Free reference 23 state laws

Which state privacy laws exempt GLBA financial institutions?

Name: State privacy laws and the GLBA exemption
Creator: RiskTemplates
License: https://creativecommons.org/licenses/by/4.0/

Short answer

Of the 23 comprehensive state consumer privacy laws tracked here (as of September 30, 2026), 17 exempt GLBA financial institutions entirely, 5 (Connecticut, Montana, Oregon, Minnesota and Vermont) exempt only banks and similar chartered institutions as entities and give other financial institutions a data-level exemption, and California exempts only data subject to GLBA.

For a non-bank fintech, a data-level exemption covers only data subject to GLBA; its other personal data, such as website and marketing data, still has to meet the state law. Delaware changes on January 1, 2027: GLBA entity exemption narrowed to banks and other listed institutions.

Last verified: September 30, 2026

Download CSV JSON

How to use this Sources

What the GLBA exemption means for a fintech

Three kinds of exemption. The quote under each is the dataset's fintech note for one example state.

17Entity-level exemption

Entity: GLBA financial institutions exempt, plus GLBA data

Virginia, Colorado, Utah, Iowa, Indiana, Tennessee, Texas, Delaware, New Hampshire, New Jersey, Nebraska, Maryland, Kentucky, Rhode Island, Oklahoma, Alabama and Louisiana

Colorado: Colorado exempts GLBA financial institutions and their affiliates as entities, which is broader than most states. A fintech that is not a GLBA financial institution is fully covered, including biometric duties (such as KYC selfie or face match) with no volume threshold.

5Banks only (entity) + data

Banks only (entity) + data: banks and similar institutions exempt; other fintechs exempt only for GLBA data

Connecticut, Montana, Oregon, Minnesota and Vermont

Connecticut: As of July 1, 2026 non-bank fintechs lose CT's entity-level GLBA exemption, and processing any sensitive data (which now includes financial account credentials and SSNs) triggers coverage with no volume minimum.

1Data-level only

Data only: only data subject to GLBA is exempt; the rest of a fintech's data is covered

California

California: The GLBA exemption covers data, not the institution, so a fintech's non-GLBA data (website and marketing tracking, B2B contacts, employee and applicant data) stays in scope. Automated decision-making rules generally reach decisions only to the extent they use non-GLBA personal information — confirm with counsel.

State privacy laws and their GLBA treatment

Open "Statute text" under each GLBA entry for the exemption language as quoted in the review. Short summaries of thresholds, cure periods and penalties expand to the fuller detail.

Comprehensive state privacy laws and GLBA exemptions, 23 states, last verified September 30, 2026
State	Law and citation	Effective	Applies to	GLBA exemption	Nonprofit exemption	Enforcer	Cure period	Private right of action	Penalties	Last verified
California Verify with counsel Open items: universal_opt_out.effective_date; upcoming_changes (other 2026 bills awaiting the Governor's action by 2026-09-30 not checked; only SB 923 signed and AB 1542 vetoed were confirmed) Fintech note The GLBA exemption covers data, not the institution, so a fintech's non-GLBA data (website and marketing tracking, B2B contacts, employee and applicant data) stays in scope. Automated decision-making rules generally reach decisions only to the extent they use non-GLBA personal information — confirm with counsel. Changes coming 2027-01-01: SB 923 (deletion reaches data from third parties; webform for online-only businesses), browser opt-out setting (AB 566), ADMT compliance. 2027-12-31: risk assessments for existing processing. 2028-04-01: first risk-assessment submissions and cybersecurity audits (phased to 2030)	California Consumer Privacy Act, as amended by the CPRA (CCPA/CPRA) Cal. Civ. Code §§ 1798.100–1798.199.100; regulations at Cal. Code Regs. tit. 11, § 7000 et seq.	2020-01-01	$26.6M revenue; OR buy/sell/share data of 100,000 consumers or households; OR 50%+ of revenue from selling or sharing data Statute summary For-profit entity doing business in California that meets any one of these tests: (A) annual gross revenue over $25,000,000 in the preceding calendar year, CPI-adjusted to $26,625,000 effective 2025-01-01; (B) alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households (this is a buying/selling/sharing test, not a processing test); or (C) derives 50% or more of annual revenue from selling or sharing consumers' personal information. Commonly branded controlled/controlling entities and qualifying joint ventures are also covered (§ 1798.140(d)).	Data-level only Data only: only data subject to GLBA is exempt; the rest of a fintech's data is covered Statute text § 1798.145(e): "This title shall not apply to personal information collected, processed, sold, or disclosed subject to the federal Gramm-Leach-Bliley Act (Public Law 106-102), and implementing regulations, or the California Financial Information Privacy Act (Division 1.4 (commencing with Section 4050) of the Financial Code), or the federal Farm Credit Act of 1971 ... This subdivision shall not apply to Section 1798.150." There is no entity-level exemption, and the data breach private right of action still applies to GLBA data.	Not stated in the dataset	California Privacy Protection Agency (administrative enforcement) and California Attorney General (civil actions)	None for regulator enforcement Detail none for CPPA/AG enforcement (no statutory cure in §§ 1798.155 or 1798.199.90). A 30-day notice-and-cure applies only before statutory-damages claims under the data breach private right of action (§ 1798.150(b)).	Limited to data breaches Detail Limited to data breaches: a consumer whose nonencrypted, nonredacted personal information is subject to unauthorized access and exfiltration, theft or disclosure because the business failed to maintain reasonable security may recover $100–$750 per consumer per incident (CPI-adjusted to $107–$799 effective 2025-01-01) or actual damages, whichever is greater (§ 1798.150).	$2,663 per violation; $7,988 intentional or involving minors (CPI-adjusted 2025) Detail Up to $2,500 per violation or $7,500 per intentional violation or violation involving minors (§ 1798.155(a) administrative fines; § 1798.199.90(a) civil penalties). CPI-adjusted effective 2025-01-01 to $2,663 and $7,988.	2026-09-30
Virginia Fintech note GLBA-covered financial institutions are exempt as entities, but non-bank fintechs that aren't GLBA 'financial institutions' are covered, and the 2026 amendment bans selling precise geolocation data outright. Changes coming None listed	Virginia Consumer Data Protection Act (VCDPA) Va. Code Ann. §§ 59.1-575 to 59.1-584	2023-01-01	100,000 consumers; OR 25,000 + more than 50% of revenue from selling data Statute summary Persons that do business in Virginia or target products/services to Virginia residents and, during a calendar year, either (i) control or process personal data of at least 100,000 consumers, or (ii) control or process personal data of at least 25,000 consumers and derive over 50% of gross revenue from the sale of personal data. There is no revenue-only trigger. Consumer data processed in an employment or B2B context is excluded.	Entity-level Entity: GLBA financial institutions exempt, plus GLBA data Statute text § 59.1-576(B): "This chapter shall not apply to any ... (ii) financial institution or data subject to Title V of the federal Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.)". This is an entity exemption plus a data exemption.	Not stated in the dataset	Virginia Attorney General (exclusive authority)	30 days, mandatory Detail 30 days, mandatory (AG must give 30 days' written notice; no action if cured with an express written statement) (§ 59.1-584(B))	None (§ 59.1-584(E))	$7,500 per violation Detail Civil penalties up to $7,500 per violation, plus injunction and recovery of reasonable investigative expenses and attorney fees (§ 59.1-584(C)–(D))	2026-09-30
Colorado Fintech note Colorado exempts GLBA financial institutions and their affiliates as entities, which is broader than most states. A fintech that is not a GLBA financial institution is fully covered, including biometric duties (such as KYC selfie or face match) with no volume threshold. Changes coming 2026-12-31: cure for minors' provisions ends	Colorado Privacy Act (CPA) Colo. Rev. Stat. §§ 6-1-1301 to 6-1-1314; rules at 4 CCR 904-3	2023-07-01	100,000 consumers; OR 25,000 + any revenue or discount from selling data. Biometric data covered at any volume Statute summary Controllers that do business in Colorado or intentionally target Colorado residents and either (1) control or process personal data of 100,000+ consumers in a calendar year, or (2) derive revenue or receive a discount on goods/services from the sale of personal data and process or control personal data of 25,000+ consumers. There is no revenue threshold. Since 2025-07-01 (HB 24-1130), a controller that processes any amount of biometric identifiers or biometric data is covered for its biometric data even below these thresholds. Since 2025-10-01 (SB 24-041), the minors' duty-of-care, heightened-risk assessment and related provisions (§§ 6-1-1305.5, 6-1-1308.5, 6-1-1309.5) apply to any controller doing business in or targeting Colorado, regardless of volume.	Entity-level Entity: GLBA financial institutions exempt, plus GLBA data Statute text § 6-1-1304(2)(q): part 13 does not apply to "A financial institution or an affiliate of a financial institution as defined by and that is subject to the federal 'Gramm-Leach-Bliley Act', 15 U.S.C. sec. 6801 et seq., as amended, and implementing regulations, including Regulation P, 12 CFR 1016." Also a data-level exemption in § 6-1-1304(2)(j)(II) for personal data "Collected, processed, sold, or disclosed pursuant to the federal 'Gramm-Leach-Bliley Act' ... if the collection, processing, sale, or disclosure is in compliance with that law". Neither was changed through the 2026 session (CRS 2026).	Not stated in the dataset	Colorado Attorney General and district attorneys (exclusive). A CPA violation is a deceptive trade practice under the Colorado Consumer Protection Act.	Expired 2025-01-01 (minors' provisions: 60 days until 2026-12-31) Detail expired 2025-01-01 for general CPA violations (§ 6-1-1311(1)(d)(I) repealed). A 60-day notice-and-cure still applies to the minors' provisions until it is repealed on 2026-12-31 (§ 6-1-1311(1)(d)(II)).	None (§§ 6-1-1310(1), 6-1-1311(1)(b))	$20,000 per violation Detail Up to $20,000 per violation, with each consumer or transaction a separate violation; up to $50,000 per violation against an elderly person (C.R.S. § 6-1-112(1)(a), (c), applied through § 6-1-1311(1)(c))	2026-09-30
Utah Fintech note Utah exempts GLBA financial institutions and their affiliates as entities, and its dual revenue-plus-volume test keeps most small fintechs out. Covered firms must now honor correction requests (since 2026-07-01) but face no assessment or appeal duties. Changes coming 2027-01-01: vehicle manufacturers covered (HB 357)	Utah Consumer Privacy Act (UCPA) Utah Code Ann. §§ 13-61-101 to 13-61-404 (Part 5 §§ 13-61-501 to -504 added eff. 2027-01-01)	2023-12-31	$25M revenue AND (100,000 consumers, OR 25,000 + more than 50% of revenue from selling data) Statute summary Controllers or processors that do business in Utah or target Utah residents, AND have annual revenue of $25,000,000 or more, AND either (a) control or process personal data of 100,000+ consumers in a calendar year, or (b) derive over 50% of gross revenue from the sale of personal data and control or process personal data of 25,000+ consumers (§ 13-61-102(1)). Revenue alone does not trigger coverage.	Entity-level Entity: GLBA financial institutions exempt, plus GLBA data Statute text § 13-61-102(2): chapter does not apply to "a financial institution or an affiliate of a financial institution governed by, or personal data collected, processed, sold, or disclosed in accordance with, Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. Sec. 6801 et seq., and related regulations". This is an entity exemption plus a data exemption, unchanged by the 2026 H.B. 357 amendments.	Not stated in the dataset	Utah Attorney General (exclusive), on referral from the Division of Consumer Protection, which receives and investigates complaints (§§ 13-61-401, -402)	30 days, mandatory Detail 30 days, mandatory (AG must give written notice; no action if cured within 30 days with an express written statement) (§ 13-61-402(3))	None (§ 13-61-305)	Actual damages + up to $7,500 per violation Detail Actual damages to consumers plus up to $7,500 per violation (§ 13-61-402(3)(d))	2026-09-30
Iowa Verify with counsel Open items: upcoming_changes (the Iowa Code 2026 PDF, generated 2025-12-09, reflects Acts through 2025; no primary-source check was made for 2026-session amendments to ch. 715D) Fintech note Iowa exempts financial institutions and their affiliates as entities. For covered non-GLBA businesses it is lenient: a 90-day response window, a 90-day cure and no data protection assessments. Changes coming None found in the sources checked (2026 session not fully reviewed)	Iowa Consumer Data Protection Act (ICDPA) Iowa Code ch. 715D (§§ 715D.1–715D.9)	2025-01-01	100,000 consumers; OR 25,000 + more than 50% of revenue from selling data Statute summary Persons doing business in Iowa or targeting Iowa residents that, during a calendar year, either (a) control or process personal data of at least 100,000 consumers, or (b) control or process personal data of at least 25,000 consumers and derive over 50% of gross revenue from the sale of personal data (§ 715D.2(1)). There is no revenue-only trigger.	Entity-level Entity: GLBA financial institutions exempt, plus GLBA data Statute text § 715D.2(2): "This chapter shall not apply to ... financial institutions, affiliates of financial institutions, or data subject to Tit. V of the federal Gramm-Leach-Bliley Act of 1999, 15 U.S.C. §6801 et seq." This is an entity exemption (including affiliates) plus a data exemption.	Not stated in the dataset	Iowa Attorney General (exclusive; may issue civil investigative demands)	90 days, mandatory Detail 90 days, mandatory (AG must give 90 days' written notice; no action if cured with an express written statement) (§ 715D.8(2))	None (§ 715D.8(4))	$7,500 per violation Detail Civil penalties up to $7,500 per violation, plus injunction (§ 715D.8(3))	2026-09-30
Connecticut Fintech note As of July 1, 2026 non-bank fintechs lose CT's entity-level GLBA exemption, and processing any sensitive data (which now includes financial account credentials and SSNs) triggers coverage with no volume minimum. Changes coming 2026-10-01: sale of precise geolocation banned (PA 26-64). 2027-01-01: data broker rules	Connecticut Data Privacy Act (CTDPA) Conn. Gen. Stat. §§ 42-515 to 42-526 (as amended by PA 25-113 (SB 1295) and PA 26-64 (SB 4))	2023-07-01	Since 2026-07-01: 35,000 consumers; OR any sensitive data; OR offering any personal data for sale Statute summary Since July 1, 2026 (PA 25-113 § 6), applies to persons that (1) conduct business in CT or target CT residents and in the preceding calendar year controlled or processed personal data of at least 35,000 consumers (excluding data processed solely to complete a payment transaction); OR (2) control or process consumers' sensitive data (same payment-transaction exclusion), with no volume minimum; OR (3) offer consumers' personal data for sale in trade or commerce, with no volume minimum. The former 100,000 / 25,000 + 25% revenue tests were repealed.	Banks only (entity) + data Banks only (entity) + data: banks and similar institutions exempt; other fintechs exempt only for GLBA data Statute text Effective July 1, 2026, PA 25-113 § 7 deleted the entity exemption for '[financial institution or data subject to Title V of the Gramm-Leach-Bliley Act, 15 USC 6801 et seq.]' from § 42-517(a) and added data-level § 42-517(b)(17): 'data subject to Title V of the Gramm-Leach-Bliley Act, 15 USC 6801 et seq.' A narrower entity exemption remains at § 42-517(a)(11): 'bank, Connecticut credit union, federal credit union, out-of-state bank or out-of-state credit union, or any affiliate or subsidiary thereof, as such terms are defined in section 36a-2, that (A) is only and directly engaged in financial activities as described in 12 USC 1843(k), (B) is regulated and examined by the Department of Banking or an applicable federal bank regulatory agency, and (C) has established a program to comply with all applicable requirements established by the Banking Commissioner or the applicable federal bank regulatory agency concerning personal data'. Also entity-exempt: insurers and affiliates, insurance-support organizations, and insurance producers (§ 42-517(a)(10)), and agents, broker-dealers, investment advisers and investment adviser agents regulated by the Department of Banking or SEC (§ 42-517(a)(12)). Non-bank fintechs (lenders, money transmitters, BNPL) now only get the data-level GLBA exemption.	Not stated in the dataset	Connecticut Attorney General (exclusive)	Discretionary (mandatory cure ended 2024-12-31) Detail none mandatory; the 60-day mandatory cure period expired 2024-12-31; since 2025-01-01 the AG may, at its discretion, grant an opportunity to cure (§ 42-525(c))	None (§ 42-525(d)); violations are CUTPA unfair trade practices enforced solely by the AG, and the CUTPA private action in § 42-110g does not apply (§ 42-525(e)) Detail None (§ 42-525(d)); violations are CUTPA unfair trade practices enforced solely by the AG, and the CUTPA private action in § 42-110g does not apply (§ 42-525(e)).	$5,000 per willful violation (CUTPA) Detail Violations are CUTPA violations (§ 42-525(e)); civil penalty up to $5,000 per willful violation (§ 42-110o(b)) and up to $25,000 per violation of a restraining order or injunction (§ 42-110o(a)), plus injunctive relief and restitution under CUTPA.	2026-09-30
Indiana Fintech note Indiana keeps a full entity-level exemption for financial institutions and their affiliates, so GLBA-covered fintechs are outside the law entirely, while non-FI fintech data still needs GLBA or FCRA data exemptions. Changes coming None listed	Indiana Consumer Data Protection Act (ICDPA) Ind. Code art. 24-15 (IC 24-15-1-1 et seq.), enacted by P.L. 94-2023 (SEA 5), amended by P.L. 236-2025	2026-01-01	100,000 consumers; OR 25,000 + more than 50% of revenue from selling data Statute summary Applies to persons that conduct business in Indiana or produce products or services targeted to Indiana residents and that during a calendar year (1) control or process personal data of at least 100,000 Indiana consumers; or (2) control or process personal data of at least 25,000 Indiana consumers and derive more than 50% of gross revenue from the sale of personal data (IC 24-15-1-1(a)). No revenue-only test.	Entity-level Entity: GLBA financial institutions exempt, plus GLBA data Statute text IC 24-15-1-1(b)(2): 'Any financial institutions and affiliates, or data subject to Title V of the federal Gramm-Leach-Bliley Act (15 U.S.C. 6801 et seq.).' Entity-level exemption covering financial institutions and their affiliates, plus data-level GLBA exemption. 'Financial institution' is not separately defined in the article. FCRA-regulated activity also exempt (IC 24-15-1-2(9)).	Not stated in the dataset	Indiana Attorney General (exclusive, IC 24-15-10-1)	30 days, mandatory Detail 30 days, mandatory, no sunset (IC 24-15-10-3)	None (IC 24-15-10-4)	$7,500 per violation Detail Up to $7,500 per violation plus injunction and reasonable investigative expenses and attorney's fees (IC 24-15-10-2)	2026-09-30
Tennessee Verify with counsel Open items: citation; upcoming_changes Fintech note Affirmative defense for controllers or processors that keep a written privacy program reasonably conforming to the NIST Privacy Framework; the $25M revenue gate plus the entity-level financial institution exemption keeps most small fintechs and GLBA FIs out. Changes coming None found in the sources checked (2025–2026 sessions not fully reviewed)	Tennessee Information Protection Act (TIPA) 2023 Tenn. Pub. Ch. 408 (HB 1181), codified in Tenn. Code Ann. Title 47, Chapter 18	2025-07-01	$25M revenue AND (175,000 consumers, OR 25,000 + more than 50% of revenue from selling data) Statute summary Applies to persons that conduct business in Tennessee producing products or services that target Tennessee residents and that (1) exceed $25,000,000 in revenue AND (2) either (A) control or process personal information of at least 25,000 consumers and derive more than 50% of gross revenue from the sale of personal information, or (B) during a calendar year control or process personal information of at least 175,000 consumers.	Entity-level Entity: GLBA financial institutions exempt, plus GLBA data Statute text Pub. Ch. 408 § 2, § 47-18-3210(a)(2) (as enacted; codified in part 33): 'A financial institution, an affiliate of a financial institution, or data subject to Title V of the federal Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.)'. Also exempt: licensed insurance companies and insurance producers (title 56), and FCRA-regulated activity.	Not stated in the dataset	Tennessee Attorney General and Reporter (exclusive)	60 days, mandatory Detail 60 days, mandatory, no sunset (AG must give 60 days' written notice; no action if cured with a written statement)	None, including class actions	$7,500 per violation; treble damages if willful Detail Up to $7,500 per violation; court may award treble damages for willful or knowing violations; plus declaratory/injunctive relief, attorney's fees and investigative costs (act § 47-18-3212(c)-(f))	2026-09-30
Montana Fintech note After SB 297, Montana's 25,000-consumer threshold and lack of any cure period make it one of the easier state laws for mid-size non-bank fintechs to trigger, since only chartered banks and credit unions keep an entity exemption. Changes coming None listed	Montana Consumer Data Privacy Act (MCDPA) Mont. Code Ann. §§ 30-14-2801 to 30-14-2820 (Ch. 681, L. 2023; amended by Ch. 567, L. 2025 (SB 297))	2024-10-01	25,000 consumers; OR 15,000 + more than 25% of revenue from selling data (since 2025-10-01) Statute summary Since October 1, 2025 (SB 297), applies to persons that conduct business in Montana or produce products or services targeted to Montana residents and (a) control or process personal data of at least 25,000 consumers (excluding data processed solely to complete a payment transaction); or (b) control or process personal data of at least 15,000 consumers and derive more than 25% of gross revenue from the sale of personal data (§ 30-14-2803(1)). The minors duty-of-care provisions (§§ 30-14-2811, -2818, -2819) apply to any person doing business in or intentionally targeting Montana, with no threshold (§ 30-14-2803(2)).	Banks only (entity) + data Banks only (entity) + data: banks and similar institutions exempt; other fintechs exempt only for GLBA data Statute text § 30-14-2804(1)(e): 'state or federally chartered bank or credit union or an affiliate or subsidiary that is principally engaged in financial activities as described in 12 U.S.C. 1843(k)'; § 30-14-2804(1)(f): 'personal data collected, processed, sold, or disclosed in accordance with, Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. 6801, et seq.' (text as amended by SB 297, Ch. 567, L. 2025). Insurers, insurance producers and third-party administrators (and affiliates principally engaged in financial activities) are also entity-exempt (§ 30-14-2804(1)(h)). Non-bank fintechs get data-level GLBA coverage only.	Not stated in the dataset	Montana Attorney General (exclusive, with Montana Unfair Trade Practices and Consumer Protection Act powers, § 30-14-2817(1))	None (removed 2025-10-01) Detail none; SB 297 (effective 2025-10-01) struck the 60-day notice-and-cure requirement from § 30-14-2817 and repealed its sunset provision (Sec. 15, Ch. 681, L. 2023). Note: § 30-14-2820(2) still refers to 'the 30-day period described in 30-14-2817(3)', but § 2817(3) now covers civil investigative demands only.	None (§ 30-14-2817(5))	$7,500 per violation Detail Up to $7,500 per violation plus injunction, attorney fees and expenses (§ 30-14-2820, added by SB 297); a violation is also a violation of Title 30, ch. 14, parts 1 and 2	2026-09-30
Texas Fintech note Texas has no volume threshold, so any non-SBA-small fintech that is not a GLBA financial institution is covered from its first Texas customer; since 2026-01-01 processors must also help with security of personal data handled by AI systems (HB 149). Changes coming None listed	Texas Data Privacy and Security Act (TDPSA) Tex. Bus. & Com. Code ch. 541 (§§ 541.001-541.205) (Acts 2023, 88th Leg., ch. 995 (HB 4); § 541.104 amended by Acts 2025, 89th Leg., ch. 1174 (HB 149))	2024-07-01	No volume test: anyone doing business in Texas that processes or sells personal data, unless an SBA small business Statute summary No revenue or consumer-count threshold. Applies to any person that (1) conducts business in Texas or produces a product or service consumed by Texas residents; (2) processes or sells personal data; and (3) is not a small business as defined by the U.S. Small Business Administration (§ 541.002(a)). Small businesses remain subject to § 541.107: they may not sell sensitive data without prior consumer consent.	Entity-level Entity: GLBA financial institutions exempt, plus GLBA data Statute text § 541.002(b)(2): 'a financial institution or data subject to Title V, Gramm-Leach-Bliley Act (15 U.S.C. Section 6801 et seq.)'. Entity-level for financial institutions (no express affiliate language) plus data-level. FCRA-regulated activity also exempt (§ 541.003(11)).	Not stated in the dataset	Texas Attorney General (exclusive, § 541.151)	30 days, mandatory Detail 30 days, mandatory, no sunset. The cure statement must include notifying the consumer, supporting documentation, and policy changes (§ 541.154).	None (§ 541.156)	$7,500 per violation Detail Up to $7,500 per violation plus injunction, attorney's fees and investigative expenses (§ 541.155)	2026-09-30
Oregon Fintech note Entity exemption covers only ORS 706.008 financial institutions (banks, credit unions, trust companies), so non-bank fintechs are in scope for non-GLBA data, and payment-transaction-only data does not count toward the 100,000 threshold. Changes coming None listed	Oregon Consumer Privacy Act (OCPA) ORS 646A.570 to 646A.589 (Or. Laws 2023, ch. 369, as amended by Or. Laws 2024 ch. 64; 2025 chs. 163, 251, 417)	2024-07-01	100,000 consumers; OR 25,000 + 25% or more of revenue from selling data Statute summary Applies to a person that conducts business in Oregon or provides products or services to Oregon residents and, during a calendar year, controls or processes personal data of (A) 100,000+ consumers, not counting personal data controlled or processed solely to complete a payment transaction, or (B) 25,000+ consumers while deriving 25% or more of annual gross revenue from selling personal data. Since 2025-09-26 (Or. Laws 2025 ch. 163), motor vehicle manufacturers and affiliates are covered regardless of volume for vehicle-derived data. No 2026-session amendments to ORS 646A.570-646A.589 (2026 A&R table lists none).	Banks only (entity) + data Banks only (entity) + data: banks and similar institutions exempt; other fintechs exempt only for GLBA data Statute text ORS 646A.572(2)(k)(A): exempts "Information collected, processed, sold or disclosed under and in accordance with ... The Gramm-Leach-Bliley Act, P.L. 106-102, and regulations adopted to implement that Act" (data-level). ORS 646A.572(2)(L): entity exemption only for "A financial institution, as defined in ORS 706.008, or a financial institution's affiliate or subsidiary that is only and directly engaged in financial activities, as described in 12 U.S.C. 1843(k)" (ORS 706.008 = banks, trust companies, savings banks, credit unions, etc.). ORS 646A.572(2)(m) also exempts GLBA-intermingled information that a consumer finance licensee under ORS 725.010 maintains as GLBA requires. Insurers, producers and TPAs exempt as entities (646A.572(2)(n)-(q)). Non-bank fintechs are therefore covered except for GLBA data.	Not stated in the dataset	Oregon Attorney General (exclusive authority, ORS 646A.589(7))	Expired 2026-01-01 Detail expired 2026-01-01 (30-day mandatory cure ended 2025-12-31 for most controllers; Or. Laws 2025 ch. 417 sec. 5 kept a cure only for certain noncommercial educational broadcast stations and was itself repealed 2026-07-01). No cure right as of 2026-09-29.	None; ORS 646A.589(7) states the chapter does not create a private right of action.	$7,500 per violation Detail Civil penalty up to $7,500 per violation, plus injunction, attorney fees, expert fees and investigation costs (ORS 646A.589(4)); 5-year limitations period (646A.589(5)).	2026-09-30
Delaware Fintech note Today any GLBA-covered financial institution (including non-bank fintechs subject to GLBA Title V) is exempt as an entity, but from 2027-01-01 only banks, credit unions, savings associations, insurers and regulated broker-dealers/advisers keep entity exemptions, and the threshold falls to 10,000 consumers. Changes coming 2027-01-01: thresholds 10,000 / 5,000; GLBA entity exemption narrowed to banks and other listed institutions; assessment and profiling rules expand	Delaware Personal Data Privacy Act (DPDPA) 6 Del. C. ch. 12D, §§ 12D-101 to 12D-111 (84 Del. Laws c. 197, as amended by 85 Del. Laws c. 463 (HB 380, signed 2026-09-02, operative 2027-01-01))	2025-01-01	35,000 consumers; OR 10,000 + more than 20% of revenue from selling data (drops to 10,000 / 5,000 on 2027-01-01) Statute summary Through 2026-12-31: applies to persons conducting business in Delaware or producing products/services targeted to Delaware residents that during the preceding calendar year controlled or processed personal data of (1) 35,000+ consumers, excluding data controlled or processed solely to complete a payment transaction, or (2) 10,000+ consumers and derived more than 20% of gross revenue from the sale of personal data. Nonprofits are not exempt (except insurance-crime nonprofits). From 2027-01-01 thresholds become 10,000 / 5,000 + >20% revenue, plus third parties acquiring data from controllers.	Entity-level Entity: GLBA financial institutions exempt, plus GLBA data Statute text Current § 12D-103(b)(2) (effective until 2027-01-01): chapter does not apply to "Any financial institution or affiliate of a financial institution, all as defined in 15 U.S.C. § 6809, to the extent that the financial institution or affiliate is subject to Title V of the Gramm Leach Bliley Act"; § 12D-103(c)(14) also exempts "Data subject to Title V of the Gramm Leach Bliley Act". From 2027-01-01 (85 Del. Laws c. 463) the entity exemption is limited to "Any federal or state-chartered bank, credit union, savings association, or any affiliate or subsidiary thereof that is principally engaged in financial activities as described in 12 U.S.C. § 1843(k)" (§ 12D-103(b)(5)), insurers (b)(2) and regulated broker-dealers/investment advisers (b)(6); the (c)(14) GLBA data exemption remains, so the 2027 status becomes 'banks-only-entity + data'.	Nonprofits are not exempt (except insurance-crime nonprofits).	Delaware Department of Justice (Attorney General), exclusively (§ 12D-111(a),(e))	Discretionary since 2026-01-01 Detail discretionary (60-day mandatory cure ran 2025-01-01 to 2025-12-31; since 2026-01-01 DOJ may grant an opportunity to cure considering listed factors, § 12D-111(b)-(c))	None (§ 12D-111(d)).	$10,000 per willful violation Detail Violation is an unlawful practice under 6 Del. C. § 2513 (Consumer Fraud Act); civil penalty up to $10,000 per wilful violation under 6 Del. C. § 2522(b), plus injunction/restitution.	2026-09-30
New Hampshire Fintech note Broad entity exemption for any 'financial institution ... subject to Title V of GLBA' means GLBA-covered fintechs are fully out of scope, but non-GLBA affiliates are covered at the low 35,000-consumer threshold. Changes coming 2027-01-01: ban on selling data of known children under 13	New Hampshire Privacy Act (Expectation of Privacy) (NHPA) N.H. RSA ch. 507-H (2024 N.H. Laws ch. 5 (SB 255), as amended by 2024 ch. 229 and 2026 ch. 168 (HB 1460))	2025-01-01	35,000 consumers; OR 10,000 + more than 25% of revenue from selling data Statute summary Applies to persons conducting business in New Hampshire or producing products or services targeted to NH residents that during a one-year period controlled or processed personal data of (a) 35,000+ unique consumers, excluding data controlled or processed solely to complete a payment transaction, or (b) 10,000+ unique consumers and derived more than 25% of gross revenue from the sale of personal data. Nonprofits, higher-ed institutions, HIPAA covered entities/business associates and GLBA financial institutions are exempt as entities.	Entity-level Entity: GLBA financial institutions exempt, plus GLBA data Statute text RSA 507-H:3, I(e): chapter shall not apply to any "Financial institution or data subject to Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. 6801 et seq."	Nonprofits, higher-ed institutions, HIPAA covered entities/business associates and GLBA financial institutions are exempt as entities.	New Hampshire Attorney General (exclusive authority, RSA 507-H:11, I)	Discretionary since 2026-01-01 Detail discretionary (60-day mandatory cure 2025-01-01 to 2025-12-31; after that the AG 'may' issue a notice of violation and allow 60 days to cure, considering listed factors, RSA 507-H:11, II-III)	None (RSA 507-H:11, IV).	$10,000 per violation Detail Violation is an unfair or deceptive act under RSA 358-A:2; court may award civil penalties up to $10,000 per violation under RSA 358-A:4, III(b), plus injunction and restitution.	2026-09-30
New Jersey Verify with counsel Open items: max_penalty Fintech note Any sale of personal data (or receiving a discount for it) plus 25,000 consumers triggers coverage, and non-GLBA fintechs must treat financial account credentials as sensitive data that can no longer be sold at all ($50,000 per record). Changes coming 2027-03-27: public data broker and data collector registry	New Jersey Data Privacy Act (NJDPA) N.J.S.A. 56:8-166.4 to 56:8-166.19 (P.L.2023, c.266), as amended/supplemented by P.L.2026, c.25 (A5328, approved 2026-06-30; N.J.S.A. 56:8-166.20 to 56:8-166.24)	2025-01-15	100,000 consumers; OR 25,000 + any revenue or discount from selling data Statute summary Applies to controllers conducting business in New Jersey or producing products/services targeted to NJ residents that during a calendar year (a) control or process personal data of 100,000+ consumers, excluding data processed solely to complete a payment transaction, or (b) control or process personal data of 25,000+ consumers and derive revenue, or receive a discount on goods or services, from the sale of personal data (any amount). Separately, since 2026-06-30 (P.L.2026, c.25) the ban on selling sensitive data (N.J.S.A. 56:8-166.12(a)(6)) applies to all individuals/entities regardless of consumer count. Nonprofits not exempt.	Entity-level Entity: GLBA financial institutions exempt, plus GLBA data Statute text N.J.S.A. 56:8-166.13(b) (P.L.2023, c.266, sec. 10): nothing in the act shall apply to "a financial institution, data, or an affiliate of a financial institution that is subject to Title V of the federal Gramm-Leach-Bliley Act, 15 U.S.C. s.6801 et seq., and the rules and implementing regulations promulgated thereunder"; sec. 10(c) also exempts GLBA secondary market institutions (15 U.S.C. 6809(3)(D)) and (d) insurance institutions subject to P.L.1985, c.179. P.L.2026, c.25 repeats the same GLBA exemption for its data broker and sensitive-data-sale provisions (56:8-166.20(g)(2), 56:8-166.22(b)(2)).	Nonprofits not exempt.	New Jersey Attorney General (sole and exclusive authority, 56:8-166.19) via Division of Consumer Affairs; violations are unlawful practices under the Consumer Fraud Act (56:8-166.17(a))	Expired 2026-07-01 Detail expired 2026-07-01 (mandatory 30-day cure applied only until the first day of the 18th month after the 2025-01-15 effective date, N.J.S.A. 56:8-166.17(b)); none as of 2026-09-29	None (N.J.S.A. 56:8-166.19).	Consumer Fraud Act civil penalties (N.J.S.A. 56:8-13); $50,000 per record for selling sensitive data (2026) Detail Consumer Fraud Act penalties (N.J.S.A. 56:8-13): up to $10,000 for first offense and $20,000 for second and subsequent offenses; plus $50,000 per record for selling/offering/licensing sensitive data (N.J.S.A. 56:8-166.23, P.L.2026, c.25 sec. 5) and $2,500/day for data broker/collector registration failures (56:8-166.21).	2026-09-30
Nebraska Fintech note No volume threshold means even small-footprint fintechs that are not SBA small businesses are covered, while GLBA financial institutions and their affiliates are exempt as entities. Changes coming None listed	Nebraska Data Privacy Act (NDPA) Neb. Rev. Stat. §§ 87-1101 to 87-1130 (Laws 2024, LB1074, §§ 1-30)	2025-01-01	No volume test: anyone doing business in Nebraska that processes or sells personal data, unless an SBA small business Statute summary No revenue or consumer-volume threshold (Texas-style). Applies to any person that (a) conducts business in Nebraska or produces a product or service consumed by Nebraska residents, (b) processes or engages in the sale of personal data, and (c) is not a small business as determined under the federal Small Business Act (as it existed Jan. 1, 2024). SBA small businesses are still barred from selling sensitive data without prior consumer consent (§ 87-1118). § 87-1103(1).	Entity-level Entity: GLBA financial institutions exempt, plus GLBA data Statute text § 87-1103(2)(b): the Act does not apply to any "Financial institution, affiliate of a financial institution, or data subject to Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. 6801 et seq., as such title existed on January 1, 2024". "Financial institution" is not defined in § 87-1102.	Not stated in the dataset	Nebraska Attorney General (exclusive authority, § 87-1119).	30 days, mandatory Detail 30 days, mandatory, no sunset: AG must give written notice at least 30 days before suing and may not sue if the violation is cured and a written cure statement plus no-repeat statement is provided (§ 87-1122).	None (§ 87-1125).	$7,500 per violation Detail Civil penalty up to $7,500 per violation (after the cure period or breach of a written cure statement), plus injunctive relief and reasonable attorney's fees and investigative expenses (§ 87-1124).	2026-09-30
Maryland Verify with counsel Open items: universal_opt_out Fintech note Strictest data-minimization law in the US: collection limited to what is reasonably necessary and proportionate for the requested service, sensitive data can never be sold, and 2026 amendments bar knowingly selling personal data to government units engaged in civil immigration enforcement. Changes coming 2027-04-01: cure provision ends	Maryland Online Data Privacy Act of 2024 (MODPA) Md. Code Ann., Com. Law §§ 14-4701 to 14-4714 (codified as Subtitle 47; enacted as §§ 14-4601 to 14-4614 by 2024 Md. Laws ch. 455 (SB 541) / ch. 454 (HB 567)); amended by 2026 Md. Laws ch. 874 (HB 711)	2025-10-01	35,000 consumers; OR 10,000 + more than 20% of revenue from selling data Statute summary Persons that conduct business in Maryland or provide products or services targeted to Maryland residents and, during the preceding calendar year, (1) controlled or processed personal data of at least 35,000 consumers (excluding data processed solely to complete a payment transaction), or (2) controlled or processed personal data of at least 10,000 consumers and derived more than 20% of gross revenue from the sale of personal data (§ 14-4702). The Act took effect Oct. 1, 2025 but, per uncodified § 2 of ch. 455, does not apply to personal data processing activities before April 1, 2026.	Entity-level Entity: GLBA financial institutions exempt, plus GLBA data Statute text § 14-4703(a)(3): the subtitle does not apply to "A financial institution, an affiliate of a financial institution, or data that is subject to Title V of the federal Gramm–Leach–Bliley Act and regulations adopted under that act".	Not stated in the dataset	Office of the Attorney General, Consumer Protection Division (violations are unfair, abusive, or deceptive trade practices under Com. Law Title 13).	Discretionary 60 days, for violations through 2027-04-01 Detail 60 days, discretionary: for violations occurring on or before 2027-04-01, the Consumer Protection Division may issue a notice of violation if it determines a cure is possible, giving at least 60 days to cure (§ 14-4714). Expires for violations after 2027-04-01.	None under MODPA Detail None under MODPA: violations are enforced under the Maryland Consumer Protection Act 'except for § 13-408' (the MCPA private action) (§ 14-4713(a)(2)); § 14-4713(b) preserves any other remedy provided by law.	$10,000 per violation; $25,000 for repeat violations Detail Via Com. Law § 13-410: civil penalty up to $10,000 per violation; up to $25,000 per subsequent repeat violation (§ 14-4713 incorporating Title 13 enforcement/penalties).	2026-09-30
Minnesota Fintech note Nonbank fintechs get only a data-level GLBA exemption (entity exemption is limited to banks, credit unions and their financial-activity affiliates), and consumers can challenge profiling-based credit or lending decisions and demand the specific third parties that received their data. Changes coming 2029-07-31: postsecondary institutions covered	Minnesota Consumer Data Privacy Act (MCDPA) Minn. Stat. §§ 325M.10 to 325M.21 (Laws 2024, ch. 121, art. 5)	2025-07-31	100,000 consumers; OR 25,000 + more than 25% of revenue from selling data; SBA small businesses excluded Statute summary Legal entities that conduct business in Minnesota or produce products or services targeted to Minnesota residents and that (1) during a calendar year control or process personal data of 100,000+ consumers (excluding data processed solely to complete a payment transaction), or (2) derive over 25% of gross revenue from the sale of personal data and process or control personal data of 25,000+ consumers (§ 325M.12, subd. 1). SBA-defined small businesses are excluded but may not sell sensitive data without prior consent (§§ 325M.12, subd. 2(a)(19); 325M.17).	Banks only (entity) + data Banks only (entity) + data: banks and similar institutions exempt; other fintechs exempt only for GLBA data Statute text § 325M.12, subd. 2(a)(9) exempts "personal data collected, processed, sold, or disclosed pursuant to the federal Gramm-Leach-Bliley Act, Public Law 106-102, and implementing regulations, if the collection, processing, sale, or disclosure is in compliance with that law"; entity-level exemption only for "(16) a state or federally chartered bank or credit union, or an affiliate or subsidiary that is principally engaged in financial activities, as described in United States Code, title 12, section 1843(k)" and (18) insurance companies/producers. Subd. 2(a)(6)(iv)-(v) also exempts information intermingled with GLBA data held by licensed residential mortgage originators/servicers and nonbank financial institutions (§ 46A.01) handled in the same manner as GLBA requires.	Not stated in the dataset	Minnesota Attorney General (§ 325M.20; civil action under § 8.31).	Expired 2026-01-31 Detail Expired 2026-01-31: the mandatory 30-day AG warning letter/cure opportunity in § 325M.20(a) expired January 31, 2026; the AG may now sue without prior notice.	None, including under the private AG statute § 8.31, subd. 3a (§ 325M.20(d)).	$7,500 per violation Detail Injunction and civil penalty up to $7,500 per violation, plus reasonable value of the state's litigation expenses (§ 325M.20(b)-(c)).	2026-09-30
Kentucky Fintech note Virginia-style law with a permanent 30-day cure and no universal opt-out; GLBA financial institutions and affiliates are exempt at the entity level. Changes coming 2027-07-01: consent needed for smart-TV viewing data	Kentucky Consumer Data Protection Act (KCDPA) KRS 367.3611 to 367.3629 (2024 Ky. Acts ch. 72 (HB 15); amended 2025 Ky. Acts ch. 13 (HB 473) and 2026 Ky. Acts ch. 118 (HB 692))	2026-01-01	100,000 consumers; OR 25,000 + more than 50% of revenue from selling data Statute summary Persons that conduct business in Kentucky or produce products or services targeted to Kentucky residents and that during a calendar year control or process personal data of at least (a) 100,000 consumers, or (b) 25,000 consumers and derive over 50% of gross revenue from the sale of personal data (KRS 367.3613(1)).	Entity-level Entity: GLBA financial institutions exempt, plus GLBA data Statute text KRS 367.3613(2)(b): the Act shall not apply to any "Financial institutions, their affiliates, or data subject to Title V of the federal Gramm-Leach-Bliley Act, 15 U.S.C. sec. 6801 et seq."	Not stated in the dataset	Kentucky Attorney General (exclusive authority; handled by the AG's Office of Data Privacy) (KRS 367.3627(1)).	30 days, mandatory Detail 30 days, mandatory, no sunset: AG must give 30 days' written notice; no damages action if the controller/processor cures and provides an express written statement that violations are cured and will not recur (KRS 367.3627(2)).	None (KRS 367.3627(4)).	$7,500 per violation Detail Damages up to $7,500 for each continued violation after the cure period or breach of the written statement, plus investigative expenses, court costs and attorney's fees (KRS 367.3627(3),(5)).	2026-09-30
Rhode Island Fintech note No cure period and a notice duty for any commercial website that sells PII (listing every third party it sells to), though GLBA financial institutions and affiliates are exempt at the entity level. Changes coming None listed	Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) R.I. Gen. Laws §§ 6-48.1-1 to 6-48.1-10 (P.L. 2024, ch. 430 and ch. 453)	2026-01-01	35,000 consumers; OR 10,000 + more than 20% of revenue from selling data Statute summary Core obligations (§§ 6-48.1-4 to 6-48.1-7) apply to for-profit entities that conduct business in Rhode Island or produce products or services targeted to residents and that during the preceding calendar year (1) controlled or processed personal data of at least 35,000 customers (excluding data processed solely to complete a payment transaction), or (2) controlled or processed personal data of at least 10,000 customers and derived more than 20% of gross revenue from the sale of personal data. Separately, § 6-48.1-3 requires ANY commercial website or internet service provider doing business in RI or with RI customers to designate a controller and, if it collects, stores and sells personally identifiable information, disclose categories collected and all third parties to whom it has sold or may sell the data, regardless of volume.	Entity-level Entity: GLBA financial institutions exempt, plus GLBA data Statute text § 6-48.1-3(d): chapter does not apply to any "financial institution or data subject to Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et seq."; § 6-48.1-10(a): "Nothing in this chapter shall be deemed to apply in any manner to a financial institution, an affiliate of a financial institution, or data subject to Title V of the federal Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et seq., and its implementing regulations".	Not stated in the dataset	Rhode Island Attorney General (sole enforcement authority, § 6-48.1-8(b)); violations are deceptive trade practices under ch. 6-13.1.	None Detail none	None (§ 6-48.1-8(c)).	$10,000 per violation; $100–$500 per intentional disclosure Detail Deceptive trade practice civil penalty up to $10,000 per violation (§ 6-13.1-8, via § 6-48.1-8(a)); plus a fine of $100 to $500 per disclosure for intentionally disclosing personal data to a shell entity formed to circumvent the chapter or in violation of the chapter (§ 6-48.1-8(a)).	2026-09-30
Oklahoma Verify with counsel Open items: citation Fintech note Entity-level GLBA exemption means banks, lenders and other GLBA 'financial institutions' (including many fintechs) are outside the act entirely; non-GLBA fintech affiliates must still count Oklahoma consumers toward the 100,000 threshold. Changes coming 2027-01-01: takes effect	Oklahoma consumer data privacy law (SB 546; no short title) SB 546 (2026), to be codified at 75A O.S. § 300 et seq.	2027-01-01 Not yet in effect	100,000 consumers; OR 25,000 + more than 50% of revenue from selling data Statute summary Controllers/processors that conduct business in Oklahoma or target products/services to Oklahoma residents and, during a calendar year, either (a) control or process personal data of at least 100,000 consumers, or (b) control or process personal data of at least 25,000 consumers and derive over 50% of gross revenue from the sale of personal data (75A O.S. § 314(A)). No revenue-only trigger; no small-business carve-out beyond the volume tests. 'Sale' is limited to exchanges for monetary consideration (§ 300(28)).	Entity-level Entity: GLBA financial institutions exempt, plus GLBA data Statute text 75A O.S. § 314(B)(2) (SB 546 § 15(B)(2)): the act shall not apply to "A financial institution or data subject to Title V of the Gramm-Leach-Bliley Act, 15 U.S.C., Section 6801 et seq." -- entity-level plus data-level exemption.	Not stated in the dataset	Oklahoma Attorney General (exclusive authority, 75A O.S. § 311(A)); AG must post guidance and an online complaint mechanism.	30 days, mandatory Detail 30 days, mandatory (no sunset): AG must give written notice at least 30 days before suing; no action if the controller/processor cures and provides a written statement with supporting documentation that no further violations will occur (75A O.S. § 312). Not yet operative -- act effective 2027-01-01.	None -- "Nothing in this act shall be construed as providing a basis for, or being subject to, a private right of action" (75A O Detail None -- "Nothing in this act shall be construed as providing a basis for, or being subject to, a private right of action" (75A O.S. § 313(E)).	$7,500 per violation Detail Civil penalty up to $7,500 per violation for violations continuing after the cure period or breach of the written cure statement, plus injunctive relief and reasonable attorney fees/investigative expenses (75A O.S. § 313(A)-(C)).	2026-09-30
Alabama Verify with counsel Open items: citation; universal_opt_out Fintech note No data protection assessment and no appeal requirement, and licensed money transmitters (Ala. Code Title 8 ch. 7A) and securities registrants (ch. 6) are exempt as entities alongside GLBA financial institutions and their affiliates. Changes coming 2027-05-01: takes effect	Alabama Personal Data Protection Act (APDPA) Act 2026-552 (HB 351); Code sections not yet assigned	2027-05-01 Not yet in effect	More than 25,000 consumers; OR more than 25% of revenue from selling data. Businesses under 500 employees that do not sell data are exempt Statute summary Persons conducting business in Alabama or targeting products/services to Alabama residents that either (1) control or process personal data of more than 25,000 consumers (excluding data controlled or processed solely to complete a payment transaction), or (2) derive more than 25% of gross revenue from the sale of personal data, regardless of consumer count (HB 351 § 3). Entity exemptions include businesses with fewer than 500 employees that do not sell personal data, and nonprofits with fewer than 100 employees that do not sell personal data (§ 4(a)(7)-(8)) -- an employee-count test, not the SBA definition.	Entity-level Entity: GLBA financial institutions exempt, plus GLBA data Statute text HB 351 § 4(a)(4)-(5): act does not apply to "(4) A financial institution or an affiliate of a financial institution governed by 15 U.S.C. Chapter 94. (5) A financial institution or an affiliate of a financial institution governed by, or personal data collected, processed, sold, or disclosed in accordance with Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et. seq." Entity exemption extends to affiliates, plus data-level exemption; § 4(a)(9)-(10) also exempt any person regulated by Ala. Code Title 8 ch. 6 (Alabama Securities Act) and ch. 7A (Alabama Monetary Transmission Act).	Entity exemptions include businesses with fewer than 500 employees that do not sell personal data, and nonprofits with fewer than 100 employees that do not sell personal data (§ 4(a)(7)-(8)) -- an employee-count test, not the SBA definition.	Alabama Attorney General (HB 351 § 11(a)).	45 days, mandatory Detail 45 days, mandatory (no sunset): AG must issue a notice of violation before any action; no action if the controller corrects within 45 days and provides an express written statement that violations are corrected and will not recur (HB 351 § 11(b)). Not yet operative -- act effective 2027-05-01.	None created -- enforcement provision authorizes only the Attorney General (§ 11); the act contains no express private-right-of-action bar.	$15,000 per violation Detail Civil penalty up to $15,000 per violation where the controller failed to correct within the 45-day cure period, plus injunction (HB 351 § 11(b)(2)).	2026-09-30
Louisiana Fintech note The $25 million revenue trigger pulls in mid-size fintechs regardless of Louisiana consumer count, but GLBA financial institutions and their affiliates are exempt at the entity level. Changes coming 2027-01-01: takes effect; 2027-07-31: cure period ends	Louisiana Data Privacy Act (LDPA) La. R.S. 51:1780.1-1780.5 (Chapter 20-B of Title 51), enacted by Act 502 of 2026 (SB 386, 2026 Regular Session)	2027-01-01 Not yet in effect	$25M revenue; OR buy/sell/share data of 75,000 consumers, households or devices; OR 50%+ of revenue from selling data Statute summary Persons or entities doing business in Louisiana that meet ANY of: (1) annual gross revenues over $25 million; (2) annually buy, receive for commercial purposes, sell, or share for commercial purposes the personal information of 75,000 or more consumers, households, or devices; or (3) derive 50% or more of annual revenues from selling consumers' personal information (R.S. 51:1780.2(A)). CCPA-style test: revenue alone triggers. No small-business exemption.	Entity-level Entity: GLBA financial institutions exempt, plus GLBA data Statute text R.S. 51:1780.2(B)(2): Chapter does not apply to "A financial institution and its affiliates or data subject to Title V, Gramm-Leach-Bliley Act, 15 U.S.C. 6801 et seq., and the rules and implementing regulations promulgated thereunder." Entity-level (including affiliates) plus data-level.	Not stated in the dataset	Louisiana Attorney General (R.S. 51:1780.5(A)), through the Unfair Trade Practices and Consumer Protection Law.	30 days, 2027-01-01 to 2027-07-31 only Detail 30 days, mandatory, only from 2027-01-01 through 2027-07-31 (R.S. 51:1780.5(D)); none thereafter. Not yet operative as of 2026-09-29.	None -- violations are unfair and deceptive trade practices under LUTPA 'excluding private rights of action as provided in R Detail None -- violations are unfair and deceptive trade practices under LUTPA 'excluding private rights of action as provided in R.S. 51:1409 and 1409.1' (R.S. 51:1780.5(C)).	$5,000 per violation (intent to defraud) Detail Via LUTPA: civil penalty up to $5,000 per violation where the court finds intent to defraud (R.S. 51:1407(B)); additional penalties where elderly or disabled persons are harmed (51:1407(C)); up to $5,000 per violation for violating an injunction or assurance of voluntary compliance (51:1416). The privacy act itself sets no separate penalty amount.	2026-09-30
Vermont Fintech note Only banks, credit unions and their financial-activity affiliates, SEC/DFR-regulated securities firms and insurers are exempt as entities -- non-bank fintechs (lenders, payments, BNPL) are covered for any non-GLBA data, and the 35,000-consumer threshold excludes data processed solely to complete a payment transaction. Changes coming 2028-01-01: takes effect; 2029-06-30: cure period ends	Vermont Data Privacy and Online Surveillance Act (VDPOSA) 9 V.S.A. ch. 61A, subch. 1, §§ 2415a-2415k (Act 145 of 2026, S.71)	2028-01-01 Not yet in effect	35,000 consumers; OR sensitive data of 3,000; OR offering for sale data of 3,000 Statute summary Persons conducting business in Vermont or targeting products/services to Vermont residents that, during the preceding calendar year: (1) controlled or processed personal data of at least 35,000 consumers (excluding data processed solely to complete a payment transaction); (2) controlled or processed sensitive data of at least 3,000 consumers (same payment-transaction exclusion); or (3) offered for sale personal data of at least 3,000 consumers (9 V.S.A. § 2415b(a)). Consumer health data provisions (§ 2415k) apply to any person doing business in or targeting Vermont regardless of thresholds (§ 2415b(b)). No revenue test; no small-business exemption.	Banks only (entity) + data Banks only (entity) + data: banks and similar institutions exempt; other fintechs exempt only for GLBA data Statute text 9 V.S.A. § 2415c(a)(13)-(15): subchapter does not apply to "(13) data subject to Title V of the Gramm-Leach-Bliley Act, Pub. L. No. 106-102, and regulations adopted to implement that act; (14) a state- or federally chartered bank or credit union, or an affiliate or subsidiary that is principally engaged in financial activities, as described in 12 U.S.C. § 1843(k); (15) an agent, broker-dealer, investment adviser, or investment adviser representative ... regulated by the Department of Financial Regulation or the Securities and Exchange Commission"; (16) exempts most persons regulated under 8 V.S.A. part 3 (insurance). Non-bank fintechs get only the data-level GLBA exemption.	Not stated in the dataset	Vermont Attorney General under the Vermont Consumer Protection Act, 9 V.S.A. ch. 63 (9 V.S.A. § 2415j(a)).	60 days, discretionary, 2028-01-01 to 2029-06-30 Detail Not yet operative. 60 days, discretionary (AG issues a notice of violation only if it determines a cure is possible), from 2028-01-01 through 2029-06-30 (Act 145 Sec. 3); none thereafter.	None -- § 2415j(a) bars a private right of action; Act 145 Sec Detail None -- § 2415j(a) bars a private right of action; Act 145 Sec. 2 states the General Assembly may consider adding one if AG enforcement resources are not provided.	$10,000 per violation Detail Via the Consumer Protection Act: civil penalty up to $10,000 per unfair or deceptive act or practice, plus restitution and other relief (9 V.S.A. § 2458(b)(1)).	2026-09-30

Work out which of these laws reach your company in the Data Privacy Compliance Kit: its Applicability tab applies each state's thresholds and GLBA exemption type to your GLBA status and resident counts. Breach notice rules are on the state breach notification chart.

◆ How to use this

Read the row, then read the statute.

Decide first whether your company (and each affiliate) is a "financial institution" subject to GLBA Title V. Entity-level exemptions only help if it is.
For each state, check the GLBA column: "Entity-level" exempts a GLBA financial institution entirely; "Data-level only" and "Banks only (entity) + data" leave a non-bank fintech covered for its non-GLBA data.
Count residents per state and apply the thresholds column; the statute summary shows exclusions such as data processed only to complete a payment.
Note laws that are not yet in effect and the changes coming, and diary the dates.
Rows with open items list what could not be confirmed from primary text. Treat them as unconfirmed and check with counsel.

Methodology

Each law was checked against the statute and regulator sources listed in its row, current to September 30, 2026. The GLBA column quotes the exemption text from the statute. 7 rows list open items that could not be confirmed from primary text (California, Iowa, Tennessee, New Jersey, Maryland, Oklahoma and Alabama).

Not legal advice

This is a reference summary for risk and compliance teams, not legal advice. Laws change and how they apply depends on your facts. Confirm each obligation against the cited text and with counsel before you rely on a deadline.

◆ FAQ

Common questions.

Which state privacy laws exempt GLBA financial institutions entirely?

17 of 23: Virginia, Colorado, Utah, Iowa, Indiana, Tennessee, Texas, Delaware, New Hampshire, New Jersey, Nebraska, Maryland, Kentucky, Rhode Island, Oklahoma, Alabama and Louisiana. These are entity-level exemptions ("GLBA financial institutions exempt, plus GLBA data"). Delaware changes on January 1, 2027: GLBA entity exemption narrowed to banks and other listed institutions. As of September 30, 2026.

Which state privacy laws exempt only GLBA data, not the financial institution?

California exempts only data subject to GLBA, for every business: "only data subject to GLBA is exempt; the rest of a fintech's data is covered". Connecticut, Montana, Oregon, Minnesota and Vermont exempt banks and similar chartered institutions as entities, but other financial institutions get only the data-level exemption ("banks and similar institutions exempt; other fintechs exempt only for GLBA data").

Does the GLBA exemption take a non-bank fintech out of state privacy laws?

Only partly, and it depends on the state and on whether the company is a GLBA financial institution. Colorado: "Colorado exempts GLBA financial institutions and their affiliates as entities, which is broader than most states. A fintech that is not a GLBA financial institution is fully covered, including biometric duties (such as KYC selfie or face match) with no volume threshold." California: "The GLBA exemption covers data, not the institution, so a fintech's non-GLBA data (website and marketing tracking, B2B contacts, employee and applicant data) stays in scope. Automated decision-making rules generally reach decisions only to the extent they use non-GLBA personal information — confirm with counsel."

How many states have comprehensive consumer privacy laws?

This dataset covers 23 state laws as of September 30, 2026. 19 were in effect on that date; 4 take effect later: Oklahoma (January 1, 2027), Alabama (May 1, 2027), Louisiana (January 1, 2027) and Vermont (January 1, 2028).

Can consumers sue under state privacy laws?

Generally no: 22 of the 23 laws provide no private right of action. The exception is California: "Limited to data breaches: a consumer whose nonencrypted, nonredacted personal information is subject to unauthorized access and exfiltration, theft or disclosure because the business failed to maintain reasonable security may recover $100–$750 per consumer per incident (CPI-adjusted to $107–$799 effective 2025-01-01) or actual damages, whichever is greater (§ 1798.150)."

Which state privacy laws still have a mandatory cure period?

As of September 30, 2026: Virginia (30 days, mandatory), Utah (30 days, mandatory), Iowa (90 days, mandatory), Indiana (30 days, mandatory), Tennessee (60 days, mandatory), Texas (30 days, mandatory), Nebraska (30 days, mandatory), Kentucky (30 days, mandatory), Oklahoma (30 days, mandatory; law takes effect January 1, 2027) and Alabama (45 days, mandatory; law takes effect May 1, 2027). Elsewhere the cure period has expired, is discretionary, applies only for a set window, or does not exist; check the cure column for each state.

◆ Sources

Primary sources.

Every source checked for each state, in the order listed in the dataset. The first source for each state is the citation link in the table.

Data: CSV · JSON. Free to reuse under CC BY 4.0 with attribution to RiskTemplates and a link to this page. Last verified September 30, 2026.