AI laws, privacy rules, and cybersecurity requirements — tracked for you.

Montana grants rights to access, delete, correct, and port personal data and to opt out of sale, targeted advertising, and profiling. Controllers and processors must provide clear notices, maintain contracts, and honor consumer rights requests. Amendments effective in 2025 lowered applicability thresholds and tightened disclosure and opt-out expectations for data sales and targeted advertising.

Indiana gives consumers rights to confirm processing, access data, correct inaccuracies, delete certain personal data, obtain portable copies, and opt out of targeted advertising, sale, and profiling. It applies to businesses that meet threshold tests and requires clear notices, purpose limitation, security safeguards, and contracts with processors. The attorney general enforces the law after a cure process.

New York requires operators of covered online sites, services, and connected devices to provide privacy-by-default protections for minors and to limit data processing unless a statutory exception applies. It affects operators directed to children or that know a user is under 18, with special focus on profiling, data transfers, and persistent identifiers.

Iowa gives consumers rights to know whether personal data is processed, access and delete data they provided, and obtain a portable copy, while also allowing opt outs from data sale. It applies to controllers that meet volume thresholds and focuses on privacy notices, reasonable security, and processor contracts. Compared with some other state privacy laws, it is narrower on correction and sensitive-data consent requirements.

Florida created a state privacy regime for large covered controllers, giving consumers rights around access, deletion, correction, portability, opt outs, and sensitive-data disclosures. It affects the largest consumer-facing platforms doing business in Florida and also imposes privacy notice, contract, and sale-of-data requirements.

Oregon gives consumers rights to access, correct, delete, and port personal data and to opt out of sale, targeted advertising, and certain profiling. Controllers must provide privacy notices, minimize data, conduct assessments for higher-risk processing, and obtain consent before processing sensitive data. The law also reaches many nonprofit organizations that are exempt under other state privacy regimes.

Texas created a broad consumer privacy law that covers access, deletion, portability, and correction rights, with obligations focused on data controllers and processors.

Washington protects consumer health data that falls outside HIPAA, including reproductive, biometric, and location-linked health inferences. Regulated entities generally need separate consent for collection and sharing, valid authorization for sale, and cannot geofence around health care facilities for certain purposes. The law applies broadly to companies doing business in Washington or targeting Washington consumers.

California expanded its data-broker regime by moving registration oversight to the California Privacy Protection Agency and by requiring a one-stop deletion mechanism for covered data brokers. It primarily affects data brokers that trade in Californians'' personal information and requires recurring deletion processing, public reporting, and audit-related disclosures.

Connecticut gives residents rights to access, correct, delete, and port personal data, and to opt out of targeted advertising, sale, and certain profiling. Covered controllers must limit collection to what is reasonably necessary, conduct data protection assessments for higher-risk processing, and obtain consent for sensitive data. The statute also added stronger youth-protection rules beginning in 2025.

The CPRA amended the CCPA, expanded consumer rights around sensitive personal data, and created the California Privacy Protection Agency to enforce the regime.

Virginia gives consumers rights to access, correct, delete, and obtain a copy of personal data, and to opt out of targeted advertising, sale, and certain profiling. It applies to controllers and processors that meet statutory thresholds and requires privacy notices, data protection assessments, and contracts with processors. Sensitive data processing generally needs consumer consent.

The GDPR sets the EU baseline for personal-data processing, requiring lawful bases, transparency, security safeguards, and rights for access, deletion, and objection.