Tennessee TIPA
In force Tennessee · In force Jul 1, 2025 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Comprehensive consumer privacy law with access, correction, deletion, portability and opt-out rights (sale, targeted ads, profiling), opt-in consent for sensitive data and data protection assessments. Controllers must keep a written privacy program that reasonably conforms to the NIST Privacy Framework, which also serves as an affirmative defense.
- Who it applies to
- Persons doing business in TN or targeting TN residents with annual revenue over $25 million that either control or process personal information of 175,000+ consumers in a calendar year, or control or process personal information of 25,000+ consumers and derive more than 50% of gross revenue from selling personal information. Exempts GLBA financial institutions, HIPAA entities, nonprofits, higher education, insurers and others.
- Penalties
- Civil penalty up to $7,500 per violation; treble damages for willful or knowing violations; injunctive relief and AG fees. 60-day cure notice required before any action; it does not sunset. No private right of action.
- Enforced by
- Tennessee Attorney General and Reporter (exclusive)
- Official name
- Tennessee Information Protection Act (HB 1181 / SB 73, 2023)
- Citation
- Tenn. Code Ann. 47-18-3301 et seq. (Pub. Ch. 408, 2023)
- Topics
- privacy
Verified 2026-09-22
Research notes
The Legislature's bill history records Pub. Ch. 408 signed by the Governor on May 24, 2023 (sent to the Governor May 11, 2023). The 60-day cure right is permanent, so there is no cure-sunset deadline. No amendments found through Sept 2026.
Related
Alabama Personal Data Protection Act (APDPA)
CCPA / CPRA
Colorado AI Act
Connecticut Data Privacy Act (CTDPA)
Delaware Personal Data Privacy Act (DPDPA)Questions about Tennessee TIPA
- What are the Tennessee TIPA compliance deadlines?
- Jul 1, 2025: TIPA takes effect.
- When does Tennessee TIPA take effect?
- Tennessee TIPA took effect on Jul 1, 2025.
- Who does Tennessee TIPA apply to?
- Persons doing business in TN or targeting TN residents with annual revenue over $25 million that either control or process personal information of 175,000+ consumers in a calendar year, or control or process personal information of 25,000+ consumers and derive more than 50% of gross revenue from selling personal information. Exempts GLBA financial institutions, HIPAA entities, nonprofits, higher education, insurers and others.
- What are the penalties under Tennessee TIPA?
- Civil penalty up to $7,500 per violation; treble damages for willful or knowing violations; injunctive relief and AG fees. 60-day cure notice required before any action; it does not sunset. No private right of action.