Comprehensive Privacy Laws
- Tennessee Information Protection Act. The Tennessee Information Protection Act (TIPA) takes effect on July 1, 2025. TIPA adopts the general framework used in Virginia and other state privacy statutes. The law applies to businesses that, among other things, process personal data of at least 175,000 consumers annually—or 25,000 if the business derives over 50% of its revenue from selling personal data—and grants Tennessee residents rights to access, delete, correct, and port their personal data, as well as opt out of targeted advertising, sales, and profiling. Notably, the law requires opt-in consent for processing sensitive data and mandates data protection assessments for high-risk activities. Additionally, enforcement authority lies solely with the Tennessee Attorney General, with a 60-day cure period for violations.
- Minnesota Consumer Data Privacy Act. The Minnesota Consumer Data Privacy Act takes effect on July 31. The act generally follows the Virginia model, with some unique provisions, including additional consumer rights around automated decision-making and detailed compliance documentation requirements. Notably, the act refers to “specific” geolocation data, unlike other state statutes which refer to “precise” geolocation data and focuses on accuracy to geographic coordinate system points or street addresses. We previously covered this privacy act in more detail here.
- Louisiana HB 577. This Louisiana law, which comes into force on July 1, restricts social media platforms’ processing of personal data from minors under the age of 18. Among other requirements, a covered social media platform may not sell U18 minors’ sensitive personal data (as defined in the law) or display targeted advertising to them. The law does not require age verification, and restrictions apply only where a social media platform has actual knowledge of a user’s age.
- Louisiana Secure Online Child Interaction and Age Limitation Act. This Louisiana law also becomes effective on July 1, though enforcement has been stayed until December 19, 2025, as part of ongoing litigation. Among other provisions, it requires parental consent for a minor under the age of 16 to create an account on a social media platform, prohibits advertising to U16 minors using personal information other than the minor’s age and location, and requires social media platforms to restrict adults from sending direct messages to a U16 minor unless they are already connected on the platform. The law also requires that social media platforms make certain account supervision features available to parents, as well as the ability to set screen time limits and scheduled breaks. The law requires that social media platforms make “commercially reasonable efforts” to verify the ages of account holders and determine whether they are U16 minors, or otherwise apply limitations required for minors to the accounts of all users.