State Data Breach Notification Laws
Every U.S. state has its own data breach notification law with different deadlines, enforcement mechanisms, and consumer rights. Select your state to understand what companies must tell you and what remedies you may have.
Notification Deadlines
Most states require notification within 30–90 days of discovery, or 'without unreasonable delay.' Colorado and Florida have among the shortest deadlines at 30 days.
Private Right of Action
A handful of states — including California — let you sue companies directly under breach notification or privacy laws. In most states, only the AG can enforce.
Statutory Damages
California's CCPA (Cal. Civ. Code § 1798.150) provides $100–$750 per consumer per incident without proving actual harm. Illinois's BIPA can reach $1,000–$5,000 per biometric violation.
All 50 States
12 states with detailed profilesAlabama enacted its breach notification law in 2018, becoming the last state to do so. The Alabama Data Breach Notification Act (§§ 8-38-1 t…
Alaska's Personal Information Protection Act (AS 45.48.010–45.48.090) requires businesses that own or license personal information about Ala…
Arizona's data breach notification law (A.R.S. § 18-552) was updated in 2018 to require notification within 45 days of determining a breach …
Detailed profile coming soon. Select to see basic requirements.
California has the nation's strongest consumer data breach laws. As of January 1, 2026, SB 446 requires notification within a hard 30-day deadline from discovery (Cal. Civ. Code § 1798.82). The CCPA (Cal. Civ. Code § 1798.150) provides a private right of action with statutory damages of $100–$750 per consumer per incident when a company's failure to implement reasonable security exposes unencrypted personal information — no proof of actual harm required.
Colorado's Protections for Consumer Data Privacy Act (C.R.S. § 6-1-716) was significantly updated in 2018 and again in 2023. Colorado now re…
Connecticut's data breach notification law (C.G.S. § 36a-701b) requires notification within 60 days of discovery. Connecticut is notable for…
Detailed profile coming soon. Select to see basic requirements.
Florida requires notification within 30 days of determining a breach occurred — one of the nation's shortest deadlines. There is no private right of action under the breach notification statute. The AG can seek civil penalties up to $500,000 for non-compliance. Florida's law covers a broad range of personal information.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Illinois has two significant consumer data protection laws that together provide some of the strongest protections in the nation. The state'…
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Massachusetts requires breach notification as expeditiously as possible and mandates that covered businesses maintain a Written Information Security Program (WISP). Any breach affecting Massachusetts residents — no matter how small — must be reported to both the AG and the state consumer protection agency.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
New York's SHIELD Act requires notification without unreasonable delay and imposes affirmative data security obligations on all companies that own or license private information of New York residents. The AG must be notified simultaneously with affected individuals. No fixed statutory damages under the breach notification statute.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Texas requires notification within 30 days when 250 or more residents are affected. The Texas Data Privacy and Security Act (TDPSA), effective July 2024, adds new consumer rights. There is no private right of action under the breach notification statute — enforcement is through the AG only.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Washington State's data breach notification law (RCW 19.255.010) requires notification within 30 days of discovering a breach. The law cover…
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.
Detailed profile coming soon. Select to see basic requirements.