In effect since January 1, 2025, the Iowa Consumer Data Protection Act (ICDPA) lets Iowans see, delete, and obtain a copy of the data companies hold and opt out of its sale. It is narrower than most state laws, though: Iowa grants no right to correct inaccurate data, and where most states make a company get a person's consent before handling sensitive information, it asks only that the company offer a chance to opt out.

The California Consumer Privacy Act (CCPA) was the first comprehensive consumer privacy law in the United States, in effect since 2020 and broadened in 2023 by the California Privacy Rights Act. It lets Californians see, correct, and delete the personal information businesses collect about them and opt out of its sale or sharing, and it remains the only state law backed by a dedicated regulator, the California Privacy Protection Agency.