Privacy Laws by State: Data Rights, Biometrics & Recording Consent

There is no federal law giving Americans general control over their personal data, no federal law protecting their biometrics, and a federal recording standard so permissive that eleven states overrode it. Privacy in the United States is not a national floor with state variations on top. It is a patchwork with genuine holes, and which one you live in determines what rights you actually have.

This guide covers the three areas where state law does most of the work: comprehensive consumer data privacy, biometric protection, and recording-consent rules — the last of which is the one most likely to make an ordinary person accidentally commit a crime.

The short version

• 20 states have a comprehensive consumer data privacy law; 30 have none.
• Only Illinois, Texas, and Washington have standalone biometric statutes.
• Illinois's BIPA is the one companies actually fear — because individuals can sue directly.
• About 11 states require all-party consent to record a conversation; most require only one.
• When a call crosses state lines, follow the stricter rule.

Comprehensive privacy law

A state statute granting residents general rights over personal data held by businesses — access, correction, deletion, and opt-out.

Private right of action

The ability of an individual to sue a company directly for a violation, rather than relying on a state agency to enforce.

Biometric data

Information about unique physical traits — fingerprints, facial geometry, iris scans, voiceprints, hand geometry.

One-party consent

Only one participant must agree to a recording, and that participant can be you. The federal standard.

All-party consent

Every participant must agree before a conversation may lawfully be recorded.

Global Privacy Control

A browser signal that automatically communicates an opt-out request to sites, legally binding in some states.

Consumer data privacy: 20 states, and no federal backstop

Twenty states have enacted a comprehensive consumer data privacy law:

California started it with the CCPA in 2018 and for years stood essentially alone. The pace changed sharply from 2023 onward, and more states debate bills every session.

The details differ, but the core rights are broadly consistent:

• Access — see what personal data a business holds about you.
• Correct — fix what is inaccurate.
• Delete — have it erased.
• Opt out — of the sale of your data and of targeted advertising.
• Portability — obtain a copy to take elsewhere.

Why Congress hasn't acted

A national standard has been debated for years without passing, and it is stuck on two specific questions rather than general disagreement. The first is preemption: whether a federal law should override stronger state laws, which California in particular resists. The second is the private right of action: whether individuals could sue companies directly, which industry resists. Until one of those breaks, the patchwork is what you have.

If your state has no law

Thirty states have none, but residents there are not entirely without options:

1. Use the opt-outs anyway. Many companies extend privacy controls nationwide rather than maintain fifty versions of their systems — the same spillover effect that pay-transparency laws produce in hiring.
2. Turn on Global Privacy Control. It is a browser signal that automatically communicates an opt-out, and it is legally binding in several states.
3. Minimize. Limit what you share, review app permissions, and prefer tools that do not collect in the first place. This is the only approach that does not depend on someone else's compliance.

Biometric data: three states, and one that matters

Biometric data means your unique physical traits — fingerprints, facial geometry, iris scans, voiceprints, hand geometry. It is used to unlock phones, clock in at work, and tag photographs.

What makes it categorically different from other personal data is permanence. A leaked password is an inconvenience; you change it. You cannot change your face. A biometric breach is, functionally, permanent.

Three states have a dedicated biometric statute:

Many of the 20 comprehensive-privacy states also treat biometrics as a protected "sensitive" category within those broader laws, which is meaningful but generally weaker and less specific than a standalone statute.

Why BIPA is the one companies fear

Illinois's Biometric Information Privacy Act, passed in 2008, is watched more closely by corporate counsel than any other state privacy law in the country. Not because its requirements are unusually strict — inform the subject, obtain written consent, disclose the retention period, follow security and deletion rules — but because of one structural feature: it grants a private right of action.

Individuals can sue directly. They do not have to persuade a state attorney general to take an interest.

That single provision has produced class-action settlements reaching nine figures against major technology platforms, and it has made BIPA the de facto national standard for handling biometrics well outside Illinois — because a company operating nationally cannot easily build one biometric pipeline for Illinois and another for everywhere else.

It is the clearest demonstration in American privacy law that enforcement mechanism matters more than statutory text. Several states have biometric provisions on paper; one has consequences.

As facial recognition spreads through retail, policing, and venues, more states are weighing BIPA-style protections. The fight in each of them is over the private right of action, because everyone involved understands that is the part with teeth.

Recording consent: the rule that catches ordinary people

Federal law (18 U.S.C. § 2511) and most states follow one-party consent: you may record a conversation you are part of without telling anyone else. About eleven states require all-party consent — everyone must agree — and in those states getting it wrong can be a criminal offense as well as a civil liability.

Connecticut, Michigan, and Oregon sit in between, applying all-party rules to some kinds of communication, often in-person ones, but not to others.

The cross-border problem

This is where people genuinely get caught. If you are in a one-party state and the person you are recording is in an all-party state, which law governs is unsettled — courts have gone both ways, and there is no clean rule to rely on.

The safe practice is simple and costs nothing: if anyone on a call could be in an all-party state, get everyone's consent. "I'm recording this call — is that okay?" at the start resolves it almost everywhere, and a recorded yes is itself the evidence that you complied.

Given how much of American life now happens on calls between people who do not know each other's location, treating all-party consent as the default is the only defensible habit.

How states rank on privacy

Recording rules, data rights, and biometric protection all feed the Fourth Amendment score, alongside surveillance limits and civil-forfeiture protections:

1. 1. Maine —
   9.5/10 (A+).
2. 2. New Mexico —
   9.5/10 (A+).
3. 3. Wisconsin —
   9.0/10 (A+).
4. 4. Missouri —
   8.5/10 (A).
5. 5. North Carolina —
   8.5/10 (A).
6. 6. Maryland —
   8.5/10 (A).
7. 7. Florida —
   6.5/10 (B-).
8. 8. Colorado —
   6.5/10 (B-).
9. 9. Connecticut —
   6.5/10 (B-).
10. 10. Oregon —
    6.5/10 (B-).

See all 50 states ranked on 4th Amendment

See all 50 states ranked on privacy & the Fourth Amendment

Data privacy, biometrics, recording, surveillance, and forfeiture protections — the full ranking with a map.