Privacy rights in states without a comprehensive law
While 20 states have a comprehensive consumer privacy law, about 28 still don’t. If you live in one of them, you’re not without protection: federal laws apply in every state, and you can remove your data from brokers no matter where you live.
The federal protections you always have
The U.S. has no single comprehensive federal privacy law, but several federal laws give you real leverage in every state:
FTC Act (Section 5)
The Federal Trade Commission can act against unfair or deceptive data practices nationwide, and your state attorney general can enforce similar consumer-protection rules.
Fair Credit Reporting Act (FCRA)
You can dispute inaccurate information in background checks and credit reports — which covers many people-search and screening products — and have errors corrected.
Gramm-Leach-Bliley Act (GLBA)
Financial institutions must explain how they share your financial data and let you opt out of some sharing.
HIPAA
Health-care providers, plans and their partners must protect your medical information and limit how it’s shared.
How to remove your data without a state law
- Use your federal rightsDispute inaccurate background- or credit-report data under the FCRA, and report unfair or deceptive practices to the FTC.
- Opt out of data brokers directlyYou don’t need a state law — every major data broker and people-search site is required to honor a removal request.
- Work through the brokers that list youUse each broker’s official opt-out process; start with the largest people-search sites that anyone can look you up on.
- Re-check every few weeksBrokers re-list people from fresh public records, so a one-time removal isn’t enough — repeat or automate it.
States with a law on the way
Alabama
Enacted the Alabama Personal Data Protection Act (APDPA), effective May 1, 2027. Until then, federal protections and direct broker opt-outs apply.
Oklahoma
Enacted the Oklahoma Consumer Data Privacy Act (OCDPA), effective January 1, 2027. Until then, federal protections and direct broker opt-outs apply.
Vermont
Enacted the Vermont Data Privacy and Online Surveillance Act (VDPOSA), effective January 1, 2028. Yes — Vermont has run the original U.S. data-broker registry since 2018, already in effect.
States without a comprehensive privacy law
Residents of these states rely on the federal protections above — plus, in some, a narrower law covering specific data. The direct data-broker opt-out works the same in all of them.
Alaska
Alaska has no comprehensive consumer privacy law. Residents rely on federal protections (FTC Act, FCRA, GLBA, HIPAA) and can opt out of data brokers directly.
Arizona
Arizona has no comprehensive consumer privacy law. Residents rely on federal protections (FTC Act, FCRA, GLBA, HIPAA) and can opt out of data brokers directly.
Arkansas
Arkansas has no comprehensive consumer privacy law. Residents rely on federal protections (FTC Act, FCRA, GLBA, HIPAA) and can opt out of data brokers directly.
Georgia
Georgia has no comprehensive consumer privacy law. Residents rely on federal protections (FTC Act, FCRA, GLBA, HIPAA) and can opt out of data brokers directly.
Hawaii
Hawaii has no comprehensive consumer privacy law. Residents rely on federal protections (FTC Act, FCRA, GLBA, HIPAA) and can opt out of data brokers directly.
Idaho
Idaho has no comprehensive consumer privacy law. Residents rely on federal protections (FTC Act, FCRA, GLBA, HIPAA) and can opt out of data brokers directly.
Illinois
Illinois has no comprehensive privacy law, but its Biometric Information Privacy Act (BIPA) strictly regulates fingerprints, face scans and other biometric data — and uniquely lets residents sue companies directly.
Kansas
Kansas has no comprehensive consumer privacy law. Residents rely on federal protections (FTC Act, FCRA, GLBA, HIPAA) and can opt out of data brokers directly.
Louisiana
Louisiana has no comprehensive consumer privacy law. Residents rely on federal protections (FTC Act, FCRA, GLBA, HIPAA) and can opt out of data brokers directly.
Maine
Maine has no comprehensive privacy law, but it has one of the strictest ISP privacy laws, barring internet providers from selling customer data without opt-in consent.
Massachusetts
Massachusetts has no comprehensive consumer privacy law. Residents rely on federal protections (FTC Act, FCRA, GLBA, HIPAA) and can opt out of data brokers directly.
Michigan
Michigan has no comprehensive consumer privacy law. Residents rely on federal protections (FTC Act, FCRA, GLBA, HIPAA) and can opt out of data brokers directly.
Mississippi
Mississippi has no comprehensive consumer privacy law. Residents rely on federal protections (FTC Act, FCRA, GLBA, HIPAA) and can opt out of data brokers directly.
Missouri
Missouri has no comprehensive consumer privacy law. Residents rely on federal protections (FTC Act, FCRA, GLBA, HIPAA) and can opt out of data brokers directly.
Nevada
Nevada has no comprehensive privacy law, but a narrower statute lets residents tell websites not to sell their covered personal information.
New Mexico
New Mexico has no comprehensive consumer privacy law. Residents rely on federal protections (FTC Act, FCRA, GLBA, HIPAA) and can opt out of data brokers directly.
New York
New York has no comprehensive consumer privacy law yet, but the SHIELD Act imposes data-security duties and breach-notification requirements on businesses holding New Yorkers’ data.
North Carolina
North Carolina has no comprehensive consumer privacy law. Residents rely on federal protections (FTC Act, FCRA, GLBA, HIPAA) and can opt out of data brokers directly.
North Dakota
North Dakota has no comprehensive consumer privacy law. Residents rely on federal protections (FTC Act, FCRA, GLBA, HIPAA) and can opt out of data brokers directly.
Ohio
Ohio has no comprehensive consumer privacy law. Residents rely on federal protections (FTC Act, FCRA, GLBA, HIPAA) and can opt out of data brokers directly.
Pennsylvania
Pennsylvania has no comprehensive consumer privacy law. Residents rely on federal protections (FTC Act, FCRA, GLBA, HIPAA) and can opt out of data brokers directly.
South Carolina
South Carolina has no comprehensive consumer privacy law. Residents rely on federal protections (FTC Act, FCRA, GLBA, HIPAA) and can opt out of data brokers directly.
South Dakota
South Dakota has no comprehensive consumer privacy law. Residents rely on federal protections (FTC Act, FCRA, GLBA, HIPAA) and can opt out of data brokers directly.
Washington
Washington has no comprehensive privacy law, but its My Health My Data Act tightly regulates consumer health data and lets residents sue directly.
Washington, D.C.
Washington, D.C. has no comprehensive consumer privacy law. Residents rely on federal protections (FTC Act, FCRA, GLBA, HIPAA) and can opt out of data brokers directly.
West Virginia
West Virginia has no comprehensive consumer privacy law. Residents rely on federal protections (FTC Act, FCRA, GLBA, HIPAA) and can opt out of data brokers directly.
Wisconsin
Wisconsin has no comprehensive consumer privacy law. Residents rely on federal protections (FTC Act, FCRA, GLBA, HIPAA) and can opt out of data brokers directly.
Wyoming
Wyoming has no comprehensive consumer privacy law. Residents rely on federal protections (FTC Act, FCRA, GLBA, HIPAA) and can opt out of data brokers directly.
No law? You can still disappear from the brokers
See where you’re exposed for free — then we remove your data from 499 broker and people-search sites and keep it gone, in any state.
See also: privacy rights by state · data-broker opt-out guide
Common questions
No state law — what now?
Can I still delete my personal data if my state has no privacy law?
Yes. Federal protections like the FTC Act and the Fair Credit Reporting Act apply in every state, and every major data broker and people-search site is required to honor an opt-out request regardless of where you live.
Which states have no comprehensive privacy law?
About 28 states still have no comprehensive consumer privacy law, including New York, Pennsylvania, Ohio, Georgia, Michigan and Massachusetts. Some have narrower laws covering specific data like biometrics or health information.
Is a privacy law coming to my state?
Possibly. Oklahoma, Alabama and Vermont have already enacted laws that take effect in 2027–2028, and comprehensive bills are pending in many other states. Until one passes, federal protections and direct data-broker opt-outs are your tools.