer of Ketchdemandbase is a customer of Ketchinspire brands are a customer of Ketchdrift is a customer of Ketcharby's is a customer of Ketchbuffalo wings is a customer of Ketchjimmy johns is a customer of Ketchsonic is a customer of Ketch

Common data privacy laws FAQs

Which laws does Ketch cover?

Ketch supports compliance with major privacy laws, including GDPR, CCPA, CPRA, and various emerging US state laws, ensuring businesses meet global and local data privacy requirements.

What are the privacy laws in the US?

The US has no single federal privacy law. Key privacy laws in the United States include HIPAA (health data), GLBA (financial data), and several state-specific laws like CCPA in California and VCDPA in Virginia. In 2024, the proposed American Privacy Rights Act (APRA) seeks to create a unified national data privacy standard. It still remains under consideration in Congress.

How many US states have privacy laws?

Why do individual US states have their own data privacy laws?

Which US states have the strictest data privacy laws?

Do businesses need to comply with the data privacy laws of every US state?

How do US state privacy laws compare to the GDPR?

How does GDPR differ from us privacy laws?

How can businesses stay compliant with evolving US data privacy laws?

Where can I find more information about my state’s data privacy law?

Continue reading:
latest regulation news

More Articles
Regulations, Top Articles

Wiretapping laws in the digital era: how to protect your brand

Colleen Barry
7 min read
Regulations, News, Privacy tech

How to meet the New York AG website privacy controls requirements

Max Anderson
8 min read
Regulations, Top articles

Careless pixel tracking is bad for your company's health

Jonathan Joseph
9 min read
Automate your privacy compliance with Ketch
Risk of regulatory action or fine is no longer an unlikely, empty threat—regulators across Europe and now the United States are charging brands with irresponsible handing of consumer data.
Your knowledge of the regulations and requirements for your business may be the difference maker in ensuring your brand reputation stays intact. Ketch can help.
Try Ketch for Free
Book a Demo