Guide · State law

How do state privacy laws differ from breach notification laws?

State breach notification laws tell organisations what to do after personal information is exposed; comprehensive consumer privacy laws govern how personal data is collected and used day to day. They are separate statutes, and a state can have one without the other.

Breach notification laws

Every state and DC has one. They focus on notice after a security incident. This site covers these laws: see the laws index.

Comprehensive privacy laws

These laws give consumers rights over their data, such as access or deletion, and set duties for businesses. The list changes as legislatures pass new laws. We do not track them; for a current list, see the IAPP US state privacy legislation tracker and your state attorney general.

Does the US have data privacy laws?

Yes, but not one general law. There are federal sector laws (such as HIPAA for health information), state breach notification laws, and state comprehensive privacy laws in some states.

Frequently asked questions

How many states have data privacy laws?

All 50 states and DC have breach notification laws. For the number with comprehensive consumer privacy laws, which changes often, see the IAPP state privacy legislation tracker; this site does not track them.

Which states have data privacy laws?

Every state has a breach notification law (see our laws index). For comprehensive privacy laws, use the IAPP tracker or your state attorney general.

Does the US have data privacy laws?

Yes, through federal sector laws such as HIPAA, state breach notification laws, and comprehensive privacy laws in some states. There is no single general federal privacy law.

Sources

Last updated 2026-10-20.