U.S. State Privacy Laws You Probably Didn’t Know Apply to You

 

Most people assume that only California has strong privacy laws. That’s no longer true. Over the past few years, many U.S. states have passed their own privacy acts, each with different rules about how companies collect, store, and share your personal data. Some laws protect how businesses use your information, while others give you the right to see, correct, or delete it.

If you’ve ever filled out an online form, made a purchase on a website, or signed up for a loyalty program, your information may already fall under a state privacy law — even if you live somewhere else.

This guide breaks down what’s happening across the United States, how these laws affect you, and what rights you might not know you already have.

Why State Privacy Laws Matter

Before diving into specific states, it helps to understand why privacy laws exist and how they shape your everyday online and offline experiences. This section explains the growing importance of data protection and why more states are stepping in to fill the federal gap.

Privacy laws are no longer just about cookie pop-ups. They shape how your personal information is handled behind the scenes, everything from your browsing history and contact details to your purchase records and online habits.

When states create their own privacy laws, they do it to fill the gap left by the absence of a single national privacy law. That means protections now depend on where you live, where a company is based, or even where the company’s customers are located.

A 2024 report from the International Association of Privacy Professionals (IAPP) found that over 70% of U.S. residents are now covered under some form of state-level privacy law. That number will rise to 80% by 2026 as more states pass new regulations like those in New Jersey, Delaware, and Indiana.

For example, a retailer based in Colorado must follow Colorado’s privacy rules for its residents, even if you shop from another state. This overlapping system makes privacy rights both complex and interesting because it often affects more people than expected.

States Leading the Way

Each state has taken its own approach to data privacy. Some laws give you stronger rights to control your data, while others balance consumer protection with business needs. Here’s how key states are setting the standard for privacy in the U.S.

1. California Consumer Privacy Act (CCPA) and CPRA

California started it all with the California Consumer Privacy Act (CCPA) in 2020. It was later expanded under the California Privacy Rights Act (CPRA). Together, they give residents the right to know what personal data companies collect, request that it be deleted, and opt out of the sale or sharing of their information.

Even non-California residents benefit indirectly. Many large companies apply these rules to all U.S. users to avoid maintaining different privacy systems per state. If you’ve noticed clearer privacy policies or “Do Not Sell My Info” links on websites, this law is the reason.

2. Virginia Consumer Data Protection Act (VCDPA)

Virginia followed soon after. Its law, known as the VCDPA, went into effect in 2023. It allows residents to access, correct, and delete personal data. It also gives people the right to opt out of targeted advertising or profiling.

What makes Virginia’s approach interesting is that it only applies to companies handling data from a certain number of consumers or earning a set amount from selling personal information. So, small businesses may not be covered but the bigger brands you interact with likely are.

3. Colorado Privacy Act (CPA)

Colorado’s privacy act mirrors some parts of California and Virginia’s laws but adds unique touches. The CPA gives consumers the right to access, delete, and correct their information and opt out of both targeted ads and data sales.

Colorado also focuses on data controllers, wherein the companies deciding how and why your data is used. They’re required to conduct regular assessments to prove that data use is fair and necessary. That’s an extra level of accountability that benefits consumers whether or not they live in Colorado.

4. Connecticut Data Privacy Act (CTDPA)

Connecticut’s privacy act covers many familiar rights, including access, correction, and deletion. It also lets consumers opt out of targeted advertising, profiling, and data sales.

What sets Connecticut apart is its focus on children’s data. Companies must get consent before collecting information from minors under 16. This is especially relevant for families who let their kids use apps, play online games, or join social platforms.

5. Utah Consumer Privacy Act (UCPA)

Utah’s privacy law is more business-friendly but still gives consumers basic control. Residents can request access to their personal data, ask for deletion, and opt out of selling or sharing it.

Unlike other states, Utah doesn’t require companies to allow corrections to data or conduct privacy assessments. Still, it sets a clear expectation that personal information belongs to the consumer, not the company.

6. Oregon Consumer Privacy Act (OCPA)

Oregon’s privacy law is newer, taking effect in 2024. It brings together ideas from earlier laws and adds strong consumer rights. Residents can see, fix, or erase personal data and limit its use for targeted ads.

Oregon also protects nonprofit organizations, which means charities and associations must follow privacy standards similar to for-profit companies. That’s rare among state laws.

7. Texas Data Privacy and Security Act (TDPSA)

Texas joined the list in 2024. Its TDPSA shares many features with Colorado’s law but uses broader language about “data sales.” If you’re a Texas resident, you can ask companies to stop sharing your data for advertising or analytics.

Texas also requires businesses to post clear privacy notices online and honor opt-out requests quickly. If you’ve seen more websites showing clear “opt out” buttons lately, that’s partly because of Texas rules.

Other States Making Progress

Privacy regulations are spreading fast. This section lists other states that are either enforcing or finalizing their own privacy laws, showing how the U.S. is moving closer to nationwide data protection.

A growing number of states have passed or are working on similar laws. These include Montana, Tennessee, Delaware, Iowa, New Jersey, Indiana, and New Hampshire. Some are still finalizing enforcement dates, but many will become active soon.

This patchwork of laws means companies operating across the U.S. must adapt quickly. For consumers, it means stronger data rights — even if you live somewhere that hasn’t passed its own privacy law yet.

How These Laws Affect You

Now that you’ve seen which states have privacy protections, this section explains how these laws directly impact your day-to-day life — from what information companies can store to what you can ask them to delete or stop sharing.

1. You Gain the Right to Know

Most state privacy laws give you the right to know what data a company has about you. That includes names, addresses, emails, purchase records, and online identifiers like cookies or device IDs.

You can request this information, and companies must respond within a set period — often 45 days. That means you can finally see what’s being tracked about you and how it’s used.

2. You Can Request Deletion or Correction

If your information is outdated or inaccurate, these laws allow you to ask for corrections or deletion. This helps prevent data errors that can affect credit checks, marketing messages, or even job applications.

For example, if a retailer keeps sending you promotions after you’ve opted out, you can request that your data be deleted under your state’s privacy law. In most cases, the company must honor that within 45 days.

Some states also give you the right to portability, which lets you ask a company to send your data to another provider. That could mean moving your information between online services more easily.

3. You Can Say “No” to Data Sharing

Opting out of data sharing is a major win for consumers. You can refuse targeted ads, stop companies from selling your information, or block profiling used for automated decisions.

Most laws require companies to provide an easy way to opt out — usually through website links or browser settings. When you click “Do Not Sell My Information,” you’re exercising this right.

4. You Benefit from Stricter Security

Even if you don’t make requests or opt out, these laws still work in your favor. Businesses must secure data using reasonable methods, disclose breaches, and avoid collecting unnecessary information.

Some laws also demand that companies assess their privacy risks regularly and show regulators how they protect personal data. This keeps businesses more accountable and helps prevent the misuse of personal information.

Common Misunderstandings About Privacy Laws

Many people assume privacy laws only matter for big tech companies or residents of certain states. This section clears up common misconceptions and explains why these protections extend to nearly everyone who shares information online.

“I’m Not in That State, So It Doesn’t Apply to Me”

You might think only residents benefit, but that’s not always true. Many companies apply these protections nationwide to simplify compliance. If a large company sells products or services across states, it’s easier for them to give everyone the same level of protection.

So, even if your state hasn’t passed its own privacy act yet, there’s a good chance you’re already covered by another state’s rules indirectly.

“It’s Only for Tech Companies”

Privacy laws affect more than social media or e-commerce platforms. Retail stores, real estate agencies, healthcare providers, and financial institutions all collect personal data and must follow these rules.

That means privacy protections extend to your gym membership, travel booking, or local online order. Anywhere you share your name, phone number, or email address — privacy laws may apply.

A local dental office collecting your contact information for reminders or promotions also falls under these rules. You can ask them to stop sharing your data with third-party marketing vendors.

“It’s Only About Online Tracking”

While cookies and ad targeting get most of the attention, state privacy laws cover more than web tracking. They apply to any personal information stored or shared electronically. That includes data collected from loyalty cards, customer support systems, or even surveillance systems in stores.

These laws treat personal data broadly, which gives consumers protection across digital and physical touchpoints.

States Without Comprehensive Privacy Laws

Some states haven’t passed broad privacy acts yet, but discussions are happening everywhere. This section explains which states are still in progress and how their limited protections still affect consumers.

Not every state has passed a comprehensive privacy law yet, but discussions are ongoing in places like Florida, Illinois, and New York. Some states rely on narrower protections that cover specific types of data, such as health records or children’s information.

The growing trend suggests that most states will eventually adopt full privacy frameworks, bringing the U.S. closer to a nationwide standard.

How to Use Your Rights

Knowing your rights is one thing; using them is another. This section walks you through simple steps to request, correct, or delete your data — plus what to do if a company doesn’t respond.

1. Check a company’s privacy policy. Look for “Your Privacy Rights,” “Do Not Sell,” or “Data Requests.”
2. Submit a request. Most companies have online forms or email addresses for privacy inquiries.
3. Verify your identity. You might be asked to confirm who you are before they process your request.
4. Follow up. Companies usually have 45 days to respond, and you can ask for confirmation once your request is completed.

If a company ignores your request, many states let you appeal directly to their attorney general’s office. Find your state attorney general’s contact list. That adds another layer of accountability.

According to a Pew Research Center study, 79% of Americans are concerned about how companies use their personal data, yet only 27% feel they fully understand what companies actually do with it. These laws aim to close that gap by giving consumers more visibility and control.

If you’re curious about what personal data is publicly available, there are tools that can help you check. Searchbug follows strict privacy standards and complies with both federal and state laws, including the California Consumer Privacy Act (CCPA). Users can review the company’s Privacy Policy for details on how data is handled or opt out of data sharing under CCPA if they prefer.

Searchbug also offers a free People Search that allows individuals to see what public information is associated with their own name. While the search requires a valid payment method for verification, there is no charge for the search itself. This verification step prevents fraud, supports Know Your Customer (KYC) compliance, and protects users from unauthorized access.

Final Thoughts

State privacy laws may sound complicated, but their purpose is simple — to give you more control over your information. Even if your state hasn’t passed a law yet, the trend is moving toward nationwide protection through overlapping state efforts.

Each new law adds a piece to the puzzle, strengthening how businesses handle data and how consumers can demand accountability.

So next time you see a privacy notice pop up or a “Do Not Sell My Info” button, don’t scroll past it. That’s your opportunity to exercise your rights — rights that more states are working hard to protect.

For businesses handling customer outreach or telemarketing, understanding privacy rules also helps prevent unwanted violations. Tools that verify phone numbers and check Do Not Call lists can make TCPA compliance easier under both state privacy laws and TCPA regulations.