thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

State Comprehensive Privacy Laws

US state laws, following California and Virginia, granting consumer privacy rights and imposing duties on controllers.

Definition

As of 2026 roughly 20 states, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others, have comprehensive privacy laws. Most follow a controller/processor model, provide rights to access, correct, delete, port, and opt out of targeted advertising, sale, and profiling, require consent for sensitive data, and mandate data protection assessments. Most lack a private right of action and are enforced by attorneys general.

Example

A company headquartered in Texas must conduct data protection assessments for targeted advertising under the Texas Data Privacy and Security Act.

Exam tip

Most state laws are modeled on Virginia's VCDPA rather than CCPA.

Related terms