These are the 13 states with comprehensive consumer privacy protection laws

Emma Rubin
A busy street in Hollywood.
Canva

- California Consumer Privacy Rights Act
- Effective beginning Jan. 1, 2023

Covers the following:
- Right to access
- Right to correct
- Right to delete
- Right to opt out of certain processing: For sensitive data
- Right to portability
- Right to opt out of sales
- Right against automated decision-making
- Private right of action
- Opt-in default (requirement age): 16
- Notice/transparency requirement
- Risk assessments
- Prohibition on discrimination (exercising rights)
- Purpose/processing limitation

California
The Denver skyline.
Canva

- Colorado Privacy Act
- Effective beginning July 1, 2023

Covers the following:
- Right to access
- Right to correct
- Right to delete
- Right to opt out of certain processing: For profiling/targeted advertising purposes
- Right to portability
- Right to opt out of sales
- Right against automated decision-making: Certain decision making
- Opt-in default (requirement age): 13 for sensitive data
- Notice/transparency requirement
- Risk assessments
- Prohibition on discrimination (exercising rights)
- Purpose/processing limitation

Colorado
The ornate historic Capitol building in Hartford with a gold dome on top.
Canva

- Personal Data Privacy and Online Monitoring
- Effective beginning July 1, 2023

Covers the following:
- Right to access
- Right to correct
- Right to delete
- Right to opt out of certain processing: For profiling/targeted advertising purposes
- Right to portability
- Right to opt out of sales
- Right against automated decision-making: Certain decision making
- Opt-in default (requirement age): 13 for sensitive data
- Notice/transparency requirement
- Risk assessments
- Prohibition on discrimination (exercising rights)
- Purpose/processing limitation

Connecticut
Aerial view of the capitol building in Salt Lake City.
Canva

- Utah Consumer Privacy Act
- Effective beginning Dec. 31, 2023

Covers the following:
- Right to access
- Right to delete
- Right to opt out of certain processing: For profiling/targeted advertising purposes
- Right to portability
- Right to opt out of sales
- Opt-in default (requirement age): 13
- Notice/transparency requirement
- Prohibition on discrimination (exercising rights)

Utah
Richmond in the evening.
Canva

- Consumer Data Protection Act
- Effective beginning Jan. 1, 2023

Covers the following:
- Right to access
- Right to correct
- Right to delete
- Right to opt out of certain processing: For profiling/targeted advertising purposes
- Right to portability
- Right to opt out of sales
- Right against automated decision-making: Certain decision making
- Opt-in default (requirement age): 13 for sensitive data
- Notice/transparency requirement
- Risk assessments
- Prohibition on discrimination (exercising rights)
- Purpose/processing limitation

Virginia
The capitol building in Dover.
Canva

- Delaware Personal Data Privacy Act
- Effective beginning Jan. 1, 2025

Covers the following:
- Right to access
- Right to correct
- Right to delete
- Right to opt out of certain processing: For profiling/targeted advertising purposes
- Right to portability
- Right to opt out of sales
- Right against automated decision-making
- Opt-in default (requirement age): 17
- Notice/transparency requirement
- Risk assessments
- Prohibition on discrimination (exercising rights)
- Purpose/processing limitation

Delaware
Downtown Indianapolis.
Canva

- Indiana Consumer Data Protection Act
- Effective beginning Jan. 1, 2026

Covers the following:
- Right to access
- Right to correct
- Right to delete
- Right to opt out of certain processing: For profiling/targeted advertising purposes
- Right to portability
- Right to opt out of sales
- Right against automated decision-making: Certain decision making
- Notice/transparency requirement
- Risk assessments
- Prohibition on discrimination (exercising rights)
- Purpose/processing limitation

Indiana
The Des Moines skyline at sunset.
Canva

- Iowa Consumer Data Protection Act
- Effective beginning Jan. 1, 2025

Covers the following:
- Right to access
- Right to delete
- Right to portability
- Right to opt out of sales
- Opt-in default (requirement age): 13 for sensitive data
- Notice/transparency requirement
- Prohibition on discrimination (exercising rights)
- Purpose/processing limitation

Iowa
An aerial view of Billings at sunset.
Canva

- Montana Consumer Data Privacy Act
- Effective beginning Oct. 1, 2024

Covers the following:
- Right to access
- Right to correct
- Right to delete
- Right to opt out of certain processing: For profiling/targeted advertising purposes
- Right to portability
- Right to opt out of sales
- Right against automated decision-making: Certain decision making
- Opt-in default (requirement age): 13 for sensitive data
- Notice/transparency requirement
- Risk assessments
- Prohibition on discrimination (exercising rights)
- Purpose/processing limitation

Montana
An aerial view of the capitol building in Trenton with the Delaware River in the background.
Canva

- Senate Bill 332
- Effective beginning Jan. 15, 2025

Covers the following:
- Right to access
- Right to correct
- Right to delete
- Right to opt out of certain processing: For profiling/targeted advertising purposes
- Right to portability
- Right to opt out of sales
- Right against automated decision-making: Certain decision making
- Opt-in default (requirement age): 13 for sensitive data
- Notice/transparency requirement
- Risk assessments
- Prohibition on discrimination (exercising rights)
- Purpose/processing limitation

New Jersey
The capitol building in Salem with blossoming cherry trees lining the lawn.
Canva

- Oregon Consumer Privacy Act
- Effective beginning July 1, 2024

Covers the following:
- Right to access
- Right to correct
- Right to delete
- Right to opt out of certain processing: For profiling/targeted advertising purposes
- Right to portability
- Right to opt out of sales
- Right against automated decision-making: Certain decision making
- Opt-in default (requirement age): 13 for sensitive data
- Notice/transparency requirement
- Risk assessments
- Prohibition on discrimination (exercising rights)
- Purpose/processing limitation

Oregon
The Nashville skyline.
Canva

- Tennessee Information Protection Act
- Effective beginning July 1, 2025

Covers the following:
- Right to access
- Right to correct
- Right to delete
- Right to opt out of certain processing: For profiling/targeted advertising purposes
- Right to portability
- Right to opt out of sales
- Right against automated decision-making: Certain decision making
- Opt-in default (requirement age): 13 for sensitive data
- Notice/transparency requirement
- Risk assessments
- Prohibition on discrimination (exercising rights)
- Purpose/processing limitation

Tennessee
The skyline in Austin with the capitol in the background.
Canva

- Texas Data Privacy and Security Act
- Effective beginning July 1, 2024

Covers the following:
- Right to access
- Right to correct
- Right to delete
- Right to opt out of certain processing: For profiling/targeted advertising purposes
- Right to portability
- Right to opt out of sales
- Right against automated decision-making: Certain decision making
- Opt-in default (requirement age): 13 for sensitive data
- Notice/transparency requirement
- Risk assessments
- Prohibition on discrimination (exercising rights)
- Purpose/processing limitation

Story editing by Shannon Luders-Manuel. Copy editing by Kristen Wegrzyn.

Texas
A woman using a laptop in a cafe.
Canva