A business with customers or staff across the United States has to answer the same four questions in every state: is there a comprehensive privacy law, how fast must a breach be notified, is there a security duty, and who enforces it. This quick reference answers those questions for the 15 most populous states: California, Texas, Florida, New York, Pennsylvania, Illinois, Ohio, Georgia, North Carolina, Michigan, New Jersey, Virginia, Washington, Arizona and Tennessee (ranked by the US Census Bureau's Vintage 2025 estimates). It is a lookup page for security, privacy and incident response leads; for how the privacy laws work in depth, read the US State Privacy Laws Guide, and for security duties and safe harbours, the US State Cybersecurity Laws Map.
Source note: checked on 9 November 2026. Several state legislature and Attorney General sites could not be accessed, so parts of this page rely on secondary sources: the Privacy Rights Clearinghouse 50-state breach survey (January 2026), the Mintz Matrix state breach pages, a Vaquill state-by-state breach summary (updated October 2026), Venable's 2026 mid-year privacy update and the privacylawmap.com state list (figures as of October 2026). Official texts were read for New York, Arizona and Florida, and the Texas Legislature's bill analysis for the Texas Attorney General notice. A deadline or threshold appears below only where two independent sources agree. Confirm against the official text before relying on it.
Key takeaways
- Six of the 15 have a comprehensive privacy law in force. California, Florida (narrow, very large companies only), New Jersey, Tennessee, Texas and Virginia; the other nine rely on breach, security, biometric or health data laws.
- Breach clocks range from 30 days to no fixed number. California, Florida, New York and Washington set 30 days; Ohio, Arizona and Tennessee 45; Texas 60; the rest say "without unreasonable delay" or "most expedient time possible".
- The Attorney General is the default regulator. California alone adds a dedicated privacy agency, the California Privacy Protection Agency; New Jersey routes breach notice to the State Police before consumers.
- Residence of the person, not the company, decides which law applies. A breach of a national customer database triggers every state where an affected person lives, so run one clock at the shortest deadline.
- Thresholds for regulator notice differ. Texas reports to the Attorney General at 250 residents, Florida at 500, California above 500 and Arizona above 1,000; build the counts into the incident playbook.
How to use this reference
Use the tables in order. First check whether a state's comprehensive privacy law applies to you (thresholds are in the US State Privacy Laws Guide). Then use the breach table to set your notification clock and regulator list for an incident. Then check the security and sector laws that set your baseline controls. The final table gives the enforcing body and its official site so the team can find current forms, guidance and enforcement announcements.
- For incident response: sort affected people by state of residence, find the shortest fixed deadline that applies and work to it for everyone.
- For programme planning: the strictest privacy law in your footprint, usually California, sets most of the design; the Virginia-model states add consent for sensitive data.
- For audits and due diligence: use the regulator column to check enforcement history before entering a new state market.
Comprehensive privacy laws in the 15 largest states
| State (population rank) | Comprehensive privacy law | In force from | Enforcer |
|---|---|---|---|
| California (1) | California Consumer Privacy Act as amended by the CPRA | 1 January 2020; CPRA amendments 2023; 2025 regulations 1 January 2026 | California Privacy Protection Agency and Attorney General |
| Texas (2) | Texas Data Privacy and Security Act (TDPSA) | 1 July 2024 | Attorney General |
| Florida (3) | Florida Digital Bill of Rights (FDBR), limited to businesses with more than $1 billion global revenue that meet a business-model test | 1 July 2024 | Department of Legal Affairs (Attorney General) |
| New York (4) | None in force; SHIELD Act covers security and breach | Not applicable | Attorney General |
| Pennsylvania (5) | None in force | Not applicable | Attorney General |
| Illinois (6) | None in force; Biometric Information Privacy Act (BIPA) applies to biometrics | Not applicable | Attorney General; BIPA private actions |
| Ohio (7) | None in force | Not applicable | Attorney General |
| Georgia (8) | None in force | Not applicable | Attorney General |
| North Carolina (9) | None in force | Not applicable | Attorney General (Consumer Protection Division) |
| Michigan (10) | None in force | Not applicable | Attorney General |
| New Jersey (11) | New Jersey Data Privacy Act (NJDPA) | 15 January 2025 | Attorney General |
| Virginia (12) | Virginia Consumer Data Protection Act (VCDPA) | 1 January 2023 | Attorney General only |
| Washington (13) | None comprehensive; My Health My Data Act covers consumer health data | My Health My Data Act 31 March 2024 (30 June 2024 small businesses) | Attorney General; private actions under the Consumer Protection Act |
| Arizona (14) | None in force | Not applicable | Attorney General |
| Tennessee (15) | Tennessee Information Protection Act (TIPA) | 1 July 2025 | Attorney General |
Four further states enacted comprehensive laws in 2026 that are not yet in force (Louisiana and Oklahoma from 1 January 2027, Alabama from 1 May 2027, Vermont from 1 January 2028); none is in the top 15. Bills are introduced every session in the nine top-15 states without a law, so recheck this table at the start of each legislative year.
Breach notification at a glance
Every state has a breach notification statute. The table gives the citation, the consumer clock and regulator notice where two sources agree. "No fixed days" means the statute uses qualitative wording such as "without unreasonable delay"; it is not permission to wait.
| State | Statute | Consumer notice | Regulator notice |
|---|---|---|---|
| California | Civil Code 1798.82 | 30 calendar days (from 1 January 2026) | Sample notice to the Attorney General when more than 500 residents are notified |
| Texas | Business and Commerce Code 521.053 | Without unreasonable delay, no later than 60 days after determining a breach | Attorney General within 30 days if at least 250 Texans are affected |
| Florida | Fla. Stat. 501.171 | No later than 30 days after determining a breach | Department of Legal Affairs within 30 days if 500 or more individuals (15 more days possible with written good cause) |
| New York | General Business Law 899-aa | Most expedient time possible, no later than 30 days after discovery | Attorney General, Department of State and State Police whenever residents are notified; DFS for Part 500 entities |
| Pennsylvania | Breach of Personal Information Notification Act | No fixed days (without unreasonable delay) | Attorney General when notifying residents above a statutory threshold; confirm on the AG portal |
| Illinois | 815 ILCS 530/10 | No fixed days (most expedient time possible) | Attorney General above a resident threshold, no later than consumer notice; confirm the count in the statute |
| Ohio | Revised Code 1349.19 | No later than 45 days after discovery | Check the statute; consumer reporting agencies above a threshold |
| Georgia | O.C.G.A. 10-1-912 | No fixed days (most expedient time possible) | No general regulator notice in the sources read |
| North Carolina | N.C. Gen. Stat. 75-61 and 75-65 | No fixed days (without unreasonable delay) | Consumer Protection Division of the Attorney General, by online form |
| Michigan | MCL 445.72 | No fixed days (without unreasonable delay) | No general regulator notice in the sources read |
| New Jersey | N.J. Stat. 56:8-161 et seq. | No fixed days (most expedient time possible) | Division of State Police, before consumers are notified |
| Virginia | Va. Code 18.2-186.6 | No fixed days (without unreasonable delay) | Attorney General |
| Washington | RCW 19.255.010 | No more than 30 calendar days after discovery | Attorney General above a resident threshold; confirm the count and timing in the statute |
| Arizona | A.R.S. 18-552 | Within 45 days after the breach is determined | Attorney General and Arizona Department of Homeland Security if more than 1,000 individuals |
| Tennessee | Tenn. Code 47-18-2107 | Immediately, no later than 45 days after discovery | Check the statute; consumer reporting agencies above a threshold |
Most of these statutes also require notice to the nationwide consumer reporting agencies above a count set in each statute (Arizona above 1,000 individuals, New York above 5,000 residents notified at one time, from the official texts). Pennsylvania requires an offer of free credit monitoring where a name is combined with a Social Security number, bank account number or driver's licence or state ID number, per the Mintz Matrix; check the current statute for the period. For drafting, use the Data Breach Notification Checklist and the Customer Breach Notification Letter Template.
Security duties, safe harbours and sector laws
Breach laws say what to do after an incident; these laws say what controls must exist before one. The entries below are drawn from the US State Cybersecurity Laws Map and the deep guides it links.
| State | Law | Type | Practical effect |
|---|---|---|---|
| California | CCPA 1798.150 and the 2025 cybersecurity audit regulations | Security duty with private action for certain breaches | Annual independent cybersecurity audits phased in from 1 April 2028 by revenue; statutory damages for breaches caused by failure to keep reasonable security |
| New York | SHIELD Act, GBL 899-bb; 23 NYCRR Part 500 | Security duty; sector rule | Listed administrative, technical and physical safeguards; prescriptive controls for DFS-regulated entities |
| Ohio | Revised Code chapter 1354; Revised Code 9.64 | Safe harbour; public sector | Affirmative defence for a conforming written programme; political subdivisions report incidents within 7 days |
| Texas | SB 2610 (2025) | Safe harbour (small business) | Businesses under 250 employees with a programme are shielded from exemplary damages |
| Tennessee | Public Chapter 991 of 2024 | Litigation limit | Class actions for a cybersecurity event need willful and wanton misconduct or gross negligence |
| Florida | Fla. Stat. 282.3185 and 282.3186 | Public sector | Local government standards, training, incident reporting and a ransom payment ban |
| North Carolina | N.C. Gen. Stat. 143-800 | Public sector | State agencies and local governments may not pay ransoms and must report ransom requests |
| Illinois | Biometric Information Privacy Act | Data-type law | Written notice and release before collecting biometrics; private right of action |
| Washington | My Health My Data Act | Data-type law | Consent and authorisation for consumer health data; private actions |
See the NYDFS Part 500 Guide and the CCPA and CPRA guide for depth on the two states with the most prescriptive duties.
Regulators and official sources
Bookmark these sites for breach forms, guidance and enforcement news. Each Attorney General runs a consumer protection division that handles privacy and breach matters; California's privacy agency also issues regulations.
| State | Regulator | Official site |
|---|---|---|
| California | California Privacy Protection Agency; Attorney General | cppa.ca.gov; oag.ca.gov |
| Texas | Office of the Attorney General | texasattorneygeneral.gov |
| Florida | Office of the Attorney General (Department of Legal Affairs) | myfloridalegal.com |
| New York | Office of the Attorney General; Department of Financial Services for regulated entities | ag.ny.gov; dfs.ny.gov |
| Pennsylvania | Office of Attorney General | attorneygeneral.gov |
| Illinois | Attorney General | illinoisattorneygeneral.gov |
| Ohio | Attorney General | ohioattorneygeneral.gov |
| Georgia | Attorney General (Consumer Protection Division) | law.georgia.gov |
| North Carolina | Department of Justice (Consumer Protection Division) | ncdoj.gov |
| Michigan | Department of Attorney General | michigan.gov/ag |
| New Jersey | Office of the Attorney General; Division of State Police for breach notice | Confirm the current address on nj.gov |
| Virginia | Office of the Attorney General | oag.state.va.us |
| Washington | Attorney General | atg.wa.gov |
| Arizona | Attorney General | azag.gov |
| Tennessee | Attorney General and Reporter | tn.gov/attorneygeneral |
Running one programme across 15 states
- Map residency: make sure every system holding customer and employee data records state of residence, so an incident can be split by state within hours.
- Set one clock: adopt 30 days from discovery as the house deadline for consumer notice (the shortest fixed limit in the table), and pre-calculate regulator thresholds.
- Write to the strictest privacy law: design consumer rights and opt-out handling to California and sensitive data consent to the Virginia-model laws in Texas, New Jersey, Tennessee and Virginia.
- Adopt one control baseline: map the New York 899-bb safeguards, Part 500 where it applies and the California audit components to one control set, and record which framework (for example NIST CSF 2.0) supports safe harbour claims in Ohio and Texas.
- Prepare regulator packs: keep current links and fields for each Attorney General portal, the New Jersey State Police notice and the California sample notice.
- Review every legislative year: assign an owner to recheck this page's tables each January and after each session ends.
Small versus large organisations: a business below every privacy law threshold still owes breach notice and, in New York, safeguards; it can stop at steps 1, 2, 5 and 6. A national consumer brand needs all six, plus a request platform and preference centre that push choices by API to downstream systems.
Measurement and framework mapping
- Residency coverage: percentage of personal data stores where state of residence can be queried.
- Notification readiness: time from discovery to state-split notice list in the last exercise, against the 30-day house deadline.
- Regulator pack currency: portals and templates checked in the last 12 months.
- Law change lag: days between a new law's enactment and its entry in your applicability register.
| Activity | NIST CSF 2.0 | NIST SP 800-53 Rev 5 |
|---|---|---|
| Track legal and regulatory requirements per state | GV.OC-03 | Programme level, no single control |
| Data inventory with residency attribute | ID.AM-07 | CM-8 |
| Notify regulators and individuals | RS.CO-02 | IR-6 |
| Incident response plan with state clocks | RS.MA-01 | IR-8 |
The mapping is ours, offered to help teams reuse existing control evidence.
Common failure patterns
- Using headquarters state law only: notification duties follow the affected person's residence.
- Reading "without unreasonable delay" as open-ended: regulators compare against the 30 to 45 day states; long silences invite enforcement.
- Missing the pre-notice step: New Jersey wants the State Police told before consumers.
- Stale tables: California moved to a fixed 30-day clock on 1 January 2026, and four states enacted privacy laws in 2026; a reference not rechecked yearly will be wrong.
- Forgetting data-type laws: states without a comprehensive law can still carry the heaviest exposure, such as Illinois for biometrics and Washington for health data.
Practitioner checklist
- Confirm which of the 15 states your customers and employees live in.
- Check applicability thresholds for California, Florida, New Jersey, Tennessee, Texas and Virginia privacy laws.
- Record state of residence in every personal data store.
- Set a 30-day house deadline for breach notice and list regulator thresholds by state.
- Prepare regulator portal packs, including the New Jersey State Police and California sample notice.
- Map controls to SHIELD 899-bb and, where relevant, Part 500 and the California audit regulations.
- Review biometric and health data processing against Illinois and Washington laws.
- Recheck this reference each January and after each legislative session.
Standards and references
- New York State Senate: General Business Law section 899-aa
- Arizona State Legislature: A.R.S. 18-552, notification of security system breaches
- Privacy Rights Clearinghouse: Data Breach Notification Laws, a 50-State Survey (2026 Edition)
- Mintz: Mintz Matrix, state data breach notification laws
- Vaquill: State data breach notification laws, where each one lives and what it requires
- Florida Senate: Florida Statutes 501.171, security of confidential personal information
- Texas Legislature: SB 768 (2023) bill analysis, Attorney General breach notice
- Texas Legislature: SB 2610 (2025) enrolled text
- Ohio Laws: Revised Code 9.64
- Duane Morris: Eight new state privacy laws take effect in 2025
- Perkins Coie: CPPA approves cybersecurity audit, ADMT and risk assessment regulations
- Shook, Hardy and Bacon: California adopts regulations on cybersecurity audits
- Venable: 2026 Mid-Year State Privacy Law Update
- privacylawmap.com: How many states have data privacy laws
- US Census Bureau: Vintage 2025 state population estimates (as republished by Rhode Island DLT)
Related NHI Mgmt Group resources: US State Privacy Laws Guide · US State Cybersecurity Laws Map · Massachusetts 201 CMR 17.00 Guide · Breach Notification Laws by Country Guide. This guide summarises the privacy, breach notification and data security laws of the 15 most populous US states as checked on 9 November 2026 and is not legal advice.