Eight comprehensive state privacy laws took effect in 2025 alone, more than any other single year since California's CCPA started the clock in January 2020, according to PrivacyTerms.io's compilation of the IAPP US State Privacy Legislation Tracker and MultiState's 2026 roundup. That one year accounts for 8 of the 20 effective dates now on the books, and the timeline below plots every one of them.
How many state privacy laws take effect each year?
The pace has been uneven but never slowed. California's law took effect alone in 2020, no state law took effect in 2021 or 2022, then 4 states followed in 2023, another 4 in 2024, and 8 in 2025, the busiest year yet. Three more, Indiana, Kentucky, and Rhode Island, started on January 1, 2026.
Figure 1: State privacy laws that took effect, by year, 2020 through 2026. 2025 is the single busiest year on record. Source: IAPP US State Privacy Legislation Tracker, PrivacyTerms.io compilation.
That 2025 spike is not a sign new laws were rushed through that year. Every one of the 8 laws that took effect in 2025 had actually been signed in an earlier legislative session; MultiState's 2026 roundup notes that no entirely new comprehensive privacy law was passed during 2025 itself. The 8 effective dates were simply the delayed arrival of bills states had already enacted, most commonly on a 12-to-18-month runway between signing and enforcement.
What does the full 2020-2026 timeline look like?
Reading the year-by-year count as a running total shows how quickly the map filled in. From 1 state in 2020, the count reached 5 by the end of 2023, 9 by the end of 2024, 17 by the end of 2025, and 20 as of January 2026, a twentyfold increase in 6 years.
Figure 2: Cumulative states with an effective comprehensive privacy law, 2020 through 2026. Source: IAPP US State Privacy Legislation Tracker, MultiState 2026 roundup, PrivacyTerms.io compilation.
At that pace, a new state's law has reached its effective date roughly every 110 days on average since January 2020, based on PrivacyTerms.io's own calculation of the 20 effective dates spread across the 2,192 days between California's start date and January 1, 2026. A business tracking compliance obligations state by state cannot treat this as a once-a-year review; a privacy policy generator built to track new state effective dates is the more realistic way to keep a public-facing policy current as the list keeps growing.
Which states have a privacy law and when did each one take effect?
Twenty states, in order of effective date, make up the current timeline. For a deeper breakdown of what each law actually requires, thresholds, and enforcement mechanics, see our full state-by-state privacy law list and tracker.
| Year | States that took effect | Count | Cumulative total |
|---|---|---|---|
| 2020 | California | 1 | 1 |
| 2023 | Virginia, Colorado, Connecticut, Utah | 4 | 5 |
| 2024 | Texas, Oregon, Montana, Florida | 4 | 9 |
| 2025 | Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland | 8 | 17 |
| 2026 | Indiana, Kentucky, Rhode Island | 3 | 20 |
Source: IAPP US State Privacy Legislation Tracker and MultiState's 2026 comprehensive-law roundup, compiled by PrivacyTerms.io. Cumulative totals count each state once, as of its own effective date, not its signing date.
2025's 8-law total is more than the 2023 and 2024 totals combined, and it is the clearest single data point showing the timeline has accelerated rather than leveled off since California went first in 2020.
How many enacted laws are still waiting to take effect?
Not every enacted state privacy law is live yet. Of the 24 states that have passed a comprehensive privacy law, 20 have reached their effective date and 4 have not: Alabama, Louisiana, Oklahoma, and Vermont, according to Byte Back's June 2026 legislative roundup. None of the four had a confirmed effective date locked in as of this post's October 2026 refresh, and PrivacyTerms.io has not found a primary-source effective date for any of them precise enough to publish here.
Figure 3: Share of the 24 enacted state privacy laws that are in effect versus still pending, as of October 2026. Source: IAPP US State Privacy Legislation Tracker, Byte Back 2026 roundup.
| State | Law status | Effective date |
|---|---|---|
| Alabama | Enacted, 2026 | Not yet confirmed |
| Louisiana | Enacted, 2026 | Not yet confirmed |
| Oklahoma | Enacted, 2026 | Not yet confirmed |
| Vermont | Enacted, 2026 | Not yet confirmed |
Source: Byte Back, "U.S. State Privacy Law Landscape Expands to 24 States" (2026). Effective dates will be added to this table once a primary source confirms them; check back at this post's next refresh.
If the 12-to-18-month signing-to-effective pattern seen in the 2025 cohort holds, most of these 4 states should reach their own effective dates sometime in 2027, though PrivacyTerms.io is not treating that as a confirmed figure until a primary source publishes it.
How fast is the list of states with a live privacy law still growing?
20 states in effect as of January 2026 is up 3 from the 17 in effect at the end of 2025, itself up 8 from the 9 in effect at the end of 2024. The year-over-year growth rate has not been constant: doubling roughly every 2 years through 2024, then nearly doubling again in the single year 2025 before slowing to a 3-state gain in 2026's first days.
Figure 4: States with an effective comprehensive privacy law, year over year, ending at 20 in January 2026. Source: IAPP US State Privacy Legislation Tracker, PrivacyTerms.io compilation.
Whether 2027 repeats 2025's 8-law spike depends largely on whether Alabama, Louisiana, Oklahoma, and Vermont's laws reach their effective dates in the same year, which is not yet confirmed.
The Bottom Line
Eight state privacy laws taking effect in a single year, 2025, is the strongest evidence yet that the state-by-state privacy law timeline is not slowing down. Six years after California went first alone, 20 states now enforce a comprehensive privacy law and 4 more have already been signed and are simply waiting for their effective date. A business collecting personal data from US consumers cannot treat this as a one-time compliance project; the list has changed on a new effective date roughly once every 110 days since 2020, and it is on track to keep changing at a similar pace through the rest of the decade.
Frequently Asked Questions
What year had the most state privacy law effective dates? 2025, when 8 state privacy laws took effect: Delaware, Iowa, Nebraska, and New Hampshire on January 1, New Jersey on January 15, Tennessee on July 1, Minnesota on July 31, and Maryland on October 1, per PrivacyTerms.io's compilation of the IAPP US State Privacy Legislation Tracker.
How many state privacy laws are in effect versus enacted as of 2026? 20 states have a comprehensive privacy law in effect as of January 2026, while 24 states have enacted one in total, according to the IAPP tracker and Byte Back's June 2026 roundup. The 4 gap states, Alabama, Louisiana, Oklahoma, and Vermont, had passed a law that had not yet reached its effective date as of this post's October 2026 refresh.
Which state privacy law took effect first? California's CCPA took effect January 1, 2020, starting a timeline that reached 20 states with an effective law over the next 6 years, according to the IAPP US State Privacy Legislation Tracker.
How long did it take state privacy laws to go from 1 state to 20? 6 years, from California's January 1, 2020 effective date to Indiana, Kentucky, and Rhode Island joining the list on January 1, 2026, per PrivacyTerms.io's timeline compiled from the IAPP tracker and MultiState's 2026 roundup.
Where the Numbers Come From
- IAPP. "US State Privacy Legislation Tracker." 20 states with a comprehensive privacy law in effect as of January 2026, the primary source for every effective date used in this post's timeline.
- MultiState. (2026). "All of the Comprehensive Privacy Laws That Take Effect in 2026." Confirms Indiana, Kentucky, and Rhode Island effective January 1, 2026, and notes no entirely new comprehensive privacy law was passed during 2025 itself.
- Byte Back. (2026). "U.S. State Privacy Law Landscape Expands to 24 States." Source for Alabama, Louisiana, Oklahoma, and Vermont's 2026 enactments and the 24-state total, though it does not publish individual effective dates for those 4 states.
- Troutman Pepper Locke. (2023). "U.S. State Privacy Laws in 2023: California, Colorado, Connecticut, Utah and Virginia." Confirms the 2023 effective dates for the first four-state cohort to follow California.
Note: All figures verified as of October 2026. The year-by-year counts, cumulative totals, and the 110-day average gap between effective dates are PrivacyTerms.io's own calculations, run on the same 20 confirmed effective dates first compiled in our companion state-by-state privacy law tracker. This timeline is refreshed at least twice a year as new states reach their effective dates.
