iQ Cookie Compliance Resources
US State Privacy Law Tracker
Cookie consent and data privacy law status for all 50 states, in plain English. Green means a comprehensive privacy law is in effect right now. Blue means the law is signed and the clock is ticking toward its effective date. Gray means no comprehensive law yet — but several of those states have narrower laws worth knowing about.
Interactive US Privacy Law Map
Every state is labeled directly on the map. Click any state to jump straight to its cookie & privacy law guide — hover or tap first for a quick summary.
↔ This map is fixed-size for legible labels — scroll sideways to see the rest.
Educational purposes only — not legal advice. Laws change frequently. Always consult a qualified attorney before making compliance decisions. iQ Cookie is a technology tool, not a law firm.
Not sure where your site stands?
iQ Cookie scans your site for compliance gaps and deploys a lightweight US-built consent banner.
Laws in effect (21)
APDPA · since Jul 1, 2025
ACTOPPA teen privacy law added Jul 1, 2026 — first COPPA 2.0 state
CCPA / CPRA · since Jan 1, 2020
First state law; only dedicated privacy agency (CPPA); GPC mandatory
CPA · since Jul 1, 2023
Server-side GPC required; nonprofits covered; ADMT rules land 2027
CTDPA · since Jul 1, 2023
GPC required; threshold drops to 35k residents Jul 1, 2026
DPDPA · since Jan 1, 2025
Lowest threshold of any state law: 35,000 consumers; nonprofits covered
FDBR · since Jul 1, 2024
Narrow: $1B+ tech only; separate minors’ social media law applies broadly
INCDPA · since Jan 1, 2026
Virginia model; permanent 30-day cure period; no GPC required
ICDPA · since Jan 1, 2025
Most business-friendly law: no correction/profiling rights, 90-day cure
KCDPA · since Jan 1, 2026
Virginia model; amended (HIPAA carve-out) before taking effect
MODPA · since Oct 1, 2025
Strictest law: sensitive data sale banned outright; enforcement active Apr 2026
MCDPA · since Jul 31, 2025
Right to question profiling decisions; mandatory data inventory; cure period expired Jan 2026
MCDPA · since Oct 1, 2024
SB 297 (2025) lowered thresholds and removed the cure period entirely
NDPA · since Jan 1, 2025
Texas model: no volume threshold — small businesses exempt via SBA definition
NHDPA · since Jan 1, 2025
Low threshold: 35,000 consumers; cure period expired Dec 2025
NJDPA · since Jan 15, 2025
Covers nonprofits/universities; financial data is sensitive; cure period expired Jul 2026
OCPA · since Jul 1, 2024
One of few laws covering nonprofits; under-16 data sale ban since Sep 2025
RIDTPPA · since Jan 1, 2026
Must name current AND potential future data recipients; no cure period, no GPC mandate
TIPA · since Jul 1, 2025
$25M revenue floor; NIST framework = affirmative defense
TDPSA · since Jul 1, 2024
No volume threshold; aggressive AG enforcement
UCPA · since Dec 31, 2023
Most business-friendly; $25M revenue floor required
VCDPA · since Jan 1, 2023
The template most other states copied; geolocation sale banned Jul 2026
Signed & upcoming (4)
APDPA · signed Apr 2026
Virginia model; no GPC mandate; permanent 45-day cure period
LDPA · SB 386, signed 2026
$25M revenue floor OR 75,000 consumers; GPC required; cure period sunsets Jul 31, 2027
OCDPA · SB 546, signed Mar 2026
Narrow monetary-only "sale" definition; permanent 30-day cure period
VDPOSA · Act 145, signed Jun 2026
Lowest sensitive-data threshold in the country (3,000 residents); longest runway
No comprehensive law yet (25)
No comprehensive privacy law.
No comprehensive privacy law.
No comprehensive privacy law.
No comprehensive privacy law.
No comprehensive privacy law.
No comprehensive law — but BIPA biometric law carries a private right of action. Handle with care.
No comprehensive privacy law.
No comprehensive law — ISP privacy law only.
Bills passed both chambers — in conference committee. Likely state #26.
No comprehensive privacy law.
No comprehensive privacy law.
No comprehensive privacy law.
No comprehensive law — but websites must honor data-sale opt-outs (SB 220).
No comprehensive privacy law.
No comprehensive law — but SHIELD Act requires reasonable data security.
No comprehensive privacy law.
No comprehensive privacy law.
No comprehensive privacy law.
No comprehensive privacy law.
No comprehensive privacy law.
No comprehensive privacy law.
No comprehensive law — but My Health My Data covers health data with a private right of action.
No comprehensive privacy law.
No comprehensive privacy law.
No comprehensive privacy law.
Educational purposes only — not legal advice. This tracker summarizes state privacy laws as they relate to cookie consent and website compliance. Laws change fast — check the date stamp above. Always consult a qualified legal professional before making compliance decisions. iQ Cookie is a technology tool, not a law firm.
Selling into all 50 states?
iQ Cookie handles every state’s cookie consent rules with one lightweight US-built banner — GPC included.
iQ Cookie US State Privacy Law Tracker · Updated August 2026 · New state guides published weekly