TL;DR: There's no single federal privacy law in the US, but 20 states now have comprehensive consumer privacy laws, from California and Virginia (2023) to Indiana, Kentucky and Rhode Island (January 2026). Most give you the right to see, correct and delete your data and to opt out of sales, targeted ads and profiling. Several, including California and Colorado, must honour a browser opt-out signal. Complaints usually go to your state attorney general.

👉 Free check covers your email in 30 seconds — full scan adds your phone number →

The states and when their laws took effect

Effective dates from the Future of Privacy Forum's tracker:

MultiState counts twenty states with comprehensive laws on the books as of 2026, counting Florida despite its narrower scope.

The rights most of these laws give you

Three states up close

Colorado Privacy Act

In force since 1 July 2023. The Colorado Attorney General says it applies to businesses handling data on more than 100,000 Colorado consumers a year, or earning revenue from selling data on 25,000 or more. From 1 July 2024, companies must honour recognised universal opt-out signals such as Global Privacy Control. Only the AG and district attorneys can enforce it.

Texas Data Privacy and Security Act

In force since 1 July 2024. Per the Texas Attorney General, it covers companies doing business in Texas or serving Texans, with most small businesses exempt (except that they need consent to sell sensitive data). There's no private right to sue; complaints go to the AG.

California (CCPA/CPRA)

The most developed regime. The California AG lists rights to know, delete, correct, opt out of sale or sharing, and limit use of sensitive data, and says businesses must honour a global privacy control as an opt-out. California also runs a data broker registry and its Delete Act system.

How to use your rights

  1. Look for “Your Privacy Choices,” “Do Not Sell or Share” or a privacy request form in a company's footer.
  2. Say which right you're using and which account or email it concerns. Keep a copy and the date.
  3. If refused, most laws give you an appeal. If the appeal fails, complain to your state attorney general.
  4. Turn on GPC in your browser so opt-outs happen automatically where the law requires it.

Data brokers are the obvious target for deletion requests. Our US data broker removal guide and LexisNexis opt-out guide show where to start, and the Sephora case shows California's law being enforced. Outside the US, the UK and EU equivalent is a subject access request.

A free email exposure check shows which breaches your email appears in, so you know which companies to send requests to.

Frequently Asked Questions

How many US states have comprehensive privacy laws?

Twenty as of 2026, according to MultiState, with Indiana, Kentucky and Rhode Island taking effect on 1 January 2026.

When did the Texas Data Privacy and Security Act take effect?

On 1 July 2024. Complaints go to the Texas Attorney General, and there is no private right to sue under the Act.

What rights does the Colorado Privacy Act give?

Rights to access, correct, delete and port your data, and to opt out of sales, targeted advertising and certain profiling. Businesses must honour universal opt-out signals from 1 July 2024.

When did Virginia and Connecticut privacy laws start?

Virginia’s Consumer Data Protection Act took effect on 1 January 2023 and Connecticut’s Data Privacy Act on 1 July 2023.

Can I sue a company under state privacy laws?

Generally no. Most state laws are enforced only by the attorney general. California’s law has a limited private right of action for certain data breaches.

Sources

Related Reading