Eight New U.S. State Privacy Laws in 2025: Compliance Challenges and Strategic Shifts

The U.S. privacy landscape will undergo seismic changes in 2025 as Maryland, New Jersey, Tennessee, and five other states enact stringent privacy laws. These regulations introduce GDPR-inspired requirements like data minimization, algorithmic risk assessments, and enhanced protections for minors and sensitive data. Below, we analyze the three most impactful laws—Maryland’s MODPA, New Jersey’s NJDPA, and Tennessee’s TIPA—and outline actionable strategies for multi-state compliance.

1. Maryland Online Data Protection Act (MODPA)

Effective Date: October 1, 2025 (enforcement begins April 1, 2026)

Key Requirements

Data Minimization:

Collect only data “reasonably necessary” to provide the specific product/service requested by the consumer.- Prohibits processing sensitive data (e.g., health, biometrics) beyond what’s strictly required.2. Youth Protections:
Bans targeted ads and data sales for users under 18 if the controller “knew or should have known” their age.- Requires age assurance mechanisms for platforms likely to attract minors.3. Risk Assessments:
Mandates annual evaluations for algorithms used in employment, healthcare, and financial decisions.4. Penalties: Up to $10,000 per violation ($25,000 for repeat offenses).

Scope:

Applies to businesses processing data of 35,000+ Maryland residents (excluding payment data) or 10,000+ residents if deriving 20%+ revenue from data sales.

2. New Jersey Data Privacy Act (NJDPA)

Effective Date: January 15, 2025 (enforcement grace period until July 2026)

Key Requirements

Expanded Sensitive Data:

Includes immigration status, union membership, and citizenship.- Requires explicit opt-in consent for processing.2. Opt-Out Rights:
Consumers can reject targeted ads, data sales, and profiling via Global Privacy Control (GPC).3. Transparency:
Privacy notices must disclose third-party data sharing with “sufficient detail to understand business models.”

Scope:

Targets businesses handling data of 100,000+ residents (or 25,000+ if 50%+ revenue from data sales).

Penalties: $7,500 per intentional violation, with no private right of action.

3. Tennessee Information Protection Act (TIPA)

Effective Date: July 1, 2025

Key Requirements

Revenue Threshold:

Applies only to businesses with $25M+ annual revenue.2. Affirmative Defense:
Avoid penalties by implementing NIST-aligned privacy programs.3. Cure Period:
60 days to fix violations before fines (up to $7,500 per violation).

Scope:

Processes data of 175,000+ residents or 25,000+ if deriving 50%+ revenue from data sales.

Comparative Analysis

Aspect Maryland (MODPA) New Jersey (NJDPA) Tennessee (TIPA)

Threshold 35K residents 100K residents $25M revenue + 175K residents

Sensitive Data Health, biometrics, genetics Immigration status, citizenship Aligns with CCPA/CPRA

Youth Protections Under 18 No explicit minor safeguards None

Penalties $10K/violation $7.5K/violation $7.5K/violation

Cure Period 60 days 30 days 60 days (non-sunsetting)

Compliance Strategies for Multi-State Operations

Unified Data Mapping:

Use tools like OneTrust to track data flows across Maryland’s “reasonably necessary” standard and New Jersey’s expanded sensitive categories.2. Algorithmic Governance:
Conduct bias audits for AI/ML models impacting hiring, credit, or healthcare (mandated in Maryland and New Jersey).3. Consent Management Platforms (CMPs):
Deploy CMPs supporting GPC for NJDPA opt-outs and MODPA’s minor ad restrictions.4. Vendor Contracts:
Require third parties to comply with state-specific rules (e.g., Maryland’s data sovereignty clauses).

Emerging Trends

GDPR Convergence:

63% of 2025 laws mandate data minimization, mirroring GDPR’s Article 5(1)(c).2. Sensitive Data Expansion:
States now protect immigration status (NJ), genetic data (MD), and non-traditional categories.3. Enforcement Surge:
State AGs plan joint task forces, with Maryland allocating $2M for privacy enforcement in 2026.

Comparing U.S. State Privacy Laws (MODPA, NJDPA, TIPA) to GDPR: Enforcement and PenaltiesThe surge in U.S. state privacy laws reflects growing alignment with GDPR principles like data minimization and transparency, but enforcement mechanisms and penalties vary significantly. Below, we compare Maryland’s MODPA, New Jersey’s NJDPA, Tennessee’s TIPA, and the EU’s GDPR across key dimensions.

1. Enforcement Authorities

U.S. State Laws

Maryland (MODPA): Enforced by the Attorney General’s Consumer Protection Division5 22.- New Jersey (NJDPA): Overseen by the Attorney General and Division of Consumer Affairs2 23.- Tennessee (TIPA): Solely enforced by the Tennessee Attorney General3 12.

GDPR: Enforced by independent Data Protection Authorities (DPAs) across 27 EU member states4 33.

2. Penalty Structures

LawMaximum PenaltyKey CriteriaMODPA$10,000 per violation; $25,000 repeatsBased on violation severity, entity size, and public harm risk5 10 28.NJDPA$10,000 (first); $20,000 (subsequent)Tied to New Jersey Consumer Fraud Act2 6 29.TIPA$7,500 per violationCivil penalties for uncured violations; treble damages for willful misconduct3 12 36.GDPR€20M or 4% global revenueWhichever is higher; applies to breaches like inadequate security or unlawful transfers4 25 33.

Example: Meta’s 2023 GDPR fine for unlawful data transfers totaled €1.2B25 33, while the largest state penalty under MODPA could reach $25K per repeat violation10.

3. Cure Periods

MODPA: 60-day cure period (mandatory until April 2027; discretionary afterward)5 22.- NJDPA: 30-day cure period, expiring July 20262 6 23.- TIPA: 60-day cure period with no sunset clause3 12 36.- GDPR: No statutory cure period, though remediation efforts may mitigate fines4 33.

4. Private Right of Action

U.S. States: None. All enforcement is state-led5 2 3.- GDPR: No private right, but individuals can file complaints with DPAs, triggering investigations4 33.

5. Scope and Extraterritorial Reach

State Laws: Apply to businesses operating in/targeting residents of each state (e.g., MODPA: 35K+ residents; TIPA: $25M+ revenue)5 12 16.- GDPR: Applies globally to any entity processing EU residents’ data, regardless of location4 9 33.

Key Trends

GDPR Influence: MODPA’s data minimization and NJDPA’s broad sensitive data definitions mirror GDPR principles5 2 14.2. Lower Penalties: State penalties (max $25K) pale compared to GDPR’s revenue-based fines (e.g., Meta’s €1.2B fine)25 33.3. Cure Periods: U.S. states offer structured remediation windows; GDPR leaves discretion to DPAs2 3 4.

Conclusion

While MODPA, NJDPA, and TIPA adopt GDPR-like accountability frameworks, their enforcement is less punitive and more localized. GDPR’s global reach and steep penalties (up to 4% of revenue) create higher stakes for multinational firms. Businesses must prioritize:

State Compliance: Implement consent management tools (e.g., OneTrust) for opt-outs and DSARs2 5.- GDPR Alignment: Conduct cross-border transfer audits and update SCCs for EU data sovereignty9 33.

Maryland’s strict minimization, New Jersey’s broad sensitive data rules, and Tennessee’s revenue thresholds create a fragmented but GDPR-aligned landscape. Businesses must prioritize centralized compliance frameworks, automate DSAR responses, and preempt algorithmic risks. With penalties exceeding $10K per violation and multi-state audits rising, proactive adaptation is critical to avoiding regulatory blowback.

Key Takeaways:

Update data inventories to meet Maryland’s “reasonably necessary” standard.2. Implement GPC for NJDPA opt-outs by January 2025.3. Leverage TIPA’s affirmative defense by aligning with NIST CSF 2.0.

(Citations: Maryland MODPA[7][16], New Jersey NJDPA[5][26], Tennessee TIPA[33][36])

1. Maryland Online Data Protection Act (MODPA)

Key Requirements

2. New Jersey Data Privacy Act (NJDPA)

Key Requirements

3. Tennessee Information Protection Act (TIPA)

Key Requirements

Comparative Analysis

Compliance Strategies for Multi-State Operations

Emerging Trends

1. Enforcement Authorities

U.S. State Laws

2. Penalty Structures

3. Cure Periods

4. Private Right of Action

5. Scope and Extraterritorial Reach

Key Trends

Conclusion

Related Articles

The CPRA Cybersecurity Audit Mandate Is Now Active: What California Businesses Must Do in 2026

California's Privacy Risk Assessment Rules Are Live. The 2028 Deadline Isn't the Starting Gun.

Ford Motor Company Fined $375,703 by California Privacy Agency for Blocking Consumer Opt-Out Rights