Does Tennessee have a comprehensive privacy law? Yes. The Tennessee Information Protection Act (TIPA), signed on May 24, 2023, has been in effect since July 1, 2025.
- Status: In Effect
- Law: Tennessee Information Protection Act (HB 1181 / SB 73, 2023; Public Chapter 408; Tenn. Code Ann. § 47-18-3201 et seq.)
- Signed: May 24, 2023 · Effective: July 1, 2025
- Applies to: Persons that conduct business in Tennessee producing products or services that target Tennessee residents, that exceed $25,000,000 in revenue, and that either control or process the personal information of at least 175,000 consumers during a calendar year, or of at least 25,000 consumers while deriving more than 50% of gross revenue from the sale of personal information
- Cure period: Yes; 60 days after the Attorney General’s written notice; no end date
- Enforcement: Attorney General and Reporter (exclusive); civil penalty of up to $7,500 per violation, and treble damages for willful or knowing violations; no private right of action
- Last verified: November 4, 2026 · Official source: Tennessee General Assembly, HB 1181
- Related: Tennessee Information Protection Act (TIPA) guide · State privacy laws that took effect in 2025
Tennessee’s comprehensive privacy law is the Tennessee Information Protection Act. It was passed as House Bill 1181 (Senate Bill 73), signed by the Governor on May 24, 2023, as Public Chapter 408, and took effect on July 1, 2025.
TIPA has some of the highest applicability thresholds of any state privacy law: a business must have more than $25 million in revenue and also handle the personal information of at least 175,000 Tennessee consumers in a year, or of at least 25,000 consumers while earning more than half of its gross revenue from selling personal information. Covered consumers can confirm and access, correct, delete and obtain a copy of their personal information, and can opt out of its sale, targeted advertising and certain profiling. The Attorney General and Reporter enforces the law exclusively, after a 60-day notice and cure period, and a controller or processor whose written privacy program reasonably conforms to the NIST Privacy Framework has an affirmative defense.
For a full explanation of who must comply and what TIPA requires, read our guide to the Tennessee Information Protection Act.