The State Privacy Rights Gap

Key findings

• Roughly half of Americans aren’t covered. ~167 million people (50%) live in a state with no comprehensive privacy law in effect; ~168 million (50%) are.
• Your rights depend on your ZIP code. 20 states protect you, 28 have nothing yet, and 3 have laws that haven’t taken effect.
• Data brokers are barely regulated. Only 5 states (California, Connecticut, Texas, Oregon, Vermont) make brokers register — covering just ~78 million people.
• The patchwork is accelerating. From 1 state law in effect in 2020 to 20 in 2026 — but it’s a state-by-state scramble, not a federal right.

Who’s covered — by population

Share of the U.S. population living under a comprehensive privacy law in effect today (U.S. Census 2023 populations).

The patchwork, year by year

Cumulative number of states with a comprehensive privacy law in effect.

Not all rights are equal

Of the 20 in-effect laws, the share that grant each consumer right.

Every state, at a glance

Comprehensive consumer privacy law status for all 50 states and D.C., with the statute and effective date where one exists.

How to exercise your privacy rights

1. Find the business’s privacy request form — look for “Your Privacy Choices”, “Do Not Sell My Personal Information”, or a privacy-policy link.
2. Submit your request to access, delete, correct or stop the sale of your data (the exact rights vary by state).
3. Verify your identity; the business generally must respond within 45 days.
4. Opt out of data brokers separately — statutory requests only reach companies you contact, not the brokers reselling your profile.
5. Escalate by filing a complaint with your state attorney general (or the CPPA in California) if a business ignores you.

See the exact rights and steps for your state in our privacy rights by state guide.

Why the gap matters

The United States has no comprehensive federal privacy law, so the right to see, delete or stop the sale of your data exists only where your state has passed one. The result is a map where two neighbors can have completely different protections. And even within the 20 covered states, the rights aren’t identical — every in-effect law lets you delete your data, but a handful still don’t let you correct it or opt out of profiling. Meanwhile the part of the industry most responsible for spreading your address and phone number — data brokers — is directly regulated in just 5 states. The practical takeaway: no matter where you live, your strongest lever is to remove your data from brokers directly, because that doesn’t wait on your statehouse.

Why there’s no federal privacy law (yet)

The U.S. has never passed a comprehensive federal consumer privacy law, so protection is left to the states — which is why the map is a patchwork. Where a state law doesn’t reach, residents fall back on sectoral federal laws: the FTC Act (unfair or deceptive practices), the FCRA (background and credit reports), GLBA (financial data) and HIPAA (health data). None of these grant a blanket right to delete your data — but every American can still opt out of data brokers directly, no state law required.

The 5 states that regulate data brokers

Only California, Connecticut, Texas, Oregon, Vermont require data brokers to register with the state — covering roughly 78 million people. California goes furthest: its DELETE Act and DROP platform let residents delete themselves from every registered broker with a single request. Everywhere else, you opt out broker by broker.

Key terms

Sources & further reading

• IAPP — US State Privacy Legislation Tracker: the canonical status of every state law.
• California Privacy Protection Agency (CPPA): the DELETE Act and the DROP platform.
• U.S. Census Bureau — Population Estimates: 2023 state populations used here.
• PersProtect privacy rights by state: the per-state detail behind this study.

Use this data

Free to cite under Creative Commons BY 4.0 with a link back. Copy the snippet to embed a headline stat:

<p>According to PersProtect's State Privacy Rights Gap study, about 167 million Americans live in a state with no comprehensive data privacy law. <a href="https://persprotect.com/research/state-privacy-rights-gap">Read the study</a>.</p>

Journalists: email support@persprotect.com for the state-by-state breakdown.