US State Privacy Laws in 2025: The Complete Map

What Are US State Privacy Laws in 2025?

US state privacy laws in 2025 are state-level consumer data protection statutes that grant residents rights over their personal information and impose obligations on businesses that collect, process, or share that data. Unlike the European Union's GDPR, the United States has no single federal privacy law as of early 2025 (the proposed American Data Privacy and Protection Act, ADPPA, remains stalled in Congress). Instead, states have independently enacted their own comprehensive privacy acts, creating a compliance landscape that requires organizations to map their obligations state by state.

These laws share a common structure — inspired largely by the California Consumer Privacy Act (CCPA/CPRA) — but vary significantly in thresholds, covered data categories, consumer rights, and enforcement penalties. The Office of the Attorney General in each state typically serves as the primary enforcement authority, though several states now grant a private right of action for specific violations.

Complete Map: Active US State Privacy Laws in 2025

The following table maps every state with a comprehensive privacy law active or with enforcement beginning in 2025. Laws listed are general consumer privacy statutes; sector-specific laws (HIPAA, GLBA, FERPA) are not included but remain in effect alongside state privacy law where exemptions apply.

Who Must Comply with US State Privacy Laws in 2025?

Organizations subject to state privacy laws generally include any for-profit entity (and in some states like California and Colorado, non-profits) that meet the applicable revenue or data processing thresholds. The core test across most laws: does the business control or process the personal data of a specified number of state residents? However, thresholds vary by state:

• Revenue-based: Most states apply a $25 million annual gross revenue threshold. Notably, Iowa and New Jersey have no revenue threshold — any business processing data of 100,000+ consumers is covered.
• Volume-based: The secondary test is either processing the personal data of 100,000 consumers (California, Colorado, Connecticut, Indiana, Iowa, Kentucky, Minnesota, Montana, Nebraska, Oregon, Tennessee, Texas, Utah, Virginia) or 35,000 consumers (Delaware, Maryland, New Hampshire).
• Data-sale-based: Some states also trigger coverage if the business derives a percentage of revenue from selling personal data (e.g., 50% for California's broader definition; 20% in Delaware and Maryland).

Exemptions apply to data already covered by HIPAA, GLBA, FERPA, and the Fair Credit Reporting Act (FCRA); employee and business-to-business (B2B) data exemptions exist under several state laws but are being phased out (California's CPRA ended the B2B exemption in 2023).

What Consumer Rights Do US State Privacy Laws Grant?

Every active state privacy law in 2025 grants residents the following core rights, though the scope and response timelines differ:

• Right to Know/Access: The right to confirm whether a business processes their personal data and to access that data. Response timelines: 45 days (exceptions to 90 days) in most states; 45 days in California and Colorado.
• Right to Delete: The right to request deletion of personal data collected or maintained. California and Colorado apply this broadly; other states include reasonable retention exceptions (e.g., security, fraud prevention).
• Right to Correct: The right to correct inaccurate personal data. All states except Iowa include this right explicitly as of 2025.
• Right to Opt Out: The right to opt out of the sale of personal data (all laws) and, in California, Colorado, Connecticut, and Oregon, the right to opt out of targeted advertising and profiling.
• Right to Portability: The right to receive personal data in a portable, machine-readable format — generally limited to data previously provided by the consumer.
• Right to Non-Discrimination: The right not to be denied goods or services for exercising privacy rights (California CPRA is the most explicit; other states follow with caveats for loyalty programs).

How Does Enforcement Work Under US State Privacy Laws?

Enforcement patterns differ significantly across states, creating a critical risk consideration for compliance strategies:

Attorney General Enforcement (All States)

Every state privacy law grants the state Attorney General (AG) exclusive or primary enforcement authority. The AG investigates violations, issues cure periods where applicable, and can seek civil penalties. Maximum fines range from $2,500 per violation (Virginia, Utah) up to $7,500 per intentional violation (California CPRA). The California Privacy Protection Agency (CPPA) — created by the CPRA — independently enforces alongside the California AG.

Private Right of Action

Three states currently provide a private right of action (PRA):

• California (CCPA/CPRA): Consumers can sue for data breaches resulting from a business's failure to maintain reasonable security. Damages: $100–$750 per incident per consumer, or actual damages.
• Colorado (CPA): A limited PRA exists for violations of the state's biometric data and data security requirements, effective from 2025 rulemaking.
• Maryland (MODPA): Effective October 1, 2025, consumers have a PRA for violations of the law's data security obligations — a broader PRA than California's breach-only standard.

What Are the Most Stringent State Privacy Laws in 2025?

While all state laws share a common core, three stand out as the most expansive and enforcement-ready:

• California (CCPA/CPRA): The broadest scope (includes employee data, B2B information, and inferred data from profiling). The CPPA has active rulemaking and enforcement actions. California is the only state with a dedicated privacy enforcement agency.
• Colorado (CPA): The Colorado AG's office has been the most aggressive enforcer outside California, with active fines and corrective actions. Colorado's rulemaking on profiling and automated decision-making (effective February 1, 2025) sets the standard for transparency requirements.
• Connecticut (CTDPA): The CTDPA mirrors Colorado in scope but adds additional consumer rights for biometric data. The Connecticut AG has signaled active enforcement prioritization for 2025–2026.

How Can Organizations Comply with Multiple State Privacy Laws in 2025?

Given the patchwork — no single federal preemption — organizations must adopt a data-mapping-first compliance strategy. The core steps:

What Changes Are Coming to US State Privacy Laws Beyond 2025?

The legislative pace is accelerating. As of early 2025, bills are active in at least 10 additional states (including Florida, Georgia, Illinois, Michigan, New York, North Carolina, Ohio, Pennsylvania, South Carolina, and Washington). Several trends are shaping the 2025–2026 landscape:

• No-cure periods: Earlier state laws allowed organizations a 30-60 day cure period before AG enforcement. California removed its cure provision in 2023; Colorado and Connecticut are moving to eliminate or restrict cure periods in 2025.
• Expansion of private right of action: Maryland's MODPA signals a shift toward granting consumers direct litigation rights. California's PRA may expand beyond breaches if new ballot initiatives succeed in 2025.
• Biometric data and AI governance: Colorado, Connecticut, and Maryland now include specific rules for biometric data (fingerprints, facial recognition, voiceprints). Colorado's CPA rulemaking on profiling and automated decision-making is likely a template for other states.
• Data minimization requirements: California (CPRA) and Maryland (MODPA) require businesses to limit data collection to what is "reasonably necessary and proportionate" to provide the service — a standard that goes beyond the GDPR's "purpose limitation."

How Does CyberSilo Support US State Privacy Law Compliance?

CyberSilo's Compliance Standards Automation platform is designed specifically for the US regulatory patchwork. Our solution helps security and compliance teams at regulated organizations in the United States navigate the overlapping requirements of CCPA/CPRA, CPA, CTDPA, VCDPA, and all other active state privacy laws alongside federal frameworks like HIPAA, GLBA, and PCI DSS v4.0.1.

Key capabilities for state privacy law compliance include:

• Multi-state data inventory and mapping: Automatically map data flows against the definitions of "personal data" under each applicable state law — including California's inferred data and profiling categories.
• Consumer rights request orchestration: A centralized intake portal with automated routing to the correct processing team, identity verification, and response timeline tracking (30, 45, or 60 days per state).
• Opt-out preference management: Integration with global opt-out signals (GPC, browser headers, company-wide consent records) for sale, sharing, and targeted advertising under California, Colorado, Connecticut, and Oregon laws.
• Privacy notice generation and versioning: Auto-generated privacy notices that reflect the latest requirements from each state, with change tracking for regulatory updates.

CyberSilo also provides US cybersecurity compliance services that include state privacy law readiness assessments, control mapping workshops, and remediation planning — ideal for CISOs and Privacy Officers who need to demonstrate compliance to regulators and auditors.