"Privacy Protection Manual for United States"

As of 2025, the United States is witnessing a significant shift in data privacy regulations, with multiple new laws and amendments coming into effect. This evolving landscape is marked by a complex patchwork of state-level data privacy laws, each with its own unique provisions.

Key Current and Upcoming State Data Privacy Laws in the U.S.

Effective in 2025: - Iowa Consumer Privacy Act (ICPA): Effective January 1, 2025. The ICPA provides consumer rights primarily related to data sales opt-out, excluding profiling/targeted ads. Enforcement is handled by the Attorney General, with fines up to $7,500 per violation. - Delaware Personal Data Privacy Act (DPDPA): Effective January 1, 2025. This law applies to businesses processing data of 10,000+ consumers or with significant data sales revenue. It includes third-party data disclosure list requirements and a 45-day consumer request response timeline. - New Hampshire Consumer Expectation of Privacy (NHCEP): Details are not fully available, but the law is expected to come into force soon. - New Jersey Consumer Privacy Act (NJCPA): The NJCPA is effective, although proposed rules were published in June 2025 to clarify “personal data” and compliance obligations. - Nebraska Data Privacy Act (NDPA): Details are not fully available, but the law is expected to come into force soon. - Tennessee Information Protection Act (TIPA): Effective July 1, 2025. - Minnesota Consumer Data Privacy Act (CDPA): Effective July 31, 2025. - Maryland Online Data Privacy Act (MODPA): Details are not fully available, but the law is expected to come into force later in 2025.

Other States with Earlier Laws: - California Consumer Privacy Act (CCPA): Enacted in 2019, creating a significant compliance burden for businesses that collect personal information about California residents. - Virginia Consumer Data Protection Act (CDPA): Enacted in 2021, extending consumer data protections and business obligations similar to the California Consumer Privacy Act and the upcoming California Privacy Rights Act. - Colorado Privacy Act (CPA): Enacted in 2021, joining the California Consumer Privacy Act and the Virginia Consumer Data Protection Act as comprehensive state data privacy laws. - Utah Consumer Privacy Act (UCPA) and Connecticut Data Privacy Act (CTDPA): Both enacted in 2023.

2026 Upcoming Laws: Some additional comprehensive privacy laws are set to take effect starting January 1, 2026, but specific states were not fully listed in the search results.

This evolving patchwork means compliance remains complex, with 20+ state consumer privacy laws now or soon effective, and more regulations around AI and data brokers emerging in states like Texas. Businesses should keep current with state law developments and align their privacy programs accordingly.

If you want details on a particular state’s law or more on upcoming 2026 laws, let me know.

Additional Context:

These state laws vary widely in thresholds for applicability, consumer rights granted, business obligations (e.g., data disclosure, opt-out rights, data correction), enforcement authorities, and penalties. Many laws have differing timelines for businesses to respond to consumer requests, ranging from 30 to 90 days. There is increasing enforcement, although many laws are in early enforcement stages, with states like California having begun active settlements. Some states are enacting amendments to existing laws, complicating ongoing compliance.

Businesses operating across multiple states must navigate this patchwork of laws with varying provisions, often leading to adopting compliance strategies based on the most stringent standards.

Many businesses are grappling with the international implications of the shifting data privacy regulations in the United States.
The Iowa Consumer Privacy Act (ICPA) is set to come into effect on January 1, 2025, providing consumers with opt-out rights related to data sales, excluding profiling and targeted ads.
The Delaware Personal Data Privacy Act (DPDPA), effective from January 1, 2025, applies to businesses processing data of 10,000+ consumers or with significant data sales revenue.
The New Hampshire Consumer Expectation of Privacy (NHCEP) is expected to be enacted soon, but the details are not fully available.
The New Jersey Consumer Privacy Act (NJCPA) came into effect, but proposed rules were published in June 2025 to clarify "personal data" and compliance obligations.
Nebraska Data Privacy Act (NDPA) details are not fully available, but the law is expected to come into force soon.
The Tennessee Information Protection Act (TIPA) will be effective from July 1, 2025.
The Minnesota Consumer Data Privacy Act (CDPA) will be effective from July 31, 2025.
The Maryland Online Data Privacy Act (MODPA) is expected to come into force later in 2025, although the details are not fully available.
California, Virginia, Colorado, and Utah already have comprehensive state data privacy laws, with Connecticut following suit in 2023.
Some additional comprehensive privacy laws are set to take effect starting January 1, 2026.
The industry is witnessing emerging regulations around AI and data brokers in states like Texas.
Compliance remains complex with over 20 state consumer privacy laws now or soon effective.
To navigate this complex landscape, businesses should align their privacy programs according to the most stringent standards in each state.
For details on a specific state’s law or more information on upcoming 2026 laws, visit whitecase.com, the online platform for insights, publications, and services in the corporate practice, including regulatory news, litigation, and education-and-self-development resources featuring a dedicated team of associates who work in various offices across the industry, providing business, finance, lifestyle, personal-finance, technology, and education-and-self-development insights.