State Privacy Law Penalties and Cure Periods by State

California looks lowest here only because this is its base figure; intentional violations and anything involving under-16 data reach $7,988. Colorado's $20,000 cap sits well above the $7,500 most states chose.

Iowa's 90 days is the outlier and does not expire. Several bars on this chart are temporary or not yet in force, so check the label before you count on that window.

Permanent cure rights are now the largest group, but the states that once offered a cure and dropped it are close behind. Among the older laws, the trend runs one way: toward less warning, not more.

The four state privacy laws enacted in 2026: penalties and cure periods

Source: Morgan Lewis, New US State Consumer Privacy Laws: What Businesses Should Know; Troutman Pepper Locke (Troutman Privacy), Oklahoma Enacts Consumer Data Privacy Law; Troutman Pepper Locke (Troutman Privacy), Alabama Enacts Consumer Data Privacy Law; Troutman Pepper Locke (Troutman Privacy), Louisiana Enacts Consumer Data Privacy Law; Jackson Lewis P.C. (Workplace Privacy Report), Consumer Privacy Protections Come to the Heart of Dixie; Mayer Brown, Vermont Enacts Comprehensive Consumer Privacy Law; Baker Donelson, Consumer Data Privacy Law Guide: Louisiana; Baker Donelson, Consumer Data Privacy Law Guide: Vermont; Baker Donelson, Consumer Data Privacy Law Guide: Oklahoma; Hunton Andrews Kurth (Privacy & Cybersecurity Law Blog), Vermont Becomes 23rd State with Comprehensive Consumer Privacy Law. Download as image

When state privacy law cure periods ended or will end

Source: Baker Donelson, Consumer Data Privacy Law Guide: Connecticut; Colorado Revised Statutes via Public.Law, C.R.S. § 6-1-1311 (Colorado Privacy Act, enforcement); Hunton Andrews Kurth (Privacy & Cybersecurity Law Blog), Montana Amends Consumer Data Privacy Act; Baker Donelson, Consumer Data Privacy Law Guide: Montana; Delaware Code Online, 6 Del. C. § 12D-111 (Delaware Personal Data Privacy Act, enforcement); Sidley Austin (Data Matters), New Hampshire's Comprehensive Data Privacy Legislation; Baker Donelson, Consumer Data Privacy Law Guide: Oregon; Minnesota Office of the Revisor of Statutes, Minn. Stat. § 325M.20 (Attorney general enforcement); Baker Donelson, Consumer Data Privacy Law Guide: New Jersey; Baker Donelson, Consumer Data Privacy Law Guide: Maryland; Troutman Pepper Locke (Troutman Privacy), Louisiana Enacts Consumer Data Privacy Law; Mayer Brown, Vermont Enacts Comprehensive Consumer Privacy Law. Download as image

Privacy law cure-period status (October 2026) by state

• 2No cure right (enforcement can start at once)
• 8Cure period expired or removed; cure now discretionary or unavailable
• 3Temporary cure period still in force or not yet started
• 10Permanent mandatory cure period
• 1Narrow law covering only very large companies
• 27No comprehensive consumer privacy law

How much can a state fine a business for a privacy violation?

Twelve of the 23 state laws stop at $7,500 per violation, so that is the figure to keep in mind when a client asks what a privacy mistake could cost. That group includes Virginia, Texas, Utah, Oregon and Minnesota. A second cluster sits at $10,000, among them Rhode Island, Delaware and New Hampshire. Colorado tops the list at $20,000, and that rises to $50,000 when the victim is elderly.

California works differently. The base amount is $2,663, but an intentional violation, or one involving data from a consumer under 16, costs up to $7,988. Those figures are adjusted for inflation every odd-numbered year, so they will move again.

Florida's Digital Bill of Rights allows $50,000 per violation and sometimes triple that, but it only reaches companies with more than $1 billion in global revenue. If you run a small agency, Florida's big number is not your problem. Your exposure comes from the ordinary state laws, and from the contracts that pass their costs to you.

How do states count a privacy violation?

The statutes rarely say. That silence favors the state. A regulator may try to count each consumer whose data was sold without a working opt-out, each deletion request that went unanswered, or each day a broken privacy notice stayed live. Kentucky's law, for example, speaks of a penalty for each continued violation.

So the cap tells you less than it seems. A $7,500 maximum applied to a single complaint is a nuisance. The same cap applied to every record in a marketing database can threaten a small company. Settlements usually land well below the theoretical maximum, but the maximum is what the state brings to the negotiating table.

Tennessee adds another lever: a court can award treble damages for willful or knowing violations. Maryland raises its cap to $25,000 for each repeat violation, and New Jersey goes to $20,000 for repeat offenses. Repeat problems cost more almost everywhere.

What is a cure period, and which states still have one?

A cure period is a grace window. Before suing, the attorney general sends notice of the violation and gives you a set number of days to fix it and confirm in writing. Fix it in time and, in most of these states, the case goes no further.

Iowa gives the most room at 90 days, and that right does not expire. Tennessee gives 60. Virginia, Texas, Utah, Indiana, Kentucky and Nebraska give 30. Alabama's new law will give 45 days once it takes effect on May 1, 2027.

California and Rhode Island give no statutory cure at all. In California, whether you get a chance to fix things is up to the regulator.

Which states ended their cure periods, and what comes next?

Connecticut's mandatory 60-day cure ended on December 31, 2024. Colorado repealed its cure as of January 1, 2025. Montana removed its cure through SB 297, effective October 1, 2025. Oregon, Delaware and New Hampshire closed theirs at the end of 2025, Minnesota followed on January 31, 2026, and New Jersey's 30-day cure ran out on July 15, 2026.

In some of those states the attorney general can still offer a cure as a courtesy. That is not the same thing as a right. A business that built its compliance plan around getting a warning letter first needs a new plan, because in these states the first letter you get may be the complaint.

Vermont shows where this is heading. Its new law takes effect January 1, 2028, offers a 60-day cure only until June 30, 2029, and then leaves it to the state's discretion.

Four states passed laws in 2026, and none of them is enforceable yet. Oklahoma's takes effect January 1, 2027, with a $7,500 cap and a 30-day cure. Louisiana's law starts the same day, but its 30-day cure lasts only until July 31, 2027. Alabama follows on May 1, 2027, with the highest penalty of the new group at $15,000 per violation and a 45-day cure that does not sunset. Vermont starts January 1, 2028, with a $10,000 cap.

If you sell into these states, use the lead time. Update privacy notices, test opt-out links and fix vendor contracts before the effective date, not after the first warning letter.

What this means if you are not a big tech company

Most small firms never meet a state privacy law's threshold on their own. They still feel these penalties, through contracts. A larger client that is covered will push its obligations down to you with a data processing addendum, an indemnity clause and audit rights. If the client is fined in Colorado because your systems leaked its customer data, the indemnity decides who pays.

Software buyers face the reverse risk. Your SaaS vendor processes your customers' data. As the controller, you still answer to regulators for how that data is handled. A vendor contract that caps liability at a single month of fees leaves you holding almost all of a per-violation penalty.

Freelancers sit in the middle. A developer or marketer with database access can be named as a processor, and a broad indemnity in a client contract can make you answer for fines you had no power to prevent.

What to do now

• List the states where your customers live, not just where you are based. The penalty and cure rules follow the consumer.
• Assume no warning letter. Plan as if the state can sue the day it finds a problem, since most of the expired-cure states now allow exactly that.
• Read every data processing addendum you sign for who pays regulatory fines, and whether that cost sits inside or outside the liability cap.
• Ask vendors for a breach notice deadline in days, not a promise to notify promptly. A cure window is useless if you learn about the problem after it closes.
• Keep records of opt-out and deletion requests and how fast you answered them. Missed requests are among the easiest violations for a regulator to count.

Sources and method

Every number on this page comes from the sources below, each opened and read on or before October 18, 2026. A second, independent review checked every figure against its source and corrected anything that did not match. 51 of 51 state entries were confirmed; any that could not be are marked "Not yet confirmed" and left out of every count and chart.

1. IAPP, Vermont becomes 23rd state to enact consumer privacy law (17 June 2026)
2. Hunton Andrews Kurth (Privacy & Cybersecurity Law Blog), Vermont Becomes 23rd State with Comprehensive Consumer Privacy Law (June 17, 2026)
3. Morgan Lewis, New US State Consumer Privacy Laws: What Businesses Should Know (July 28, 2026)
4. California Privacy Protection Agency, Updated Monetary Thresholds in CCPA (Posted 12/17/2024; effective 1/1/2025)
5. Virginia General Assembly, Legislative Information System, Code of Virginia § 59.1-584 (Virginia Consumer Data Protection Act, enforcement) (Current Code of Virginia (accessed October 2026))
6. Colorado Revised Statutes via Public.Law, C.R.S. § 6-1-1311 (Colorado Privacy Act, enforcement) (Current C.R.S. (accessed October 2026))
7. Colorado Revised Statutes via Public.Law, C.R.S. § 6-1-112 (Colorado Consumer Protection Act, civil penalties) (Current C.R.S. (accessed October 2026))
8. Iowa Legislature, Iowa Code § 715D.8 (Enforcement, penalties) (Iowa Code 2026)
9. Texas statutes via Public.Law, Tex. Bus. & Com. Code § 541.154 (Notice of violation; opportunity to cure) (Current code (accessed October 2026))
10. Texas statutes via Public.Law, Tex. Bus. & Com. Code § 541.155 (Civil penalty; injunction) (Current code (accessed October 2026))
11. Oregon Revised Statutes via Public.Law, ORS 646A.589 (Oregon Consumer Privacy Act, enforcement) (Current through early 2026, text operative January 1, 2026)
12. Delaware Code Online, 6 Del. C. § 12D-111 (Delaware Personal Data Privacy Act, enforcement) (Current Delaware Code (accessed October 2026))
13. Minnesota Office of the Revisor of Statutes, Minn. Stat. § 325M.20 (Attorney general enforcement) (2025 Minnesota Statutes)
14. Kentucky General Assembly, KRS 367.3627 (Enforcement authority of Attorney General) (Effective January 1, 2026)
15. Montana Legislature, MCA 30-14-2820 (Montana Consumer Data Privacy Act, civil penalty) (Montana Code Annotated 2025)
16. Hunton Andrews Kurth (Privacy & Cybersecurity Law Blog), Montana Amends Consumer Data Privacy Act (May 1, 2025)
17. The Florida Senate, Fla. Stat. § 501.72 (Florida Digital Bill of Rights, enforcement) (2026 Florida Statutes)
18. The Florida Senate, Fla. Stat. § 501.702 (Definitions, "controller") (2026 Florida Statutes)
19. Connecticut Office of the Attorney General, The Connecticut Data Privacy Act (Undated web page (accessed October 2026))
20. Sidley Austin (Data Matters), New Hampshire's Comprehensive Data Privacy Legislation (March 25, 2024)
21. Davis Wright Tremaine, Nebraska Data Privacy Act Signed Into Law (June 13, 2024)
22. Constangy, Brooks, Smith & Prophete, Tennessee becomes 8th state to enact comprehensive privacy law (May 22, 2023)
23. Troutman Pepper Locke (Troutman Privacy), Oklahoma Enacts Consumer Data Privacy Law (March 23, 2026)
24. Troutman Pepper Locke (Troutman Privacy), Alabama Enacts Consumer Data Privacy Law (April 16, 2026)
25. Troutman Pepper Locke (Troutman Privacy), Louisiana Enacts Consumer Data Privacy Law (June 3, 2026)
26. Jackson Lewis P.C. (Workplace Privacy Report), Consumer Privacy Protections Come to the Heart of Dixie (May 19, 2026)
27. Mayer Brown, Vermont Enacts Comprehensive Consumer Privacy Law (June 22, 2026)
28. Baker Donelson, Consumer Data Privacy Law Guide: California (Last updated December 2025)
29. Baker Donelson, Consumer Data Privacy Law Guide: Connecticut (Last updated December 2025)
30. Baker Donelson, Consumer Data Privacy Law Guide: Utah (Last updated December 2025)
31. Baker Donelson, Consumer Data Privacy Law Guide: Indiana (Last updated May 2025)
32. Baker Donelson, Consumer Data Privacy Law Guide: Tennessee (Last updated May 2025)
33. Baker Donelson, Consumer Data Privacy Law Guide: Oregon (Last updated December 2025)
34. Baker Donelson, Consumer Data Privacy Law Guide: Delaware (Last updated May 2025)
35. Baker Donelson, Consumer Data Privacy Law Guide: New Hampshire (Last updated May 2025)
36. Baker Donelson, Consumer Data Privacy Law Guide: New Jersey (Last updated May 2025)
37. Baker Donelson, Consumer Data Privacy Law Guide: Maryland (Last updated May 2025)
38. Baker Donelson, Consumer Data Privacy Law Guide: Rhode Island (Last updated May 2025)
39. Baker Donelson, Consumer Data Privacy Law Guide: Montana (Last updated December 2025)
40. Baker Donelson, Consumer Data Privacy Law Guide: Oklahoma (Last updated August 2026)
41. Baker Donelson, Consumer Data Privacy Law Guide: Alabama (Last updated August 2026)
42. Baker Donelson, Consumer Data Privacy Law Guide: Louisiana (Last updated August 2026)
43. Baker Donelson, Consumer Data Privacy Law Guide: Vermont (Last updated August 2026)
44. Baker Donelson, Consumer Data Privacy Law Guide: Colorado (Last updated December 2025)