Consumer privacy rights by state
Compare the researched consumer privacy provisions across all 50 states and DC. The table distinguishes current rights, future dates and unresolved fields.
What does the table establish?
General information, not legal advice. Consumer privacy statutes and public-record exemptions address different data. Read each law's public-information exclusion before relying on deletion.
Scope. 51 jurisdiction rows. Version 1.1. Last verified October 24, 2026.
| Jurisdiction | Law | Citation | Effective date | Right to delete | Opt out sale sharing | Global privacy signal | Authorized agent | Agent proof | Publicly available exemption | Broker registry | State deletion platform | Other protection established by this review | Source and check date |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Alabama | Alabama Personal Data Protection Act. Enacted rights begin May 1, 2027. Source | Alabama Code chapter 8-44; Act 2026-552. Source | May 1, 2027. Enacted future law. Source | Covered right to delete personal data concerning the consumer. Statutory exceptions and compliance alternatives apply. This right begins May 1, 2027. Source | Covered opt-outs for targeted advertising, sale and qualifying profiling. The profiling provision specifies solely automated decisions with legal or similarly significant effects. These rights begin May 1, 2027. Source | Not determined within the reviewed source scope. | The enacted section permits a known child's parent or legal guardian, or a consumer's guardian or conservator, to exercise the listed opt-outs. This finding does not establish a general adult-agent procedure. The provision begins May 1, 2027. Source | The enacted provision requires commercially reasonable authentication of consumer requests and permits necessary additional information. Its opt-out fraud qualification is separate. The provision begins May 1, 2027. Source | The enacted definition includes specified government records, widely distributed media and information the controller reasonably believes the consumer made public. Consumer-rights provisions begin May 1, 2027. Source | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | alison.legislature.state.al.us Checked 2026-10-24 |
| Alaska | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | The Alaska Attorney General lists the Alaska Personal Information Protection Act, AS45.48.010-.090. This is a security-breach source, not an omnibus-rights determination. Source | law.alaska.gov Checked 2026-10-24 |
| Arizona | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | The reviewed Arizona statute addresses investigation and notification of security-system breaches. It is not a general broker-deletion rule. Source | www.azleg.gov Checked 2026-10-24 |
| Arkansas | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Arkansas's official guidance requires reasonable security practices and notice to affected individuals. The Attorney General receives qualifying breach reports. Source | arkansasag.gov Checked 2026-10-24 |
| California | California Consumer Privacy Act, as amended by the California Privacy Rights Act. Source | California Civil Code sections 1798.100 through 1798.199.100; 11 CCR section 7063 for the cited agent rule. Source | January 1, 2023 for CPRA amendments. This is not the CCPA original enactment date. Source | Covered right to request deletion of personal information, subject to CCPA exceptions and verification requirements. Source | Covered opt-out of sale and sharing for cross-context behavioral advertising. Source | Covered businesses must honor qualifying opt-out preference signals Source | California regulations permit an authorized agent to submit deletion, correction and knowledge requests under section 7063. Other request types have their own rules. Source | For deletion, correction and knowledge requests, the business may require signed permission and direct consumer identity verification or direct confirmation of permission. The power-of-attorney exception applies, but a business cannot require a power of attorney merely to use an agent. Source | Personal information excludes publicly available information Source | CalPrivacy publishes an annual Data Broker Registry. The current registry covers businesses reporting 2025 activities. The dynamic page display does not establish an independently verified broker count. Source | DROP accepts eligible California residents' broker-deletion requests. Broker processing began August 1, 2026. Brokers must access it at least every 45 days, and status updates can take up to 90 days. Source | Not determined within the reviewed source scope. | California Privacy Protection Agency FAQs Checked 2026-10-24 |
| Colorado | Colorado Privacy Act. Source | Colorado Revised Statutes sections 6-1-1301 through 6-1-1314. Source | July 1, 2023. The universal opt-out requirement began July 1, 2024. Source | Covered right to delete personal data concerning the consumer. Statutory exceptions and compliance alternatives apply. Source | Covered opt-outs for targeted advertising, sale and qualifying profiling. The statutory profiling definition and exceptions apply. Source | Covered controllers must honor qualifying opt-out mechanisms or signals beginning July 1, 2024. Technical, consent and statutory conditions apply. Source | A consumer may designate another person to exercise the statutory opt-outs. This finding does not establish an agent right to exercise every consumer request. Source | The controller must be able to verify or authenticate identity and the agent's authority with commercially reasonable effort. Source | Personal data excludes publicly available information. The definition includes specified government records and information the controller reasonably believes the consumer made public. Source | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Colorado Attorney General CPA information Checked 2026-10-24 |
| Connecticut | Connecticut consumer-data privacy provisions, sections 42-515 through 42-526, including amendments operative July 1, 2026. Source | Connecticut General Statutes sections 42-515 through 42-526, with the 2026 supplement. Source | July 1, 2023 for the original framework. The cited amended definitions and provisions became operative July 1, 2026. Source | Covered right to delete personal data provided by or obtained about the consumer. Statutory exceptions and compliance alternatives apply. Source | Covered opt-outs for targeted advertising, sale and qualifying profiling. The profiling provision reaches any automated decision with the specified effects. Source | Covered controllers must honor qualifying opt-out mechanisms or signals beginning January 1, 2025. Technical, consent and statutory conditions apply. Source | A consumer may designate another person to exercise the statutory opt-outs. This finding does not establish an agent right to exercise every consumer request. Source | The controller must be able to verify or authenticate identity and the agent's authority with commercially reasonable effort. Source | The current definition includes specified government records, consumer-public information and widely distributed media. It excludes identified biometric data collected without consumer consent. Source | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | www.cga.ct.gov Checked 2026-10-24 |
| Delaware | Delaware Personal Data Privacy Act. Source | 6 Delaware Code chapter 12D. Source | January 1, 2025. Qualifying opt-out signals became mandatory January 1, 2026. Source | Covered right to delete personal data provided by or obtained about the consumer. Statutory exceptions and compliance alternatives apply. Source | Covered opt-outs for targeted advertising, sale and qualifying profiling. The profiling provision specifies solely automated decisions with legal or similarly significant effects. Source | Covered controllers must honor qualifying opt-out mechanisms or signals beginning January 1, 2026. Technical, consent and statutory conditions apply. Source | A consumer may designate another person to exercise the statutory opt-outs. This finding does not establish an agent right to exercise every consumer request. Source | The controller must be able to verify or authenticate identity and the agent's authority with commercially reasonable effort. Source | The definition includes lawfully available government records and information the controller reasonably believes the consumer made public through widely distributed media. Source | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | delcode.delaware.gov Checked 2026-10-24 |
| District of Columbia | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | The reviewed District of Columbia provision requires notification of a security breach. Its notification duties are distinct from consumer deletion requests. Source | code.dccouncil.gov Checked 2026-10-24 |
| Florida | Florida Digital Bill of Rights. The law has a limited controller definition and statutory applicability conditions. Source | Florida Statutes sections 501.701 through 501.719. Source | July 1, 2024. Source | Covered right to delete personal data provided by or obtained about the consumer. Statutory exceptions and compliance alternatives apply. Source | Covered opt-outs for targeted advertising, sale and qualifying profiling. The statutory profiling definition and exceptions apply. Source | Not determined within the reviewed source scope. | Section 501.705(1) expressly allows a known child's parent or legal guardian to exercise rights for the child. This excerpt does not establish a general adult-agent procedure. Source | Not determined within the reviewed source scope. | The personal-data definition excludes publicly available information. Section 501.702(28) includes government records and specified information made public through media or permitted consumer disclosure. Source 1 · Source 2 | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | www.myfloridalegal.com Checked 2026-10-24 |
| Georgia | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Georgia's Attorney General publishes consumer guidance about online tracking. This reviewed guidance supports practical tracking information, not a conclusion about an omnibus state privacy law. Source | consumer.georgia.gov Checked 2026-10-24 |
| Hawaii | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Hawaii's reviewed statute requires security-breach notice to affected persons and applies to specified businesses and government agencies. Source | data.capitol.hawaii.gov Checked 2026-10-24 |
| Idaho | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Idaho's Attorney General explains Title28, chapter51 security-breach duties. State public agencies have a 24-hour Attorney General notice requirement. Source | www.ag.idaho.gov Checked 2026-10-24 |
| Illinois | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Illinois BIPA requires a public retention/destruction policy for covered biometrics, tied to the initial purpose or three years after the last interaction. This is a biometric-specific rule. Source | www.ilga.gov Checked 2026-10-24 |
| Indiana | Indiana Consumer Data Protection Act. Source | Indiana Code article 24-15, as described in the Attorney General's consumer guide. Source | January 1, 2026. Source | Covered right to delete personal data provided by or obtained about the consumer. Statutory exceptions and compliance alternatives apply. Source | Covered opt-outs for targeted advertising, sale and qualifying profiling. The statutory profiling definition and exceptions apply. Source | Not determined within the reviewed source scope. | The Attorney General explains that exercising another adult's rights requires a power of attorney or other legal authorization. The guidance separately recognizes rights for a child. Source | Controllers comply with authenticated requests. The Attorney General explains that a power of attorney or other legal authorization is needed to act for another adult. Source | The Attorney General explains that personal data excludes publicly available information, including specified government records, media and unrestricted consumer disclosures. Source | Not determined within the reviewed source scope. | The Attorney General states that no single centralized deletion request is available under the CDPA. A consumer submits requests directly to individual data holders. Source | Not determined within the reviewed source scope. | www.in.gov Checked 2026-10-24 |
| Iowa | Iowa Code chapter 715D, Consumer Data Protections. Source | Iowa Code chapter 715D. Source | January 1, 2025. Source | Covered right to delete personal data the consumer provided to the controller. Statutory exceptions apply. Source | Covered right to opt out of sale of personal data under section 715D.3. Source | Not determined within the reviewed source scope. | The reviewed section expressly permits a known child's parent or legal guardian to exercise the child's rights. It does not establish a general adult-agent procedure. Source | Consumer requests require commercially reasonable authentication. The controller may request necessary additional information. The reviewed section does not provide separate adult-agent proof criteria. Source | The definition includes specified government records, media, consumer-public information and unrestricted disclosures. The statutory audience restriction matters. Source | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | www.legis.iowa.gov Checked 2026-10-24 |
| Kansas | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Kansas's reviewed provision requires a reasonable prompt security-breach investigation and qualifying notice to affected Kansas residents. Source | kslegislature.gov Checked 2026-10-24 |
| Kentucky | Kentucky Consumer Data Protection Act. Source | Kentucky Revised Statutes sections 367.3611 through 367.3629. Source | January 1, 2026. Source | Covered right to delete personal data provided by or obtained about the consumer. Statutory exceptions and compliance alternatives apply. Source | Covered opt-outs for targeted advertising, sale and qualifying profiling. The statutory profiling definition and exceptions apply. Source | Not determined within the reviewed source scope. | Section 367.3615(1) expressly allows a child's parent or legal guardian to exercise the child's rights. The reviewed section does not establish a general adult-agent procedure. Source | The reviewed section requires commercially reasonable authentication of consumer requests and permits necessary additional information. It does not specify separate adult-agent proof criteria. Source | Personal data excludes deidentified data and publicly available information, including public records. Source | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | www.ag.ky.gov Checked 2026-10-24 |
| Louisiana | Louisiana Data Privacy Act. Enacted rights begin January 1, 2027. Source | Louisiana Act 502 of 2026, SB 386. Source | January 1, 2027. Enacted future law. Source | Covered right to delete personal data provided by or obtained about the consumer. Statutory exceptions and compliance alternatives apply. This right begins January 1, 2027. Source | Covered opt-outs for targeted advertising, sale and qualifying profiling. The statutory profiling definition and exceptions apply. These rights begin January 1, 2027. Source | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | The enacted definition includes specified government records, media and unrestricted consumer disclosures. Consumer-rights provisions begin January 1, 2027. Source | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | www.legis.la.gov Checked 2026-10-24 |
| Maine | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Maine's enacted 2019 law concerns broadband Internet access service customer information. This row distinguishes that sector-specific law from an omnibus-rights determination. Source | legislature.maine.gov Checked 2026-10-24 |
| Maryland | Maryland Online Data Privacy Act. Current codification begins at Commercial Law section 14-4701. Source 1 · Source 2 · Source 3 | Maryland Commercial Law sections 14-4701 through 14-4713. The enacted 2024 act used different section numbering. Source 1 · Source 2 · Source 3 | October 1, 2025. Source | Covered right to delete personal data provided by or obtained about the consumer. Statutory exceptions and compliance alternatives apply. Retention required by law remains permitted. Source | Covered opt-outs for targeted advertising, sale and qualifying profiling. The profiling provision specifies solely automated decisions with legal or similarly significant effects. Source | Section 14-4706 allows agent designation through a browser setting, extension, global-device setting or similar technology. Authentication conditions apply. This finding does not label every signal unconditionally sufficient. Source | A consumer may designate an individual to exercise the listed opt-outs. The agent may be designated through the specified Internet, browser or device technology. Source | The controller must be able to authenticate the consumer's identity and the agent's authority using commercially reasonable efforts. Source | Personal data excludes publicly available information. The current definition conditions government-record use on compliance with imposed restrictions and excludes specified biometric data collected without the consumer's knowledge. Source 1 · Source 2 | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | oag.maryland.gov Checked 2026-10-24 |
| Massachusetts | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Massachusetts's reviewed regulation establishes minimum safeguards for paper and electronic records containing residents' personal information. It applies to persons that own or license that information. Source | www.mass.gov Checked 2026-10-24 |
| Michigan | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Michigan's reviewed Identity Theft Protection Act provision governs qualifying security-breach notices. It is distinct from a general consumer broker-deletion right. Source | zeus-milenia.legislature.mi.gov Checked 2026-10-24 |
| Minnesota | Minnesota Consumer Data Privacy Act. Source | Minnesota Statutes sections 325M.10 through 325M.21. Source | July 31, 2025 generally. Specified postsecondary institutions have a July 31, 2029 compliance date. Source | Covered right to delete personal data concerning the consumer. Statutory exceptions and compliance alternatives apply. Source | Covered opt-outs for targeted advertising, sale and qualifying profiling. The profiling provision specifies automated decisions with the stated effects. Source | Covered controllers must allow qualifying opt-out preference signals for targeted advertising and sale. The statutory technical and consent conditions apply. Source | A consumer may designate another person for targeted-advertising and sale opt-outs. Qualifying browser and device technology can designate the agent. Source | The controller must be able to verify identity and the agent's authority with commercially reasonable effort. Source | Personal data excludes publicly available information. The definition includes specified government records, media and information the controller reasonably believes became lawfully public. Source | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | www.revisor.mn.gov Checked 2026-10-24 |
| Mississippi | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | The reviewed official Mississippi ITS contract expressly requires compliance with the state data-breach notification law at75-24-29. The contract does not establish general deletion or opt-out rights. Source | www.its.ms.gov Checked 2026-10-24 |
| Missouri | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | The official Revisor page's body requires qualifying breach notice. Its in-page heading is inconsistent with its page title and must not be treated as a clean statutory heading. Source | revisor.mo.gov Checked 2026-10-24 |
| Montana | Montana Consumer Data Privacy Act, Title 30, chapter 14, part 28. Source | Montana Code Annotated sections 30-14-2801 through 30-14-2820. Source | October 1, 2024. The cited current sections incorporate subsequent amendments. Source | Covered right to delete personal data concerning the consumer. Statutory exceptions and compliance alternatives apply. Source | Covered opt-outs for targeted advertising, sale and qualifying profiling. The profiling provision specifies automated decisions with the stated effects. Source | Covered controllers must honor qualifying opt-out mechanisms or signals beginning January 1, 2025. Technical, consent and statutory conditions apply. Source | A consumer may designate another person to exercise the statutory opt-outs. This finding does not establish an agent right to exercise every consumer request. Source | The controller must be able to verify or authenticate identity and the agent's authority with commercially reasonable effort. Source | The definition includes specified government records, widely distributed media and information the controller reasonably believes the consumer made public. Source | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | mca.legmt.gov Checked 2026-10-24 |
| Nebraska | Nebraska Data Privacy Act. Source | Nebraska Revised Statutes sections 87-1101 through 87-1130. Source | January 1, 2025. Source | Covered right to delete personal data provided by or obtained about the consumer. Statutory exceptions and compliance alternatives apply. Source | Covered opt-outs for targeted advertising, sale and qualifying profiling. The statutory profiling definition and exceptions apply. Source | Section 87-1111(5)-(6) permits technology-based opt-out designation subject to statutory verification and technical conditions. Source | A consumer may designate an agent for targeted-advertising and sale opt-outs. The statute permits qualifying browser and device technology. Source | The controller must be able to verify identity and authority with commercially reasonable effort. Listed statutory exceptions also apply. Source | The Attorney General explains that personal data excludes publicly available information and data not reasonably linkable to an individual. Source | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | protectthegoodlife.nebraska.gov Checked 2026-10-24 |
| Nevada | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Nevada's Attorney General describes a website link through which residents may request that private information not be sold. This source does not establish an omnibus deletion right. Source | ag.nv.gov Checked 2026-10-24 |
| New Hampshire | New Hampshire expectation-of-privacy provisions, RSA chapter 507-H. Source | New Hampshire RSA chapter 507-H. Source | January 1, 2025. The retained chapter separately labels provisions effective January 1, 2027. Source 1 · Source 2 | Covered right to delete personal data provided by or obtained about the consumer. Statutory exceptions and compliance alternatives apply. Source | Covered opt-outs for targeted advertising, sale and qualifying profiling. The profiling provision specifies solely automated decisions with legal or similarly significant effects. Source | Covered controllers must honor qualifying opt-out mechanisms or signals beginning January 1, 2025. Technical, consent and statutory conditions apply. Source | A consumer may designate another person to exercise the statutory opt-outs. This finding does not establish an agent right to exercise every consumer request. Source | The controller must be able to verify or authenticate identity and the agent's authority with commercially reasonable effort. Source | The statutory definition includes specified government records, widely distributed media and information the controller reasonably believes the consumer made public. Source | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | gc.nh.gov Checked 2026-10-24 |
| New Jersey | New Jersey consumer-data privacy law, P.L. 2023, chapter 266, with separate 2026 data-broker provisions. Source 1 · Source 2 · Source 3 | New Jersey Statutes sections 56:8-166.4 onward; P.L. 2026, chapter 25 for the broker registry. Source 1 · Source 2 · Source 3 | January 15, 2025. Calculated from the enacted January 16, 2024 approval date plus 365 days, accounting for leap year. Source | Covered right to delete personal data concerning the consumer. Statutory exceptions and compliance alternatives apply. Source | Covered opt-outs for targeted advertising, sale and qualifying profiling. The statutory profiling definition and exceptions apply. Source | Covered controllers must allow qualifying universal opt-out mechanisms no later than six months after the act's January 15, 2025 effective date. Statutory mechanism requirements apply. Source | A consumer may designate another person to exercise the statutory opt-outs, including through qualifying browser or device technology. Source | The controller must be able to verify identity and the agent's authority with commercially reasonable effort. Source | Personal data excludes publicly available information. The definition includes specified government records, widely distributed media and consumer-public information not restricted to a specific audience. Source 1 · Source 2 | P.L. 2026, chapter 25 directs the Division of Consumer Affairs to maintain a public registry of data brokers and data collectors. Approved June 30, 2026. The registry subsection remains inoperative for 270 days following enactment. No operational registry portal is established by this review. Source 1 · Source 2 | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | pub.njleg.state.nj.us Checked 2026-10-24 |
| New Mexico | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | New Mexico's enacted Data Breach Notification Act addresses notice, secure storage and disposal of personal identifying information. This source is the2017 enactment, not an omnibus-law absence finding. Source | www.nmlegis.gov Checked 2026-10-24 |
| New York | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | New York's Attorney General explains SHIELD Act breach-notice expansion and reasonable administrative, technical and physical safeguards. Source | ag.ny.gov Checked 2026-10-24 |
| North Carolina | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | North Carolina's reviewed statute requires qualifying security-breach notices without unreasonable delay, subject to its investigation and law-enforcement provisions. Source | ncleg.gov Checked 2026-10-24 |
| North Dakota | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | North Dakota's reviewed chapter is Notice of Security Breach for Personal Information. This chapter's subject does not establish an omnibus consumer-rights regime. Source | ndlegis.gov Checked 2026-10-24 |
| Ohio | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | The Ohio Attorney General explains that businesses and government entities must give notice when consumers' information is compromised. This is a breach-notice finding. Source | www.ohioattorneygeneral.gov Checked 2026-10-24 |
| Oklahoma | Oklahoma consumer-data privacy law, SB 546 of 2026. Enacted rights begin January 1, 2027. Source | Oklahoma SB 546 of 2026, including section 22 commencement. Source | January 1, 2027. Enacted future law. Source | Covered right to delete personal data provided by or obtained about the consumer. Statutory exceptions and compliance alternatives apply. This right begins January 1, 2027. Source | Covered opt-outs for targeted advertising, sale and qualifying profiling. The statutory profiling definition and exceptions apply. These rights begin January 1, 2027. Source | Not determined within the reviewed source scope. | The enacted section expressly permits a known child's parent or legal guardian to exercise the child's rights. This finding does not establish a general adult-agent mechanism. It begins January 1, 2027. Source | The enacted section requires commercially reasonable authentication of consumer requests and permits necessary additional information. It begins January 1, 2027. Source | The enacted definition includes specified government records, media and unrestricted consumer disclosures. The consumer-rights provisions begin January 1, 2027. Source | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | www.oklegislature.gov Checked 2026-10-24 |
| Oregon | Oregon Consumer Privacy Act. Source | Oregon Revised Statutes sections 646A.570 through 646A.589. Source | July 1, 2024 for covered for-profit businesses. July 1, 2025 for covered nonprofit entities. Source | Covered right to delete personal data concerning the consumer. Statutory exceptions and compliance alternatives apply. Source | Covered opt-outs for targeted advertising, sale and qualifying profiling. The statutory profiling definition and exceptions apply. Source | Covered controllers must honor qualifying opt-out mechanisms or signals beginning January 1, 2026. Technical, consent and statutory conditions apply. Source | An agent may exercise opt-outs for sale, targeted advertising and profiling. The law does not require a controller to accept an agent's other rights requests. Source | The controller must be able to verify identity and agent authority with commercially reasonable effort. The agent uses the method in the privacy notice. Source | The reviewed guidance distinguishes public-record mailing lists from mixed profiles combining public and private information. Publicly available data includes specified government, media and consumer-public information. Source | Oregon DCBS registers data brokers under HB 2052 of 2023. Covered brokers must register before collecting, selling or licensing brokered personal data within Oregon. Source | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | www.doj.state.or.us Checked 2026-10-24 |
| Pennsylvania | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Pennsylvania's Attorney General maintains an official data-breach reporting route under the Breach of Personal Information Notification Act. Source | www.attorneygeneral.gov Checked 2026-10-24 |
| Rhode Island | Rhode Island Data Transparency and Privacy Protection Act. Source | Rhode Island General Laws chapter 6-48.1. Source | January 1, 2026. Source | Covered right to delete personal data provided by or obtained about the consumer. Statutory exceptions and compliance alternatives apply. Source | Covered opt-outs for targeted advertising, sale and qualifying profiling. The profiling provision specifies solely automated decisions with legal or similarly significant effects. Source | Not determined within the reviewed source scope. | A consumer may designate another person to exercise the statutory opt-outs. This finding does not establish an agent right to exercise every consumer request. Source | The controller must be able to verify the customer's identity and the authorized agent's authority to act. Source | The definition includes specified government records, widely distributed media and information the controller reasonably believes the customer made public. Source | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | webserver.rilegislature.gov Checked 2026-10-24 |
| South Carolina | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | South Carolina's reviewed code provision governs security-breach notice to affected residents. This source does not determine general deletion, GPC or agent rules. Source | www.scstatehouse.gov Checked 2026-10-24 |
| South Dakota | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | South Dakota's reviewed statute generally requires qualifying breach disclosure within60 days and notice to the Attorney General above250 affected residents, subject to the statutory conditions. Source | sdlegislature.gov Checked 2026-10-24 |
| Tennessee | Tennessee Information Protection Act. Source | Tennessee Code sections 47-18-3301 through 47-18-3315. Source | July 1, 2025. Source | Covered right to request deletion of personal information obtained about the consumer. The reviewed guidance excludes aggregated and deidentified information. Source | Covered opt-outs for targeted advertising, sale and qualifying profiling. The statutory profiling definition and exceptions apply. Source | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | The reviewed definition excludes publicly available, deidentified and aggregated information from personal information. Source | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | www.tn.gov Checked 2026-10-24 |
| Texas | Texas Data Privacy and Security Act, Business and Commerce Code chapter 541. Source 1 · Source 2 | Texas Business and Commerce Code chapter 541. Source 1 · Source 2 | July 1, 2024 generally. Section 541.055(e), the agent and technology route, began January 1, 2025. Source | Covered right to delete personal data provided by or obtained about the consumer. Statutory exceptions and compliance alternatives apply. Source | Covered opt-outs for targeted advertising, sale and qualifying profiling. The statutory profiling definition and exceptions apply. Source | Section 541.055(e)-(f) permits technology-based agent opt-outs for targeted advertising and sale, subject to verification, technical and statutory exceptions. That subsection became effective January 1, 2025. Source | A consumer may designate another person for targeted-advertising and sale opt-outs under section 541.055(e). Listed verification and statutory exceptions apply. Source | The controller must be able to verify identity and the agent's authority with commercially reasonable effort. Section 541.055(e) also lists limited exceptions. Source | The definition includes specified government records and information made public through media, consumers or unrestricted disclosure. Personal data excludes publicly available information. Source 1 · Source 2 | The Secretary of State maintains a searchable central Data Broker Registry under Business and Commerce Code section 510.006. Source | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | tcss.legis.texas.gov Checked 2026-10-24 |
| Utah | Utah Consumer Privacy Act. Source | Utah Code Title 13, chapter 61. Source | December 31, 2023 for the act. The cited current rights section is operative July 1, 2026. Source | Covered right to delete personal data the consumer provided to the controller. Statutory exceptions apply. Source | Covered opt-outs for targeted advertising and sale of personal data. Source | Not determined within the reviewed source scope. | The reviewed section directs a known child's parent or guardian and a protected adult's guardian or conservator to exercise rights on that person's behalf. It does not establish a general adult-agent mechanism. Source | The controller may require necessary additional information if commercially reasonable authentication of a consumer request fails. The reviewed section does not specify separate adult-agent proof criteria. Source | The definition includes specified government records, media, consumer-public information and unrestricted disclosures. The statutory audience restriction matters. Source | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | le.utah.gov Checked 2026-10-24 |
| Vermont | Vermont Data Privacy and Online Surveillance Act. Enacted consumer rights begin January 1, 2028. Source | 9 Vermont Statutes Annotated chapter 61A; section 2446 for existing data-broker registration. Source | January 1, 2028 for the enacted consumer rights. Existing broker-registration rules have separate dates. Source | Covered right to delete personal data provided by or obtained about the consumer. Statutory exceptions and compliance alternatives apply. This right begins January 1, 2028. Source | Covered opt-outs for targeted advertising, sale and qualifying profiling. The profiling provision reaches any automated decision with the specified effects. These rights begin January 1, 2028. Source | The enacted future provision allows agent designation through qualifying browser, extension or global-device technology. Authentication requirements apply. This finding does not establish unconditional signal acceptance. It begins January 1, 2028. Source | A consumer may designate another person to exercise the statutory opt-outs. This finding does not establish an agent right to exercise every consumer request. The provision begins January 1, 2028. Source | The controller must be able to verify or authenticate identity and the agent's authority with commercially reasonable effort. The provision begins January 1, 2028. Source | The future definition includes public sources but excludes specified biometrics, assembled consumer profiles, related inferences, mixed personal-data profiles and other listed material. The consumer-rights provisions begin January 1, 2028. Source | Existing data brokers register annually by January 31 under the current section 2446 rule. The displayed January 1, 2027 amended rule has separate fees, timing and requirements. Source | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | legislature.vermont.gov Checked 2026-10-24 |
| Virginia | Virginia Consumer Data Protection Act. Source | Virginia Code Title 59.1, chapter 53. Source | January 1, 2023. Source | Covered right to delete personal data provided by or obtained about the consumer. Statutory exceptions and compliance alternatives apply. Source | Covered opt-outs for targeted advertising, sale and qualifying profiling. The statutory profiling definition and exceptions apply. Source | Not determined within the reviewed source scope. | The reviewed section expressly permits a known child's parent or legal guardian to invoke the child's rights. It does not establish an adult authorized-agent procedure. Source | Section 59.1-577(B)(4) requires commercially reasonable authentication of consumer requests and permits necessary additional information. The reviewed text does not supply separate adult-agent proof criteria. Source | The definition includes specified government records, media, consumer-public information and unrestricted disclosures. The statutory audience restriction matters. Source | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | law.lis.virginia.gov Checked 2026-10-24 |
| Washington | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Washington's My Health My Data Act protects consumer health data beyond HIPAA. This is a health-data-specific protection rather than an omnibus-rights finding. Source | www.atg.wa.gov Checked 2026-10-24 |
| West Virginia | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | West Virginia's reviewed provision requires notice of specified breaches involving unencrypted and unredacted personal information and identity-theft/fraud risk. Source | code.wvlegislature.gov Checked 2026-10-24 |
| Wisconsin | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Wisconsin DATCP publishes guidance on Wisconsin's Data Breach Notification Law. This source has a security-incident scope. Source | datcp.wi.gov Checked 2026-10-24 |
| Wyoming | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Not determined within the reviewed source scope. | Wyoming's reviewed statute requires a prompt good-faith breach investigation and qualifying notice to affected Wyoming residents. This is a breach rule, not an omnibus deletion mechanism. Source | wyoleg.gov Checked 2026-10-24 |
Why can a property listing remain after a deletion request?
Publicly available information often falls outside a consumer privacy law's definition of covered personal data. Each statute defines that exclusion separately.
The table links the identified wording. A company's consumer-data deletion response does not establish removal from a county record.
Compare record-specific protection laws and Florida office procedures.
How can you check or reuse this table?
Recheck statutes and regulator rules every three months, including scheduled future effective dates.
- 2026-10-24 Initial source audit. Program contact routes and legal eligibility remain separate.
- 2026-10-24 Reviewed all 51 jurisdiction entries. Added current primary-source rights, agent rules, dated phases and explicit limits. Unknown cells are not findings of no protection.
Go Low Profile, Consumer privacy rights by state, version 1.1, verified October 24, 2026.
Original compilation licensed under CC BY 4.0. Cite the source and identify changes.
Use the state reference tool · Read the state guides · All references