Resource Center / Tools and Trackers / Key Dates from US Comprehensive State Privacy Laws

Key Dates from US Comprehensive State Privacy Laws

This resource presents key dates from enacted U.S. state comprehensive data privacy laws.

Last updated: August 2024

Contributors:

This resource provides a timeline of key dates from enacted comprehensive state privacy laws in the US, including rulemaking deadlines, dates of final regulation adoption and enforcement implementations. Particular dates and deadlines should always be verified.

Discover more about these laws through the US State Privacy Legislation Tracker.

Legend of state comprehensive privacy laws
- California: California Consumer Privacy Act, as amended by the California Privacy Rights Act
- California: California Consumer Privacy Act regulations
- Colorado: Colorado Privacy Act
- Colorado: Colorado Privacy Act rules
- Connecticut: Connecticut Data Privacy Act
- Delaware: Delaware Personal Data Privacy Act
- Indiana: Indiana Consumer Data Protection Act
- Iowa: Iowa Consumer Data Protection Act
- Kentucky: Kentucky Consumer Data Protection Act
- Maryland: Maryland Online Data Privacy Act
- Minnesota: Minnesota Consumer Data Privacy Act
- Montana: Montana Consumer Data Privacy Act
- Nebraska: Nebraska Data Privacy Act
- New Hampshire: New Hampshire Senate Bill 255
- New Jersey: New Jersey Senate Bill 332
- Oregon: Oregon Consumer Privacy Act
- Rhode Island: Rhode Island Data Transparency and Privacy Protection Act
- Tennessee: Tennessee Information Protection Act
- Texas: Texas Data Privacy and Security Act
- Utah: Utah Consumer Privacy Act
- Virginia: Virginia Consumer Data Protection Act
Full timeline of key dates
2018

18 June 2018
- California: CCPA signed into law.
3 Nov. 2020
- California: CPRA approved by a majority of voters.
2020

1 Jan. 2020
- California: CCPA went into effect.
1 July 2020
- California: CCPA went into effect.
2021

2 March 2021
- Virginia: Signed into law.
7 July 2021
- Colorado: Signed into law.
2022

24 March 2022
- Utah: Signed into law.
10 May 2022
- Connecticut: Signed into law.
1 Jan. 2022
- California: CPRA look-back period began.
2023

1 Jan. 2023
- Virginia: Effective date.
- California: CPRA effective date.
29 March 2023
- Iowa: Signed into law.
1 May 2023
- Indiana: Signed into law.
11 May 2023
- Tennessee: Signed into law.
19 May 2023
- Montana: Signed into law.
18 June 2023
- Texas: Signed into law.
1 July 2023
- Connecticut, Colorado: Went into effect.
18 July 2023
- Oregon: Signed into law.
11 Sept. 2023
- Delaware: Signed into law.
31 Dec. 2023
- Utah: Went into effect.
2024

16 Jan. 2024
- New Jersey: Signed into law.
6 March 2024
- New Hampshire: Signed into law.
9 Feb. 2024
- California: California Privacy Protection Agency able to enforce updated regulations from the CPRA.
4 April 2024
- Kentucky: Signed into law.
17 April 2024
- Nebraska: Signed into law.
9 May 2024
- Maryland: Signed into law.
24 May 2024
- Minnesota: Signed into law.
25 June 2024
- Rhode Island: Enacted via transmission without signature.
1 July 2024
- Texas, Oregon: Went into effect.
- Colorado: Requirement to allow consumers to opt out of processing for purposes of targeted advertising or any sale through opt-out preference signals went into effect.
- New Hampshire, Tennessee, Oregon: Data protection assessment requirements apply to processing activities created or generated after this date.
1 Oct. 2024
- Montana: Effective date.
2025

1 Jan. 2025
- Delaware, Iowa, Nebraska and New Hampshire: Go into effect.
- Connecticut, Texas: Requirement to allow consumers to opt out of processing for purposes of targeted advertising or any sale through opt-out preference signals goes into effect.
- Connecticut: Mandatory right to cure period expires. Attorney general has discretion to grant cure period.
- Colorado: Mandatory notice of violation and right to cure period expires.
- Montana, New Hampshire: Requirement to allow consumers to opt out of processing for purposes of targeted advertising or any sale through opt-out preference signals goes into effect.
- Texas: Authorized agent provisions go into effect.
- Rhode Island, Minnesota: Data protection assessment requirements apply to processing activities created or generated after this date.
15 Jan. 2025
- New Jersey: Goes into effect.
1 July 2025
- Oregon: Goes into effect date for 501(c)3 tax exempt organizations.
- Tennessee: Goes into effect.
31 July 2025
- Minnesota: Goes into effect.
1 Oct. 2025
- Maryland: Goes into effect.
- Maryland: Data protection assessment requirements apply to processing activities created or generated after this date.
- Maryland: Requirement to allow consumers to opt out of processing for purposes of targeted advertising or any sale through opt-out preference signals goes into effect.
31 Dec. 2025
- New Hampshire, Delaware: Mandatory right to cure period expires. Attorneys general have discretion to grant cure period.
- Indiana: Data protection assessment requirements apply to processing activities created or generated after this date.
2026

1 Jan. 2026
- Indiana, Kentucky, Rhode Island: Go into effect.
- Oregon: Mandatory right to cure period expires. Requirement to allow consumer to opt out of processing for purposes of targeted advertising or any sale through opt-out preference signals goes into effect.
- Minnesota: Mandatory right to cure period expires.
1 June 2026
- Kentucky: Data protection assessment requirements apply to processing activities created or generated after this date.
2027

1 April 2027
- Maryland: Optional 60 day right to cure period expires.
2029

31 July 2029:
- Minnesota: Goes into effect for postsecondary institutions regulated by the Minnesota Office of Higher Education.
California
Comprehensive privacy laws
- California Consumer Privacy Act, as amended by the California Privacy Rights Act
- California Consumer Privacy Act regulations
Key dates

18 June 2018
- CCPA signed into law.
1 Jan. 2020
- CCPA went into effect.
1 July 2020
- CCPA enforced.
1 Jan. 2022
- CPRA look-back period began.
9 Feb. 2024
- California Privacy Protection Agency able to enforce updated regulations from the CPRA.
Colorado
Comprehensive privacy law
- Colorado Privacy Act
- Colorado Privacy Act rules
Key dates

7 July 2021
- Signed into law.
1 July 2023
- Went into effect.
1 July 2024
- Requirement to allow consumers to opt out of processing for purposes of targeted advertising or any sale through opt-out preference signals went into effect.
1 Jan. 2025
- Notice of violation and right to cure period expires.
Connecticut
Comprehensive privacy law
- Connecticut Data Privacy Act
Key dates

10 May 2022
- Signed into law.
1 July 2023
- Went into effect.
1 Jan. 2025
- Requirement to allow consumers to opt out of processing for purposes of targeted advertising or any sale through opt-out preference signals goes into effect.
1 Jan. 2025
- Mandatory right to cure period expires. Attorney general has discretion to grant cure period.
Delaware
Comprehensive privacy law
- Delaware Personal Data Privacy Act
Key dates

11 Sept. 2023
- Signed into law.
1 Jan. 2025
- Goes into effect.
31 Dec. 2025
- Mandatory right to cure period expires. Attorneys general have discretion to grant cure period.
Indiana
Comprehensive privacy law
- Indiana Consumer Data Protection Act
Key dates

1 May 2023
- Signed into law.
31 Dec. 2025
- Data protection assessment requirements apply to processing activities created or generated after this date.
1 Jan. 2026
- Goes into effect.
Iowa
Comprehensive privacy law
- Iowa Consumer Data Protection Act
Key dates

29 March 2023
- Signed into law.
1 Jan. 2025
- Goes into effect.
Kentucky
Comprehensive privacy law
- Kentucky Consumer Data Protection Act
Key dates

4 April 2024
- Signed into law.
1 Jan. 2026
- Goes into effect.
1 June 2026
- Data protection assessment requirements apply to processing activities created or generated after this date.
Maryland
Comprehensive privacy law
- Maryland Online Data Privacy Act
Key dates

9 May 2024
- Signed into law.
1 Oct. 2025:
- Goes into effect.
- Data protection assessment requirements apply to processing activities created or generated after this date.
- Requirement to allow consumers to opt out of processing for purposes of targeted advertising or any sale through opt-out preference signals goes into effect.
1 April 2027
- Optional 60-day right to cure period expires.
Minnesota
Comprehensive privacy law
- Minnesota Consumer Data Privacy Act
Key dates

24 May 2024
- Signed into law.
1 Jan. 2025
- Data protection assessment requirements apply to processing activities created or generated after this date.
31 July 2025
- Goes into effect.
1 Jan. 2026
- Mandatory right to cure period expires.
31 July 2029
- Goes into effect for postsecondary institutions regulated by the Minnesota Office of Higher Education.
Montana
Comprehensive privacy law
- Montana Consumer Data Privacy Act
Key dates

19 May 2023
- Signed into law.
1 Jan. 2024
- Requirement to allow consumers to opt out of processing for purposes of targeted advertising or any sale through opt-out preference signals went into effect.
1 Oct. 2024
- Goes into effect.
1 Jan. 2025
- Requirement to allow consumers to opt out of processing for purposes of targeted advertising or any sale through opt-out preference signals goes into effect.
Nebraska
Comprehensive privacy law
- Nebraska Data Privacy Act
Key dates

17 April 2024
- Signed into law.
1 Jan. 2025
- Goes into effect.
New Hampshire
Comprehensive privacy law
- New Hampshire Senate Bill 255
Key dates

6 March 2024
- Signed into law.
1 July 2024
- Data protection assessment requirements apply to processing activities created or generated after this date.
1 Jan. 2025
- Goes into effect.
- Requirement to allow consumers to opt out of processing for purposes of targeted advertising or any sale through opt-out preference signals goes into effect.
31 Dec. 2025
- Mandatory right to cure period expires. Attorneys general have discretion to grant cure period.
New Jersey
Comprehensive privacy law
- New Jersey Senate Bill 332
Key dates

16 Jan. 2024
- Signed into law.
15 Jan. 2025
- Goes into effect.
Oregon
Comprehensive privacy law
- Oregon Consumer Privacy Act
Key dates

18 July 2023
- Signed into law.
1 July 2024
- Went into effect.
- Data protection assessment requirements apply to processing activities created or generated after this date.
1 July 2025
- Goes into effect for for 501(c)3 tax exempt organizations.
Rhode Island
Comprehensive privacy law
- Rhode Island Data Transparency and Privacy Protection Act
Key dates

25 June 2024
- Enacted via transmission without signature.
1 Jan. 2025
- Data protection assessment requirements apply to processing activities created or generated after this date.
1 Jan. 2026
- Goes into effect.
Tennessee
Comprehensive privacy law
- Tennessee Information Protection Act
Key dates

11 May 2023
- Signed into law.
1 July 2024
- Data protection assessment requirements apply to processing activities created or generated after this date.
1 July 2025
- Goes into effect.
Texas
Comprehensive privacy law
- Texas Data Privacy and Security Act
Key dates

18 June 2023
- Signed into law.
1 July 2024
- Went into effect.
1 Jan. 2025
- Requirement to allow consumers to opt out of processing for purposes of targeted advertising or any sale through opt-out preference signals goes into effect.
- Authorized agent provisions go into effect.
Utah
Comprehensive privacy law
- Utah Consumer Privacy Act
Key dates

24 March 2022
- Signed into law.
31 Dec. 2023
- Went into effect.
Virginia
Comprehensive privacy law
- Virginia Consumer Data Protection Act
Key dates

2 March 2021
- Signed into law.
1 Jan. 2023
- Went into effect.