Key Takeaways
- 19 of 50 states have comprehensive data privacy laws – 62% still don’t.
- California passed the first in 2018; 2023 and 2024 each added 7 states.
- In 2025, no new state passed one – the first such pause in five years.
- Penalties already reach $10,000 per violation in Rhode Island.
The Story Behind the Numbers
As of mid-2026, 19 U.S. states have passed comprehensive data privacy laws – rules that give you real control over the personal information companies collect about you.
It started slowly. California stood alone after passing the first such law in 2018. Then the pace picked up fast: two states joined in 2021, two more in 2022, seven in 2023, and another seven in 2024. Then it stalled. In 2025, for the first time in five years, no new state passed one. Instead, three laws already on the books (Indiana, Kentucky, and Rhode Island) officially took effect on January 1, 2026.
Here’s every state, in the year it passed its law:
| No. | State | Year Passed |
|---|---|---|
| 1 | California | 2018 |
| 2 | Virginia | 2021 |
| 3 | Colorado | 2021 |
| 4 | Utah | 2022 |
| 5 | Connecticut | 2022 |
| 6 | Delaware | 2023 |
| 7 | Indiana | 2023 |
| 8 | Iowa | 2023 |
| 9 | Montana | 2023 |
| 10 | Oregon | 2023 |
| 11 | Tennessee | 2023 |
| 12 | Texas | 2023 |
| 13 | New Hampshire | 2024 |
| 14 | New Jersey | 2024 |
| 15 | Kentucky | 2024 |
| 16 | Maryland | 2024 |
| 17 | Minnesota | 2024 |
| 18 | Nebraska | 2024 |
| 19 | Rhode Island | 2024 |
Why This Data Is Important
Here’s the catch: 19 states out of 50 means only about 38% of states are covered. If you live in the other 62%, you may have little legal protection over how your data is bought, sold, and shared. There is still no national U.S. privacy law, so your rights depend almost entirely on your ZIP code.
The good news is these laws are remarkably consistent. In a covered state, you can typically:
- Access the data a company holds on you.
- Correct or delete it.
- Opt out of targeted ads, data sales, and profiling.
Every one of these laws is enforced by the state Attorney General. Until coverage is nationwide, tools like hiding your IP address let you protect yourself no matter where you live.
Looking Ahead: Future Outlook
The count held at 19 through 2025 and into 2026, but momentum hasn’t stopped – several states have new bills in progress, and enforcement is sharpening. Penalties already reach $7,500 per violation in Indiana and Kentucky, and $10,000 in Rhode Island. Congress is also weighing a new federal bill that could one day replace this state-by-state patchwork. With surveillance alliances still active worldwide, a VPN remains a smart layer of self-protection.
Source & Methodology
This data comes from the IAPP US State Comprehensive Privacy Laws Report and its US State Privacy Legislation Tracker (data collected: June 23, 2026). The IAPP counts only “comprehensive” laws that broadly govern personal data, excluding narrow or sector-specific rules.