Eight New U.S. State Privacy Laws in 2025: Compliance Challenges and Strategic Shifts

Compliance Hub

14 Feb 2025 — 8 min read

The U.S. privacy landscape will undergo seismic changes in 2025 as Maryland, New Jersey, Tennessee, and five other states enact stringent privacy laws. These regulations introduce GDPR-inspired requirements like data minimization, algorithmic risk assessments, and enhanced protections for minors and sensitive data. Below, we analyze the three most impactful laws—Maryland’s MODPA, New Jersey’s NJDPA, and Tennessee’s TIPA—and outline actionable strategies for multi-state compliance.

1. Maryland Online Data Protection Act (MODPA)

Effective Date: October 1, 2025 (enforcement begins April 1, 2026)

Key Requirements

Data Minimization:
- Collect only data “reasonably necessary” to provide the specific product/service requested by the consumer.
- Prohibits processing sensitive data (e.g., health, biometrics) beyond what’s strictly required.
Youth Protections:
- Bans targeted ads and data sales for users under 18 if the controller “knew or should have known” their age.
- Requires age assurance mechanisms for platforms likely to attract minors.
Risk Assessments:
- Mandates annual evaluations for algorithms used in employment, healthcare, and financial decisions.
Penalties: Up to $10,000 per violation ($25,000 for repeat offenses).

Scope:

Applies to businesses processing data of 35,000+ Maryland residents (excluding payment data) or 10,000+ residents if deriving 20%+ revenue from data sales.

2. New Jersey Data Privacy Act (NJDPA)

Effective Date: January 15, 2025 (enforcement grace period until July 2026)

Key Requirements

Expanded Sensitive Data:
- Includes immigration status, union membership, and citizenship.
- Requires explicit opt-in consent for processing.
Opt-Out Rights:
- Consumers can reject targeted ads, data sales, and profiling via Global Privacy Control (GPC).
Transparency:
- Privacy notices must disclose third-party data sharing with “sufficient detail to understand business models.”

Scope:

Targets businesses handling data of 100,000+ residents (or 25,000+ if 50%+ revenue from data sales).

Penalties: $7,500 per intentional violation, with no private right of action.

3. Tennessee Information Protection Act (TIPA)

Effective Date: July 1, 2025

Key Requirements

Revenue Threshold:
- Applies only to businesses with $25M+ annual revenue.
Affirmative Defense:
- Avoid penalties by implementing NIST-aligned privacy programs.
Cure Period:
- 60 days to fix violations before fines (up to $7,500 per violation).

Scope:

Processes data of 175,000+ residents or 25,000+ if deriving 50%+ revenue from data sales.

Comparative Analysis

Aspect	Maryland (MODPA)	New Jersey (NJDPA)	Tennessee (TIPA)
Threshold	35K residents	100K residents	$25M revenue + 175K residents
Sensitive Data	Health, biometrics, genetics	Immigration status, citizenship	Aligns with CCPA/CPRA
Youth Protections	Under 18	No explicit minor safeguards	None
Penalties	$10K/violation	$7.5K/violation	$7.5K/violation
Cure Period	60 days	30 days	60 days (non-sunsetting)

Compliance Strategies for Multi-State Operations

Unified Data Mapping:
- Use tools like OneTrust to track data flows across Maryland’s “reasonably necessary” standard and New Jersey’s expanded sensitive categories.
Algorithmic Governance:
- Conduct bias audits for AI/ML models impacting hiring, credit, or healthcare (mandated in Maryland and New Jersey).
Consent Management Platforms (CMPs):
- Deploy CMPs supporting GPC for NJDPA opt-outs and MODPA’s minor ad restrictions.
Vendor Contracts:
- Require third parties to comply with state-specific rules (e.g., Maryland’s data sovereignty clauses).

Emerging Trends

GDPR Convergence:
- 63% of 2025 laws mandate data minimization, mirroring GDPR’s Article 5(1)(c).
Sensitive Data Expansion:
- States now protect immigration status (NJ), genetic data (MD), and non-traditional categories.
Enforcement Surge:
- State AGs plan joint task forces, with Maryland allocating $2M for privacy enforcement in 2026.

Comparing U.S. State Privacy Laws (MODPA, NJDPA, TIPA) to GDPR: Enforcement and PenaltiesThe surge in U.S. state privacy laws reflects growing alignment with GDPR principles like data minimization and transparency, but enforcement mechanisms and penalties vary significantly. Below, we compare Maryland’s MODPA, New Jersey’s NJDPA, Tennessee’s TIPA, and the EU’s GDPR across key dimensions.

1. Enforcement Authorities

U.S. State Laws

Maryland (MODPA): Enforced by the Attorney General’s Consumer Protection Division5 22.
New Jersey (NJDPA): Overseen by the Attorney General and Division of Consumer Affairs2 23.
Tennessee (TIPA): Solely enforced by the Tennessee Attorney General3 12.

GDPR: Enforced by independent Data Protection Authorities (DPAs) across 27 EU member states4 33.

2. Penalty Structures

Law	Maximum Penalty	Key Criteria
	$10,000 per violation; $25,000 repeats	Based on violation severity, entity size, and public harm risk5 1028.
	$10,000 (first); $20,000 (subsequent)	Tied to New Jersey Consumer Fraud Act2 629.
	$7,500 per violation	Civil penalties for uncured violations; treble damages for willful misconduct3 1236.
	€20M or 4% global revenue	Whichever is higher; applies to breaches like inadequate security or unlawful transfers4 2533.

Example: Meta’s 2023 GDPR fine for unlawful data transfers totaled €1.2B25 33, while the largest state penalty under MODPA could reach $25K per repeat violation10.

3. Cure Periods

MODPA: 60-day cure period (mandatory until April 2027; discretionary afterward)5 22.
NJDPA: 30-day cure period, expiring July 20262 6 23.
TIPA: 60-day cure period with no sunset clause3 12 36.
GDPR: No statutory cure period, though remediation efforts may mitigate fines4 33.

4. Private Right of Action

U.S. States: None. All enforcement is state-led5 2 3.
GDPR: No private right, but individuals can file complaints with DPAs, triggering investigations4 33.

5. Scope and Extraterritorial Reach

State Laws: Apply to businesses operating in/targeting residents of each state (e.g., MODPA: 35K+ residents; TIPA: $25M+ revenue)5 12 16.
GDPR: Applies globally to any entity processing EU residents’ data, regardless of location4 9 33.

Key Trends

GDPR Influence: MODPA’s data minimization and NJDPA’s broad sensitive data definitions mirror GDPR principles5 2 14.
Lower Penalties: State penalties (max $25K) pale compared to GDPR’s revenue-based fines (e.g., Meta’s €1.2B fine)25 33.
Cure Periods: U.S. states offer structured remediation windows; GDPR leaves discretion to DPAs2 3 4.

Conclusion

While MODPA, NJDPA, and TIPA adopt GDPR-like accountability frameworks, their enforcement is less punitive and more localized. GDPR’s global reach and steep penalties (up to 4% of revenue) create higher stakes for multinational firms. Businesses must prioritize:

State Compliance: Implement consent management tools (e.g., OneTrust) for opt-outs and DSARs2 5.
GDPR Alignment: Conduct cross-border transfer audits and update SCCs for EU data sovereignty9 33.

Maryland’s strict minimization, New Jersey’s broad sensitive data rules, and Tennessee’s revenue thresholds create a fragmented but GDPR-aligned landscape. Businesses must prioritize centralized compliance frameworks, automate DSAR responses, and preempt algorithmic risks. With penalties exceeding $10K per violation and multi-state audits rising, proactive adaptation is critical to avoiding regulatory blowback.

Key Takeaways:

Update data inventories to meet Maryland’s “reasonably necessary” standard.
Implement GPC for NJDPA opt-outs by January 2025.
Leverage TIPA’s affirmative defense by aligning with NIST CSF 2.0.

(Citations: Maryland MODPA[7][16], New Jersey NJDPA[5][26], Tennessee TIPA[33][36])

Eight New U.S. State Privacy Laws in 2025: Compliance Challenges and Strategic Shifts

Compliance Hub

1. Maryland Online Data Protection Act (MODPA)

Key Requirements

2. New Jersey Data Privacy Act (NJDPA)

Key Requirements

3. Tennessee Information Protection Act (TIPA)

Key Requirements

Comparative Analysis

Compliance Strategies for Multi-State Operations

Emerging Trends

1. Enforcement Authorities

U.S. State Laws

2. Penalty Structures

3. Cure Periods

4. Private Right of Action

5. Scope and Extraterritorial Reach

Key Trends

Conclusion

Read more

Secrets Sprawl: A Compliance Nightmare Leading to Potential Privacy Fines

Navigating CMMC Compliance for Your Defense Contractor Website

Comparative Analysis of Cybersecurity Frameworks: MOSAICS, CMMC, and FedRAMP

The NIST Cybersecurity Framework (CSF) 2.0: A Comprehensive Guide for Your Compliance Hub