Summarize this article with
For an overview of the regulatory landscape in 2026, check out: 2026 U.S. State Privacy Laws: what you need to know
You know the drill: another year, another batch of U.S. state privacy laws to add to your compliance checklist.
2025 will be another banner year for privacy regulation in the U.S., with eight new U.S. state laws going into effect. The stakes for compliance are growing higher than ever. Whether it’s refining your data privacy practices or ensuring your tech stack is ready to handle new requirements, there’s a lot to unpack.
Let’s dive into the unique nuances of these laws, and what you need to do to stay ahead. Keep reading for.
The state of the U.S. privacy landscape
If you’ve been tracking privacy legislation in the U.S., you know the federal government’s efforts to establish a comprehensive framework have fallen flat.
Two high-profile attempts, the American Data Privacy and Protection Act (ADPPA) and the American Privacy Rights Act (APRA), have made headlines but failed to cross the finish line. Key sticking points? Disputes over preemption (whether federal law should override state laws) and private right of action (whether individuals can sue for violations).
With no federal law in sight, states have stepped up, creating a patchwork of privacy regulations that expand consumer protections—but also introduce significant complexity for businesses.
A new, Republican administration takes the White House and Congress in January: could we finally see meaningful movement toward federal legislation? It’s possible, but unlikely.
For an expert take on this, check out our recent Privacy Huddle episode featuring my colleague Jonathan Joseph with Alysa Hutnik, Partner at Kelley Drye. They explore how the new White House administration might tackle privacy policy:
8 New U.S. State Privacy Laws for 2025
In absence of a federal law, U.S. states are increasingly adopting their own privacy regulations to address the growing demand for data protection. These laws build on the foundations laid by pioneering legislation like the California Consumer Privacy Act (CCPA) and Virginia's Consumer Data Protection Act (VCDPA).
What U.S. state privacy laws are taking effect in 2025?
In 2025, several state privacy laws will take effect, including Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, and Maryland. These laws enhance consumer data rights, including access, correction, deletion, and transparency, with varying compliance requirements and penalties.
Dates vary across the 8 new laws. Here’s when each new law goes into effect:
- Iowa Consumer Data Protection Act (ICDPA) – effective January 1, 2025
- Delaware Personal Data Privacy Act (DPDPA) – effective January 1, 2025
- Nebraska Data Privacy Act (NDPA) – effective January 1, 2025
- New Hampshire Privacy Act (NHPA) – effective January 1, 2025
- New Jersey Data Privacy Law (NJDPL) – effective January 15, 2025
- Tennessee Information Protection Act (TIPA) – effective July 1, 2025
- Minnesota Consumer Data Privacy Act (MCDPA) – effective July 31, 2025
- Maryland Online Data Privacy Act (MODPA) – effective October 1, 2025
What businesses need to know
Each state’s legislation introduces specific requirements, but common themes include:
- Transparency: Businesses must clearly disclose data collection, processing, and sharing practices.
- Consumer rights: Individuals gain rights to access, correct, delete, or opt out of data processing.
- Data protection measures: Many laws mandate stricter data security measures and assessments.
Failing to comply with these regulations can result in significant financial penalties, reputational harm, and legal challenges.
Specific nuances across the 8 new U.S. state laws
No two laws are created equal. Each introduces distinct requirements and priorities, from expanded consumer rights to unique compliance challenges for businesses. Here’s what you need to know about the nuances of these laws.
Iowa Consumer Data Protection Act (ICDPA) – effective January 1, 2025
The ICDPA focuses on core consumer rights like access, correction, and deletion. Penalties for non-compliance can reach $7,500 per violation. It’s worth noting that Iowa’s law doesn’t mandate data correction rights for residents.
When it comes to unique data subject rights like this, it’s really up to the business to decide if a state-specific or national approach makes sense. With tools like Ketch DSR automation, you can create location-aware DSR portal experiences, showing the correct rights according to states.
However, many businesses choose to apply a single standard to all states for a unified experience for all consumers. It's important to consult your outside counsel to choose the best approach for your brand.
Delaware Personal Data Privacy Act (DPDPA) – effective January 1, 2025
Delaware stands out by including nonprofits under its umbrella, expanding the scope of organizations affected. It also raises the bar on child protections: businesses must obtain opt-in consent for targeted advertising aimed at individuals under 18.
This differs from the federal Children's Online Privacy Protection Rule (COPPA) standard, which applies to children under 13, and mirrors the trend toward stricter age-appropriate design standards. If your brand attracts younger audiences, be ready for heightened compliance obligations.
Nebraska Data Privacy Act (NDPA) – effective January 1, 2025
Nebraska is unique in its lack of exemptions for small businesses. There is no minimum threshold for revenue or consumers served, meaning even small businesses must comply with the NDPA. For startups, this is a reminder that it’s often easier to build a strong privacy foundation early than to retrofit compliance later. Nebraska also emphasizes data security, requiring robust protection measures to minimize the risk of breaches.
New Hampshire Privacy Act (NHPA) – effective January 1, 2025
New Hampshire joins the growing list of state regulators requiring that businesses comply with the Global Privacy Control (GPC) signal. The GPC requires businesses to honor its browser-based privacy signal that indicates consumer preferences. While GPC is already mandated in several states, the addition of New Hampshire reinforces the need for companies to ensure these tools are enabled in their systems. If your GPC mechanisms aren’t fully operational yet, now is the time to address that gap.
New Jersey Data Privacy Law (NJDPL) – effective January 15, 2025
New Jersey offers a couple of unique twists. First, it has a shorter processing period for opt-out requests—15 days instead of the more typical 30 or 45. Second, it’s a rulemaking state, joining California and Colorado in adding layers of regulatory details over time. Companies should prepare for the possibility of evolving requirements.
Tennessee Information Protection Act (TIPA) – effective July 1, 2025
Tennessee introduces an opt-in requirement for sensitive data, including biometrics and health information. This isn’t common in U.S. laws and mirrors the stricter consent standards seen in Europe’s GDPR. If your business processes sensitive data, you’ll need to secure explicit consumer consent–raising the stakes for companies that rely on this type of information.
Minnesota Consumer Data Privacy Act (MCDPA) – effective July 31, 2025
Minnesota takes inspiration from Oregon by granting consumers the right to request a list of third parties their data is shared with. This can present logistical challenges, especially for businesses with complex advertising or data-sharing ecosystems. Remember, this list doesn’t include service providers but focuses on entities receiving data for “sales” or “sharing” purposes.
If your current data-sharing processes aren’t well-documented, now’s the time to start mapping them.
Maryland Online Data Privacy Act (MODPA) – effective October 1, 2025
Maryland is turning heads with its affirmative data minimization requirements and outright bans on certain data sales, particularly in sensitive categories. These rules align with trends seen in laws like Washington’s My Health My Data Act, which forced some businesses to stop digital advertising entirely in that state.
Maryland’s broad interpretation of sensitive data categories will likely drive cautious implementation as businesses navigate what can and can’t be done under this law.
Compare U.S. State Privacy Laws side-by-side
Here’s a side-by-side comparison of the key aspects of the upcoming privacy legislation to help you identify overlaps and differences:
What should privacy leaders focus on now?
With new state privacy laws coming into effect in 2025, privacy leaders must adapt quickly:
- Know the differences: While there are similarities across state laws, each has unique requirements that demand careful review. Charts (like the one we’ve provided above) are your friend! It’s impossible to read every piece of legislation–leverage resources that help you distill what’s important, quickly, like our Regulatory Compliance Hub and the IAPP’s legislation tracker.
- Update your privacy policy: Now is the time to review your privacy policy to ensure that you’re accounting for state-specific nuances, like sensitive data handling and requests for third party data sharing entities.
- Leverage tools: As laws amass, considering upgrading your privacy tech to streamline operations. Tools like Ketch are helpful to automatically deploy state-specific consent and rights experiences.
How Ketch can help
Navigating the evolving privacy landscape can be complex. At Ketch, we offer data privacy solutions that help businesses comply with regulations across jurisdictions. Our tools streamline consent management, data access requests, and compliance workflows, so you can focus on growing your business.
Request a demo to see how Ketch can support your compliance efforts.
“The privacy of our customers' data is very important to us, and we want to make sure we are acting in accordance with their wishes as well as complying with all state laws. Ketch helps us do this without a lot of overhead so we can focus our internal resources on growing our technology capabilities and supporting our aggressive omni-channel growth plans.”
- Mike Early, Chief Technology Officer, Francesca's
