US state privacy laws: the full map through 2028
Twenty-four US states have comprehensive privacy laws, from 2020 to 2028. See the effective dates, California's fines and where the federal bill stands.
The United States has no general federal data protection law. Instead, a map of state laws now covers 24 states with comprehensive privacy statutes, according to ComplyJet, from California in 2020 to Vermont in 2028.
The full calendar
| Effective | States |
|---|---|
| 2020 | California (CCPA; CPRA from Jan 1, 2023) |
| 2023 | Virginia, Colorado, Connecticut, Utah |
| 2024 | Texas, Oregon, Florida (narrow scope), Montana |
| 2025 | Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland |
| 2026 | Indiana, Kentucky, Rhode Island |
| 2027 | Oklahoma, Louisiana (Jan 1); Alabama (May 1) |
| 2028 | Vermont (Jan 1) |
Maryland's MODPA took effect on October 1, 2025, but applies to processing from April 1, 2026. California's automated decision-making (ADMT) rules start January 1, 2027, and first risk assessments are due April 1, 2028 (MultiState).
California enforcement
The California Privacy Protection Agency's first actions: American Honda ($632,500, March 2025), Todd Snyder ($345,000) and Tractor Supply ($1.35 million, September 2025), its largest so far (White & Case). Polsinelli sees a new focus on privacy disclosures.
The federal bill
The SECURE Data Act (H.R. 8413), introduced April 22, 2026, would broadly preempt state laws, offer no private right of action and be enforced by the FTC and state attorneys general (IAPP). It remained in committee in October 2026. Only two federal privacy laws passed recently, the TAKE IT DOWN Act and the Homebuyers Privacy Protection Act, with 49 bills pending (KEYT/Stacker).
Federal sector rules still bite: the FTC fined Cognosphere $20 million and Disney $10 million under COPPA (Perkins Coie), and breach settlements such as Equifax ($575–700 million) dwarf state fines (Enzuzo).
What to do
- Map where your consumers are and check each law's applicability thresholds.
- Build one program around the strictest rule, usually California's.
- Review privacy notices and opt-outs, the focus of early CPPA fines.
- Prepare for 2027 and track the SECURE Data Act.
Source
- ComplyJet: US state privacy laws list 2026
- MultiState: comprehensive privacy laws taking effect in 2026
- Polsinelli: CPPA $1.35M fine
- White & Case: CPPA record fine against Tractor Supply
- IAPP: SECURE Data Act analysis
- KEYT/Stacker: federal privacy legislation in 2026
- Perkins Coie: Privacy Law Recap 2025 (FTC)
- Enzuzo: biggest data breach fines and settlements