The 2026 US State Privacy Laws: Every Data Removal Right by State

There is no federal data broker law in the United States. What exists instead is a patchwork of 23 state privacy laws, each with different definitions, different enforcement mechanisms, and different rights for consumers. Your ability to demand deletion of your personal data from a data broker depends significantly on which state you live in.

This guide covers every state with a comprehensive privacy law in effect or taking effect in 2026, what rights each law gives you, how to invoke those rights, and the legal timelines brokers must follow.

Key Takeaways

• No federal data broker law exists: your right to demand deletion depends entirely on which state you live in.
• 23 states now have comprehensive privacy laws with enforceable deletion rights as of mid-2026, led by California, Virginia, Colorado, and Texas, after Oklahoma, Alabama, Louisiana, and Vermont each enacted new laws in spring 2026.
• 45 days is the standard statutory response window across virtually every state law, with one 45-day extension permitted.
• California's Delete Act (DROP platform) has been live since January 1, 2026, and is the most powerful consumer tool yet: a single request covers all 575+ registered California brokers simultaneously, with brokers required to start processing requests by August 1, 2026.
• Colorado uniquely requires businesses to honor the Global Privacy Control (GPC) browser signal as a legally binding opt-out, automatically triggering opt-out when you visit covered sites.
• Residents of the 27 states without comprehensive privacy laws can still submit CCPA-cited deletion requests, as most major brokers apply CCPA-style compliance nationwide.

Why There Is No Federal Data Broker Law

Congress has introduced numerous federal privacy bills over the past decade, the American Data Privacy Protection Act (ADPPA), the Consumer Online Privacy Rights Act (COPRA), and others. None have passed into law as of 2026, primarily due to disagreement over whether federal law should preempt stronger state laws (industry-preferred) or serve as a floor that states can exceed (consumer advocates' preference).

The Federal Trade Commission has authority over data brokers under Section 5 of the FTC Act (prohibiting unfair or deceptive practices), and it has used that authority to enforce against specific egregious violations. But there is no comprehensive federal framework giving all Americans a right to delete their data from data brokers. That right, if you have it, comes from your state.

The State Privacy Law Landscape in 2026

Tier 1: Strong Comprehensive Laws (Enforceable deletion rights)

California, CCPA and CPRA

Laws: California Consumer Privacy Act (CCPA, effective 2020) and California Privacy Rights Act (CPRA, effective 2023)

Regulator: California Privacy Protection Agency (CPPA)

Deletion right: Yes, broad

Data broker registry: Yes, California's Delete Act (2023) created a mandatory data broker registry, with 575+ brokers registered as of February 2026. Since January 1, 2026, the CPPA has operated the Delete Request and Opt-Out Platform (DROP), allowing Californians to opt out of all registered brokers with a single request; registered brokers must begin processing those requests by August 1, 2026.

Timeline: Brokers must respond within 45 days (one 45-day extension permitted)

Enforcement: Private right of action for data security violations; CPPA enforcement for other violations; up to $7,500 per intentional violation

How to invoke your rights:

• For people-search sites: Submit deletion requests directly per our complete opt-out guide
• To use DROP now that it's live: cppa.ca.gov/data_broker_registry/
• File complaints: cppa.ca.gov/webapplications/complaint

Virginia, Virginia Consumer Data Protection Act (VCDPA)

Effective: January 1, 2023

Regulator: Virginia Attorney General

Deletion right: Yes

Timeline: 45 days (one 45-day extension permitted)

Enforcement: Attorney General enforcement only; no private right of action

Notable: Virginia's law covers "data brokers" explicitly and requires them to maintain a consumer request mechanism

How to invoke: Submit deletion requests directly to brokers citing "Virginia Code § 59.1-578" or use OfflistMe's first-party request system.

Colorado, Colorado Privacy Act (CPA)

Effective: July 1, 2023

Regulator: Colorado Attorney General

Deletion right: Yes

Timeline: 45 days (one 45-day extension permitted)

Global Privacy Control: Colorado requires covered businesses to honor the GPC browser signal as an opt-out. Enabling GPC in Brave or Firefox sends an automatic opt-out to covered data brokers you visit.

Enforcement: Attorney General with $20,000 per violation cap

How to invoke: Direct deletion requests to brokers citing "C.R.S. § 6-1-1306." Colorado residents can also enable GPC in their browser as an automatic opt-out for future data collection.

Connecticut, Connecticut Data Privacy Act (CTDPA)

Effective: July 1, 2023

Regulator: Connecticut Attorney General

Deletion right: Yes

Timeline: 45 days (one 45-day extension)

Enforcement: Attorney General; up to $5,000 per violation

Texas, Texas Data Privacy and Security Act (TDPSA)

Effective: July 1, 2024

Regulator: Texas Attorney General

Deletion right: Yes

Timeline: 45 days (one 45-day extension)

Notable: Broad definition of "sensitive data" including precise geolocation; applies to any business processing Texas consumers' data regardless of company location

Enforcement: Attorney General; civil penalties up to $7,500 per violation

Montana, Montana Consumer Data Privacy Act (MCDPA)

Effective: October 1, 2024

Deletion right: Yes

Timeline: 45 days

Enforcement: Attorney General

Oregon, Oregon Consumer Privacy Act (OCPA)

Effective: July 1, 2024

Deletion right: Yes, including for sensitive data

Data broker registration: Oregon requires data brokers to register with the Secretary of State and maintain an opt-out mechanism

Enforcement: Attorney General; up to $25,000 per violation (among the highest in the US)

New Hampshire, New Hampshire Privacy Act (NHPA)

Effective: January 1, 2025

Deletion right: Yes

Timeline: 45 days

Enforcement: Attorney General

New Jersey, New Jersey Data Protection Act (NJDPA)

Effective: January 15, 2025

Deletion right: Yes

Notable: Also has Daniel's Law for covered professionals (judges, law enforcement, prosecutors), strongest profession-specific protection in the US

Enforcement: Attorney General; $10,000 per violation for first offense, $20,000 for subsequent

Tier 2: Moderate Laws (Deletion rights with limitations)

Iowa, Iowa Consumer Data Protection Act (ICDPA)

Effective: January 1, 2025

Deletion right: Yes, but narrower than California, applies to data the consumer "provided" to the controller, with some exceptions

Enforcement: Attorney General; no private right of action

Indiana, Indiana Consumer Data Protection Act (INCDPA)

Effective: January 1, 2026

Deletion right: Yes

Timeline: 45 days

Delaware, Delaware Personal Data Privacy Act (DPDPA)

Effective: January 1, 2025

Deletion right: Yes

Notable: Includes data broker-specific registration requirements

Kentucky, Kentucky Consumer Data Protection Act (KCDPA)

Effective: January 1, 2026

Deletion right: Yes

Timeline: 45 days

Nebraska, Nebraska Data Privacy Act (NDPA)

Effective: January 1, 2025

Deletion right: Yes

Enforcement: Attorney General; up to $7,500 per violation

New Hampshire, New Hampshire Privacy Act

Effective: January 1, 2025

Deletion right: Yes

Tennessee, Tennessee Information Protection Act (TIPA)

Effective: July 1, 2025

Deletion right: Yes (with limitations)

Note: Applies only to companies above certain revenue and processing thresholds; fewer small data brokers are covered

Minnesota, Minnesota Consumer Data Privacy Act (MCDPA)

Effective: July 31, 2025

Deletion right: Yes

Notable: One of the stronger laws outside California; includes data minimization requirements

Maryland, Maryland Online Data Privacy Act (MODPA)

Effective: October 1, 2025

Deletion right: Yes

Notable: Among the strongest in the US alongside California; broad definition of "sensitive data" and strong minimization requirements

Rhode Island, Rhode Island Data Transparency and Privacy Protection Act

Effective: January 1, 2026

Deletion right: Yes

Tier 3: States Without Comprehensive Privacy Laws (as of 2026)

These states do not have comprehensive consumer privacy laws giving residents a right to delete their data from data brokers. Residents may still submit deletion requests, most major brokers apply CCPA-style compliance nationally, but there is no state enforcement mechanism if a broker refuses.

States currently without comprehensive consumer privacy laws:

Alabama, Alaska, Arizona, Arkansas, Georgia, Hawaii, Idaho, Kansas, Louisiana, Massachusetts, Michigan, Mississippi, Missouri, Nevada, New Mexico, New York (partial laws exist but not comprehensive), North Carolina, North Dakota, Ohio, Oklahoma, Pennsylvania, South Carolina, South Dakota, West Virginia, Wisconsin, Wyoming

Residents of these states can still:

• Submit deletion requests to brokers citing CCPA (most brokers honor these nationally)
• File FTC complaints at ftc.gov/complaint for deceptive or unfair practices
• Use general state consumer protection statutes in some cases

The Data Broker-Specific Laws (Separate from General Privacy Laws)

Vermont, Data Broker Registration Law (2019)

Vermont was the first state to require data brokers to register with the state and disclose their opt-out mechanisms. The registration database is public and searchable at bizfilings.vermont.gov/online/DatabrokerInquire/. The law does not create individual deletion rights, it creates transparency and registration requirements.

Oregon, Data Broker Registration (2024)

Oregon added data broker registration requirements to its comprehensive privacy law, requiring brokers to list their data categories and opt-out mechanisms.

California, Delete Act (2023)

As described above, creates the DROP platform for single-request deletion from all registered California brokers, live since January 1, 2026.

How to Invoke Your Rights (Practical Guide)

Step 1: Identify the applicable law

If you live in a state listed in Tier 1 or Tier 2 above, you have statutory deletion rights. Use your state's law citation in your deletion request.

Step 2: Submit a direct deletion request

Send an email to privacy@[broker].com with:

• Your full name
• Your email address
• Your state of residence
• The specific statutory citation (e.g., "CCPA Section 1798.105" or "Virginia Code § 59.1-578")
• A request for deletion of all personal data the company holds about you

Step 3: Track your request

Log each submission. The broker must respond within 45 days (or 90 days maximum with a disclosed extension).

Step 4: Escalate non-compliance

If the broker does not respond within the statutory window:

State Law Comparison Table

Frequently Asked Questions

Can I use California's CCPA if I don't live in California?

Not strictly. CCPA grants rights to "California residents." However, most major data brokers apply CCPA-style compliance nationwide because managing separate compliance by state is administratively impractical. In practice, citing CCPA in a deletion request is often effective regardless of your state, the broker treats it as a valid request rather than managing geographic restrictions.

What is the strongest state privacy law in 2026?

California has the broadest and most actively enforced privacy framework, particularly with the Delete Act's DROP platform, live since January 2026 and already processing requests against 575+ registered brokers. Maryland (effective October 2025) has emerged as the second-strongest, with particularly strong data minimization requirements. Oregon is notable for its $25,000 per violation penalty, among the highest in the US.

Does the GPC browser signal actually work?

In Colorado and California, covered businesses are legally required to honor the Global Privacy Control signal as an opt-out. Enable GPC in Brave (it's on by default) or in Firefox (Privacy Badger or DuckDuckGo extension). When you visit a covered data broker's website, the browser automatically signals opt-out. This is limited to data collection during visits, it does not delete historical records.

What happens to data collected before a privacy law took effect?

Most state privacy laws apply to data currently held, not just data collected after the law's effective date. A valid deletion request under CCPA or VCDPA applies to all personal data the company holds about you, regardless of when it was collected.

My state isn't on the list. Am I out of options?

Not entirely. Most major data brokers honor deletion requests from all US residents due to the administrative complexity of geographic enforcement. Submitting a request citing CCPA and noting "I request compliance in accordance with generally accepted privacy standards" is often effective. You can also file FTC complaints at ftc.gov/complaint if a broker engages in deceptive practices.

Data broker deletion rights in the US are real, enforced, and growing. The patchwork is frustrating, but the underlying legal obligation exists in the states where most US adults live. Use it.

Submit deletion requests to 500+ data brokers from your own inbox →

The Federal vs. State Privacy Battle in 2026

The debate over a unified federal privacy framework remains unresolved in 2026. The primary point of contention is preemption: industry groups lobby for a federal law that overrides stronger state laws, while consumer advocates demand a baseline federal law that allows states to enact stricter protections.

The Practical Impact of the Patchwork:

• Compliance Complexity: Data brokers must navigate different statutory rules, registration requirements, and penalty levels across 23 states.
• Nationwide Deletion Workflows: Because maintaining state-specific workflows is operationally costly, most national data brokers honor deletion requests from all US residents, utilizing CCPA-compliant infrastructure as the default nationwide standard.
• The GPC Signal Standard: The Global Privacy Control (GPC) signal is emerging as a critical tool, with states like Colorado and California legally requiring businesses to honor it as a binding consumer opt-out request.

Related Guides

• California Data Broker Opt-Out: Your CCPA Rights
• Texas Data Privacy Rights (TDPSA)
• Virginia Data Privacy Rights (VCDPA)
• Colorado Data Privacy Rights (CPA)
• FCRA and Data Brokers Explained
• Is Doxxing Illegal? A State-by-State Guide