[{"law_id":"ca_ccpa_cpra","state":"California","state_code":"CA","state_fips":"06","country_code":"USA","law_name":"California Consumer Privacy Act / California Privacy Rights Act","law_short":"CCPA/CPRA","status":"in_effect","effective_date":"2023-01-01","days_until_effective":-1368,"years_in_effect":3.75,"threshold_consumers":100000,"threshold_note":"100,000 consumers/households; also $26.625M+ annual revenue or 50%+ revenue from sale/share of 100k+ consumers' personal information (CPRA; revenue figure inflation-adjusted 2026).","private_right_of_action":"limited","enforcement":"CPPA_AG","universal_optout_required":"yes","demand_trigger_score":65,"note":"CPRA operative 2023-01-01 (CCPA 2020-01-01). Only state with a dedicated enforcement agency (CPPA) plus AG; limited private right of action for data breaches. DELETE Act data-broker mechanism fully operational 2026-08-01; CPPA risk-assessment rules effective 2026-01-01, ADMT duties from 2027-01-01.","verification_status":"multi_source","source_basis":"mn-lrl-guide-2026;iapp.org;mukul975/privacy-data-protection-skills;mimi1vx/ocskillz;kenkaiii/gg-framework","collected_at":"2026-09-30","row_hash":"71af7378990eacdf"},{"law_id":"va_vcdpa","state":"Virginia","state_code":"VA","state_fips":"51","country_code":"USA","law_name":"Virginia Consumer Data Protection Act","law_short":"VCDPA","status":"in_effect","effective_date":"2023-01-01","days_until_effective":-1368,"years_in_effect":3.75,"threshold_consumers":100000,"threshold_note":"100,000 consumers; or 25,000+ if >50% of gross revenue from sale of personal data.","private_right_of_action":"none","enforcement":"AG","universal_optout_required":"no","demand_trigger_score":45,"note":"Template law most other states copied. AG-only enforcement; no universal opt-out duty.","verification_status":"multi_source","source_basis":"mn-lrl-guide-2026;mukul975/privacy-data-protection-skills;wnallen/dpia-generator;kenkaiii/gg-framework","collected_at":"2026-09-30","row_hash":"1abf15703334537d"},{"law_id":"co_cpa","state":"Colorado","state_code":"CO","state_fips":"08","country_code":"USA","law_name":"Colorado Privacy Act","law_short":"CPA","status":"in_effect","effective_date":"2023-07-01","days_until_effective":-1187,"years_in_effect":3.25,"threshold_consumers":100000,"threshold_note":"100,000 consumers; or 25,000+ if revenue/discount from sale of personal data.","private_right_of_action":"none","enforcement":"AG","universal_optout_required":"yes","demand_trigger_score":55,"note":"Universal opt-out mechanism required; AG enforcement.","verification_status":"multi_source","source_basis":"mn-lrl-guide-2026;mukul975/privacy-data-protection-skills;kenkaiii/gg-framework;eigenlegal/counsel-os","collected_at":"2026-09-30","row_hash":"d31002f57b42f863"},{"law_id":"ct_ctdpa","state":"Connecticut","state_code":"CT","state_fips":"09","country_code":"USA","law_name":"Connecticut Data Privacy Act","law_short":"CTDPA","status":"in_effect","effective_date":"2023-07-01","days_until_effective":-1187,"years_in_effect":3.25,"threshold_consumers":35000,"threshold_note":"SB 1295 lowers the headline threshold from 100,000 to 35,000 consumers effective 2026-07-01 (payment-transaction data excluded); no threshold where the controller sells personal data or processes sensitive data.","private_right_of_action":"none","enforcement":"AG","universal_optout_required":"yes","demand_trigger_score":65,"note":"2026 amendments (SB 1295): LLM-training disclosure in privacy notices, expanded sensitive-data categories, impact-assessment duties from 2026-08-01, further amendments 2026-10-01.","verification_status":"multi_source","source_basis":"mn-lrl-guide-2026;mukul975/privacy-data-protection-skills;jdsupra-foster-swift-2026-07;wnallen/dpia-generator","collected_at":"2026-09-30","row_hash":"e0d82791fba88351"},{"law_id":"ut_ucpa","state":"Utah","state_code":"UT","state_fips":"49","country_code":"USA","law_name":"Utah Consumer Privacy Act","law_short":"UCPA","status":"in_effect","effective_date":"2023-12-31","days_until_effective":-1004,"years_in_effect":2.75,"threshold_consumers":100000,"threshold_note":"100,000 consumers AND $25M+ annual revenue; or 25,000+ if >50% of revenue from sale of personal data.","private_right_of_action":"none","enforcement":"AG","universal_optout_required":"no","demand_trigger_score":45,"note":"Most business-friendly of the early laws (no right to correct, no sensitive-data opt-in beyond notice). HB 418 amendments effective 2026-07-01.","verification_status":"multi_source","source_basis":"mn-lrl-guide-2026;mukul975/privacy-data-protection-skills;jdsupra-foster-swift-2026-07","collected_at":"2026-09-30","row_hash":"3223aa0a25673faa"},{"law_id":"tx_tdpsa","state":"Texas","state_code":"TX","state_fips":"48","country_code":"USA","law_name":"Texas Data Privacy and Security Act","law_short":"TDPSA","status":"in_effect","effective_date":"2024-07-01","days_until_effective":-821,"years_in_effect":2.25,"threshold_consumers":null,"threshold_note":"No consumer-count threshold: applies to any person doing business in Texas (or targeting Texans) that processes or sells personal data, unless an SBA-defined small business.","private_right_of_action":"none","enforcement":"AG","universal_optout_required":"yes","demand_trigger_score":70,"note":"Broadest reach of any state law by threshold design; universal opt-out recognition required from 2025.","verification_status":"multi_source","source_basis":"mn-lrl-guide-2026;mukul975/privacy-data-protection-skills;computerweekly-2025;wnallen/dpia-generator;eigenlegal/counsel-os","collected_at":"2026-09-30","row_hash":"e0b1ecaa388e36f5"},{"law_id":"or_ocpa","state":"Oregon","state_code":"OR","state_fips":"41","country_code":"USA","law_name":"Oregon Consumer Privacy Act","law_short":"OCPA","status":"in_effect","effective_date":"2024-07-01","days_until_effective":-821,"years_in_effect":2.25,"threshold_consumers":100000,"threshold_note":"100,000 consumers (payment-transaction data excluded); or 25,000+ if >=25% of revenue from sale of personal data.","private_right_of_action":"none","enforcement":"AG","universal_optout_required":"yes","demand_trigger_score":55,"note":"2025 amendments expanded scope; universal opt-out required from 2026; right to know the specific third parties data was sold to.","verification_status":"multi_source","source_basis":"mn-lrl-guide-2026;mukul975/privacy-data-protection-skills;computerweekly-2025;eigenlegal/counsel-os","collected_at":"2026-09-30","row_hash":"e5f5c769412ecc9c"},{"law_id":"mt_mcdpa","state":"Montana","state_code":"MT","state_fips":"30","country_code":"USA","law_name":"Montana Consumer Data Privacy Act","law_short":"MCDPA","status":"in_effect","effective_date":"2024-10-01","days_until_effective":-729,"years_in_effect":2.0,"threshold_consumers":25000,"threshold_note":"SB 297 lowered the headline threshold from 50,000 to 25,000 consumers effective 2025-10-01; alternative prong 15,000+ with >25% revenue from sale.","private_right_of_action":"none","enforcement":"AG","universal_optout_required":"yes","demand_trigger_score":75,"note":"SB 297 also removed the 60-day cure period and added a duty of care plus minors'-data restrictions. Universal opt-out required since 2025-01-01.","verification_status":"multi_source","source_basis":"mn-lrl-guide-2026;mukul975/privacy-data-protection-skills;computerweekly-2025;eigenlegal/counsel-os;wnallen/dpia-generator","collected_at":"2026-09-30","row_hash":"c2f0d8c3a9353c44"},{"law_id":"ia_icdpa","state":"Iowa","state_code":"IA","state_fips":"19","country_code":"USA","law_name":"Iowa Consumer Data Protection Act","law_short":"ICDPA","status":"in_effect","effective_date":"2025-01-01","days_until_effective":-637,"years_in_effect":1.74,"threshold_consumers":100000,"threshold_note":"100,000 consumers; or 25,000+ if >50% of revenue from sale of personal data.","private_right_of_action":"none","enforcement":"AG","universal_optout_required":"no","demand_trigger_score":55,"note":"Narrow rights package (no correction right); 90-day cure period with no sunset.","verification_status":"multi_source","source_basis":"mn-lrl-guide-2026;mukul975/privacy-data-protection-skills;eigenlegal/counsel-os","collected_at":"2026-09-30","row_hash":"11e9951f438b3b1b"},{"law_id":"de_dpdpa","state":"Delaware","state_code":"DE","state_fips":"10","country_code":"USA","law_name":"Delaware Personal Data Privacy Act","law_short":"DPDPA","status":"in_effect","effective_date":"2025-01-01","days_until_effective":-637,"years_in_effect":1.74,"threshold_consumers":35000,"threshold_note":"35,000 consumers; or 10,000+ if >20% of revenue from sale of personal data. HB-380 lowers to 10,000 (5,000 if >20% revenue from sale) effective 2027-01-01.","private_right_of_action":"none","enforcement":"AG","universal_optout_required":"yes","demand_trigger_score":75,"note":"Covers non-profits (unusual). No cure period after 2025-12-31. HB-380 (signed 2026-09) also bans sale of sensitive data and narrows the GLBA exemption.","verification_status":"multi_source","source_basis":"mn-lrl-guide-2026;mukul975/privacy-data-protection-skills;eigenlegal/counsel-os;privacy-daily-2026-09;mondaq-2026-09","collected_at":"2026-09-30","row_hash":"fc74c2b2b09ff417"},{"law_id":"nh_nhpa","state":"New Hampshire","state_code":"NH","state_fips":"33","country_code":"USA","law_name":"New Hampshire Privacy Act","law_short":"NHPA","status":"in_effect","effective_date":"2025-01-01","days_until_effective":-637,"years_in_effect":1.74,"threshold_consumers":35000,"threshold_note":"35,000 consumers; or 10,000+ if >25% of revenue from sale of personal data.","private_right_of_action":"none","enforcement":"AG","universal_optout_required":"yes","demand_trigger_score":75,"note":"Low-threshold New England law; AG enforcement.","verification_status":"multi_source","source_basis":"mn-lrl-guide-2026;mukul975/privacy-data-protection-skills;computerweekly-2025;wnallen/dpia-generator","collected_at":"2026-09-30","row_hash":"36e623f652f5c047"},{"law_id":"ne_ndpa","state":"Nebraska","state_code":"NE","state_fips":"31","country_code":"USA","law_name":"Nebraska Data Privacy Act","law_short":"NDPA","status":"in_effect","effective_date":"2025-01-01","days_until_effective":-637,"years_in_effect":1.74,"threshold_consumers":null,"threshold_note":"No consumer-count threshold (Texas model); SBA small-business exemption. Data-protection-assessment duty confirmed (Neb. Rev. Stat. 87-1116).","private_right_of_action":"none","enforcement":"AG","universal_optout_required":"yes","demand_trigger_score":80,"note":"Universal opt-out required. One of the two no-threshold states.","verification_status":"multi_source","source_basis":"mn-lrl-guide-2026;mukul975/privacy-data-protection-skills;computerweekly-2025;wnallen/dpia-generator;kenkaiii/gg-framework","collected_at":"2026-09-30","row_hash":"51e4f8e814bcbb5b"},{"law_id":"nj_njdpa","state":"New Jersey","state_code":"NJ","state_fips":"34","country_code":"USA","law_name":"New Jersey Data Protection Act","law_short":"NJDPA","status":"in_effect","effective_date":"2025-01-15","days_until_effective":-623,"years_in_effect":1.71,"threshold_consumers":100000,"threshold_note":"100,000 consumers; or 25,000+ if any revenue (or discount) from sale of personal data.","private_right_of_action":"none","enforcement":"AG","universal_optout_required":"yes","demand_trigger_score":65,"note":"A5328 (signed 2026-06-30) adds a data-broker/data-collector registration framework (registry launching spring 2027). June 2025 proposed regulations expired unadopted 2026-06-02.","verification_status":"multi_source","source_basis":"mn-lrl-guide-2026;mukul975/privacy-data-protection-skills;wnallen/dpia-generator;kenkaiii/gg-framework","collected_at":"2026-09-30","row_hash":"6ec6e96d4f6900be"},{"law_id":"tn_tipa","state":"Tennessee","state_code":"TN","state_fips":"47","country_code":"USA","law_name":"Tennessee Information Protection Act","law_short":"TIPA","status":"in_effect","effective_date":"2025-07-01","days_until_effective":-456,"years_in_effect":1.25,"threshold_consumers":175000,"threshold_note":"175,000 consumers AND $25M+ revenue; or 25,000+ if >50% of revenue from sale of personal data (also with $25M+ revenue).","private_right_of_action":"none","enforcement":"AG","universal_optout_required":"no","demand_trigger_score":50,"note":"Highest consumer threshold in the country; unique affirmative defense for businesses substantially complying with the NIST privacy framework. 60-day cure.","verification_status":"multi_source","source_basis":"mn-lrl-guide-2026;mukul975/privacy-data-protection-skills;computerweekly-2025;eigenlegal/counsel-os","collected_at":"2026-09-30","row_hash":"dc1ce7dc60ad3948"},{"law_id":"mn_mcdpa","state":"Minnesota","state_code":"MN","state_fips":"27","country_code":"USA","law_name":"Minnesota Consumer Data Privacy Act","law_short":"MCDPA","status":"in_effect","effective_date":"2025-07-31","days_until_effective":-426,"years_in_effect":1.17,"threshold_consumers":100000,"threshold_note":"100,000 consumers; or 25,000+ if >25% of revenue from sale of personal data.","private_right_of_action":"none","enforcement":"AG","universal_optout_required":"yes","demand_trigger_score":65,"note":"Adds a right to question profiling/automated-decision outcomes. Universal opt-out required.","verification_status":"multi_source","source_basis":"mn-lrl-guide-2026;mukul975/privacy-data-protection-skills;wnallen/dpia-generator;kenkaiii/gg-framework","collected_at":"2026-09-30","row_hash":"ffed803cb0f26cae"},{"law_id":"md_modpa","state":"Maryland","state_code":"MD","state_fips":"24","country_code":"USA","law_name":"Maryland Online Data Privacy Act","law_short":"MODPA","status":"in_effect","effective_date":"2025-10-01","days_until_effective":-364,"years_in_effect":1.0,"threshold_consumers":35000,"threshold_note":"35,000 consumers; or 10,000+ if >=20% of revenue from sale of personal data.","private_right_of_action":"none","enforcement":"AG","universal_optout_required":"yes","demand_trigger_score":85,"note":"Strictest substantive law: data minimization by default, bans sale of sensitive data, heightened protections regardless of threshold. Universal opt-out required.","verification_status":"multi_source","source_basis":"mn-lrl-guide-2026;mukul975/privacy-data-protection-skills;computerweekly-2025;kenkaiii/gg-framework","collected_at":"2026-09-30","row_hash":"a68bc113cc0753a1"},{"law_id":"in_incdpa","state":"Indiana","state_code":"IN","state_fips":"18","country_code":"USA","law_name":"Indiana Consumer Data Protection Act","law_short":"INCDPA","status":"in_effect","effective_date":"2026-01-01","days_until_effective":-272,"years_in_effect":0.74,"threshold_consumers":100000,"threshold_note":"100,000 consumers; or 25,000+ if >50% of gross revenue from sale of personal data. Enacted 2023-05-01.","private_right_of_action":"none","enforcement":"AG","universal_optout_required":"no","demand_trigger_score":65,"note":"Virginia-model law; 30-day cure period. AG enforcement.","verification_status":"multi_source","source_basis":"mn-lrl-guide-2026;jdsupra-foster-swift-2026-01;mukul975/privacy-data-protection-skills;eigenlegal/counsel-os","collected_at":"2026-09-30","row_hash":"fc7a1cee6ffa0e54"},{"law_id":"ky_kcdpa","state":"Kentucky","state_code":"KY","state_fips":"21","country_code":"USA","law_name":"Kentucky Consumer Data Protection Act","law_short":"KCDPA","status":"in_effect","effective_date":"2026-01-01","days_until_effective":-272,"years_in_effect":0.74,"threshold_consumers":100000,"threshold_note":"100,000 consumers; or 25,000+ if >50% of gross revenue from sale of personal data. Enacted 2024-04-04.","private_right_of_action":"none","enforcement":"AG","universal_optout_required":"no","demand_trigger_score":65,"note":"Virginia-model law; 30-day cure period. AG enforcement.","verification_status":"multi_source","source_basis":"mn-lrl-guide-2026;jdsupra-foster-swift-2026-01;mukul975/privacy-data-protection-skills;eigenlegal/counsel-os","collected_at":"2026-09-30","row_hash":"87d0c80e6c606dd6"},{"law_id":"ri_ridtppa","state":"Rhode Island","state_code":"RI","state_fips":"44","country_code":"USA","law_name":"Rhode Island Data Transparency and Privacy Protection Act","law_short":"RIDTPPA","status":"in_effect","effective_date":"2026-01-01","days_until_effective":-272,"years_in_effect":0.74,"threshold_consumers":35000,"threshold_note":"35,000 consumers (payment-transaction data excluded); or 10,000+ if >20% of gross revenue from sale of personal data.","private_right_of_action":"none","enforcement":"AG","universal_optout_required":"no","demand_trigger_score":75,"note":"Applies to for-profit entities; 19th/20th comprehensive law (enacted 2024, replacing vetoed Vermont bill in the count).","verification_status":"multi_source","source_basis":"mn-lrl-guide-2026;jdsupra-foster-swift-2026-01;herzoglaw-2024;mukul975/privacy-data-protection-skills","collected_at":"2026-09-30","row_hash":"dc60253117ecd475"},{"law_id":"ok_ocdpa","state":"Oklahoma","state_code":"OK","state_fips":"40","country_code":"USA","law_name":"Oklahoma Consumer Data Protection Act","law_short":"OCDPA","status":"upcoming","effective_date":"2027-01-01","days_until_effective":93,"years_in_effect":null,"threshold_consumers":100000,"threshold_note":"Virginia-model thresholds assumed: 100,000 consumers; or 25,000+ if >50% of revenue from sale. SB 546 signed 2026-03-20; narrow monetary-consideration-only definition of 'sale'.","private_right_of_action":"none","enforcement":"AG","universal_optout_required":"no","demand_trigger_score":45,"note":"Twentieth comprehensive law after a seven-year legislative push. AG enforcement; data-protection-assessment duty.","verification_status":"multi_source","source_basis":"eigenlegal/counsel-os;wnallen/dpia-generator;jdsupra-state-update-2026-07","collected_at":"2026-09-30","row_hash":"33ddc1059597cda8"}]