Following the lead of California, which passed the first comprehensive privacy legislation in the United States in 2018, many states have now enacted their own laws governing the collection and use of personal data. In addition to California, a comprehensive privacy law is effective in the following states as of 2024: Colorado, Connecticut, Montana, Oregon, Texas, Utah, and Virginia. New laws go into effect in 2025 in Delaware, Iowa, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, and Tennessee. Indiana, Kentucky, and Rhode Island have also passed comprehensive privacy laws that go into effect in 2026. There are active bills in the legislatures of Michigan, Ohio, and Pennsylvania. The laws apply to businesses that collect personal information from consumers in those states regardless of where the business is located.
