What Is the Tennessee Information Protection Act?
TIPA applies to controllers and processors meeting the statute's business, revenue, and consumer-data thresholds, subject to exemptions. Rights include delete, access, correct, port, and opt-out of targeted advertising, certain profiling, and sale. A qualifying written privacy program may support an affirmative defense; enforcement is exclusive to the AG, and the 60-day notice-and-cure process and penalty rules apply only under their statutory conditions.
At a glance
- Full name
- Tennessee Information Protection Act
- Short code
- TIPA
- Effective date
- July 1, 2025
- Response reference
- 45 days in this snapshot
- Cure period
- 60 days in this snapshot
- Private right of action
- No
- Enforcement
- Tennessee Attorney General. Consumer Protection Division
- Penalty reference
- Up to $7,500 per violation; a court may award treble damages for willful or knowing violations
- Statutory citation
- Tenn. Code Ann. §§ 47-18-3301–47-18-3315
Who TIPA applies to
A business is covered if it meets the applicability thresholds set out in Tenn. Code Ann. §§ 47-18-3301–47-18-3315. The thresholds listed below are the research record for this law. Whether one or more applies depends on the current statute, its exceptions, and the business's facts; do not assume a universal threshold structure.
- Does business in Tennessee or targets Tennessee residents, exceeds $25 million in annual revenue, and controls or processes the personal data of at least 175,000 Tennessee consumers during a calendar year
- Does business in Tennessee or targets Tennessee residents, exceeds $25 million in annual revenue, controls or processes the personal data of at least 25,000 Tennessee consumers, and derives more than 50% of gross annual revenue from the sale of personal data
Consumer rights under TIPA
Delete, access, correct, port, opt-out
Conditional NIST or comparable-framework affirmative defense
Up to $7,500 per violation; treble damages may be available for willful or knowing violations
Notable features (vs. CCPA)
TIPA gives covered consumers access, correction, deletion, portability, and opt-out rights for targeted advertising, certain profiling, and sale, with a 45-day response framework. It also offers a conditional affirmative defense when a controller or processor maintains and follows a written privacy policy that meets the statute's NIST or comparable-framework requirements; that defense does not eliminate other obligations or guarantee an enforcement result.
Enforcement and penalty reference
Enforcing agency: Tennessee Attorney General. Consumer Protection Division
Penalty reference: Up to $7,500 per violation; a court may award treble damages for willful or knowing violations
Cure period: Before bringing an action, the Attorney General must provide written notice and allow a 60-day cure period under the conditions in the statute. A cure and express written statement do not create automatic immunity if a subsequent violation occurs or the prior violation persists.
Private right of action: TIPA has no private right of action. The Tennessee Attorney General has exclusive enforcement authority.
Where to file a complaint: Tennessee Attorney General. Consumer Protection
How to exercise your TIPA rights
- 1
Identify the business that holds your data. OfflistMe can help you review a provider route across 1,034 US/global workflow profiles in the 1,052-record research universe; it does not decide whether a law applies to a specific request.
- 2
Submit a request to the business's designated contact using the provider's current verification instructions. Include only the information reasonably needed to match your record and check the applicable Tennessee residency, scope, exemption, and verification rules before sending.
- 3
This research snapshot records a 45-day reference window for the modeled request. Confirm the current statute, request type, controller scope, extension rule, and verification date before treating it as a deadline.
- 4
If the provider does not respond or disputes the request, preserve the request and response record, review the applicable exceptions, and consider the Tennessee Attorney General. Consumer Protection complaint route at https://www.tn.gov/attorneygeneral/working-for-tennessee/consumer/consumer-complaint.html. A complaint route does not itself guarantee deletion or a particular enforcement result.
Generate requests in under 60 seconds
Generate a TIPA privacy request, $9 one-time
FAQ
What is the NIST Privacy Framework affirmative defense?+
TIPA allows a controller to raise an affirmative defense when the statutory conditions for a written privacy program reasonably conforming to the NIST Privacy Framework or a comparable framework are met. The defense is fact-specific and does not guarantee that the AG will not investigate or enforce.
Official sources & citations
Compare with sibling state laws
TIPA is one of 18 comprehensive US state privacy laws. Its closest peers by effective date, useful when tracking how this law influenced or was influenced by neighboring legislation: