Tennessee Information Protection Act

The Tennessee Information Protection Act took effect on July 1, 2025. It applies only to businesses with revenue over $25 million that also either handle the personal data of 175,000 or more Tennessee consumers in a calendar year, or 25,000 or more while getting over 50% of gross revenue from selling personal data. “Sale” here means only an exchange for money.

Nonprofits are exempt, as are government bodies, colleges, Gramm-Leach-Bliley financial institutions, HIPAA covered entities and insurers.

• Rights to access, correct, delete, get a portable copy, and opt out of sale, targeted advertising and certain profiling.
• Respond within 45 days, extendable once by 45 more. Free up to twice a year.
• Appeals: free, decided within 60 days; a denial must say how to contact the Attorney General.

Tennessee doesn’t require businesses to honor universal opt-out signals such as Global Privacy Control.

Sensitive data needs consent. It includes racial or ethnic origin, religion, health diagnoses, sexual orientation, citizenship or immigration status, genetic and biometric data, data of a known child under 13, and precise geolocation. Children’s data must be handled under COPPA. Data protection assessments are required for sensitive data, sales, targeted advertising and risky profiling.

The notice must be reasonably accessible, clear and meaningful, listing the categories you process and why, how to use and appeal rights, and the categories you sell and the third parties you sell them to. Sales and targeted advertising must be clearly and conspicuously disclosed, with how to opt out. You can’t require a new account to make a request.

Tennessee gives an affirmative defense to a business with a written privacy program that reasonably conforms to the NIST Privacy Framework, kept up to date and providing the Act’s rights.

The Attorney General has exclusive authority; there’s no private right of action. Before acting, the Attorney General must give 60 days’ written notice; if you cure and confirm in writing, no action follows. The statute sets no end date for this cure period. Penalties are up to $7,500 per violation, and a court may award treble damages for willful or knowing violations, plus fees and costs.