Data Privacy Laws by State: Who Protects Your Data (2026)

There's still no federal law giving Americans control over their personal data — so your rights depend almost entirely on your state. As of 2026, 20 states have passed a comprehensive consumer privacy law. Here's who, what those laws give you, and what to do if your state isn't on the list.

The short version

• 20 states have a comprehensive consumer data privacy law as of 2026.
• California started it with the CCPA in 2018; most others followed since 2023.
• These laws let you access, correct, delete, and opt out of the sale of your data.
• There is still no comprehensive federal privacy law — it's a state-by-state patchwork.

Which states have a data privacy law?

These 20 states have enacted a comprehensive consumer data privacy law:

The pace has accelerated sharply — for years California stood alone, but a wave of states have passed laws since 2023, and more debate them every session.

What rights do these laws give you?

The details differ, but most of these laws grant residents a similar core set of rights over data that companies hold about them:

• Access — see what personal data a business has collected.
• Correct — fix inaccurate data.
• Delete — have your data erased.
• Opt out — of the sale of your data and of targeted advertising.
• Portability — get a copy of your data to take elsewhere.

Why is there no federal privacy law?

Congress has debated a national privacy standard for years without passing one — stuck mainly on two questions: whether a federal law should preempt stronger state laws, and whether individuals should be able to sue companies directly. Until that breaks, the state patchwork is what protects you, and where you live determines how much.

How states rank on privacy

Data privacy is part of the broader Fourth Amendment picture our index scores, alongside surveillance limits and forfeiture protections:

1. 1MEMaine
   9.5A+
2. 2NMNew Mexico
   9.5A+
3. 3WIWisconsin
   9.0A+
4. 4MOMissouri
   8.5A
5. 5NCNorth Carolina
   8.5A
6. 6MDMaryland
   8.5A
7. 7FLFlorida
   6.5B-
8. 8COColorado
   6.5B-
9. 9CTConnecticut
   6.5B-
10. 10OROregon
    6.5B-

See all 50 states ranked on 4th Amendment

See all 50 states ranked on privacy & the Fourth Amendment

Data privacy, surveillance, recording, and forfeiture protections — the full ranking with a map.

What to do if your state has no law

If you're in one of the 30 states without a comprehensive law, you still have options:

1. Use opt-outs anyway — many companies extend privacy controls nationwide rather than maintain 50 versions.
2. Use the Global Privacy Control — a browser signal that automatically opts you out where laws recognize it.
3. Minimize — limit what you share, use privacy-respecting tools, and review app permissions.

The trend is clearly toward more protection — but until a federal law lands, checking where your state ranks on privacy is the place to start.