The Connecticut Data Privacy Act (CTDPA) has been in force since July 1, 2023 and sits among the stronger state privacy laws. Alongside the core rights to access, correct, delete, and opt out, Connecticut returned in 2023 to widen the law with added protections for health data and for the personal information of children and teens.
In effect since January 1, 2025, the Iowa Consumer Data Protection Act (ICDPA) lets Iowans see, delete, and obtain a copy of the data companies hold and opt out of its sale. It is narrower than most state laws, though: Iowa grants no right to correct inaccurate data, and where most states make a company get a person's consent before handling sensitive information, it asks only that the company offer a chance to opt out.
The Virginia Consumer Data Protection Act (VCDPA) took effect on January 1, 2023, making Virginia the second state, after California, to enact a comprehensive privacy law. California set the strongest standard, but many of the states that came after have followed Virginia's more limited model rather than California's. It lets Virginians access, correct, delete, and obtain a copy of their data and opt out of targeted advertising, data sales, and certain profiling.
In 2025, the Data Breach Chronology captured 8,019 data breach notification filings from state and federal agencies that publish breach reports. These represented 4,080 unique breach events impacting at least 375 million individuals.
The year's statistics were dominated by Change Healthcare, whose final notification arrived in October, twenty months after the February 2024 ransomware attack, confirming 192.7 million people were affected. It's the largest healthcare data breach ever recorded, more than double the Anthem breach that held that record for a decade.
This survey analyzes and compares data breach notification laws across all 50 U.S. states and the District of Columbia. Using a standardized framework of 50 questions, we examined each jurisdiction's requirements for breach notification timing, covered data types, notification recipients, enforcement mechanisms, and consumer remedies.
This survey reflects statutes enacted as of January 1, 2026.
Explore the Data
Governor Newsom has signed SB 361, AB 566, AB 656, and SB 446 into law, advancing browser controls, data broker transparency, social media account deletion, and breach notification—continuing California's role as a national leader in consumer data privacy.
AB 566: Requiring Browsers to Make it Easier for Californians to Exercise Privacy Rights
Written in collaboration with the Electronic Frontier Foundation
A unified database of 750+ data brokers across five state registries—and the compliance gaps we found
We are joining 40+ consumer, civil rights, housing, and privacy organizations in urging the Consumer Financial Protection Bureau to maintain and continue its Consumer Complaint Intake System in the face of pressures to eliminate this vital consumer protection tool.