Colorado was among the first states to let people opt out of online tracking with a single browser signal rather than site by site, a requirement built into the Colorado Privacy Act (CPA) that has been in effect since July 1, 2023. The law gives Coloradans the same core rights to access, correct, delete, and opt out, and it empowers the Attorney General to write detailed rules carrying it out.
This survey analyzes and compares data breach notification laws across all 50 U.S. states and the District of Columbia. Using a standardized framework of 50 questions, we examined each jurisdiction's requirements for breach notification timing, covered data types, notification recipients, enforcement mechanisms, and consumer remedies.
The survey reflects statutes enacted as of January 1, 2026.
The survey reflects statutes enacted as of January 1, 2026.