Colorado was among the first states to let people opt out of online tracking with a single browser signal rather than site by site, a requirement built into the Colorado Privacy Act (CPA) that has been in effect since July 1, 2023. The law gives Coloradans the same core rights to access, correct, delete, and opt out, and it empowers the Attorney General to write detailed rules carrying it out.

The Montana Consumer Data Privacy Act (MTCDPA) took effect on October 1, 2024, and its lower coverage thresholds mean it protects Montanans' data across a wider range of companies than most state laws reach. It lets Montanans access, correct, delete, and opt out of the sale and targeted-advertising uses of their data, and a 2025 amendment added strong new protections for the data of minors.

The Connecticut Data Privacy Act (CTDPA) has been in force since July 1, 2023 and sits among the stronger state privacy laws. Alongside the core rights to access, correct, delete, and opt out, Connecticut returned in 2023 to widen the law with added protections for health data and for the personal information of children and teens.