Your Tennessee consumer data rights
In effect
The Tennessee Information Protection Act gives Tennessee residents rights over the personal information that large covered businesses collect about them. It has been in effect since July 1, 2025.
- Who or what it protects
- Tennessee residents, in their dealings with businesses in Tennessee or targeting its residents that have more than $25 million in annual revenue and either process the personal information of at least 175,000 Tennesseans a year, or of at least 25,000 while earning half of their gross revenue from selling it. Government bodies, financial institutions, organizations covered by HIPAA, nonprofits and colleges and universities are exempt.
- What you can do
- You can confirm whether a business processes your personal information and see it, correct it, have it deleted (except aggregated or de-identified information), and get a copy you can take elsewhere. You can opt out of targeted advertising, profiling, and the sale of your personal information. You also have a right to know what categories of information the business processes and why, and the categories it shares and with whom. A business needs your consent to process sensitive data. Use the method in the company's privacy notice. It must respond within 45 days, and if it denies your request it must explain why and give you a way to appeal. You can report a suspected violation to the Attorney General's Division of Consumer Affairs.
- Limits and eligibility
- This law covers only large businesses: those with more than $25 million in annual revenue that also meet the data thresholds. The Tennessee Attorney General has exclusive authority to enforce it and must give a business 60 days to fix a violation first.
- Who oversees it
- Tennessee Attorney General, Division of Consumer Affairs
- The law
- Tennessee Information Protection Act
More official places to go
Checked against the official sources on October 6, 2026. Links last checked November 2, 2026.