Tennessee Information Protection Act (TIPA)

The Tennessee Information Protection Act (TIPA) establishes consumer rights over their personal data, including the right to access, correct, and delete data, as well as opt-out of data processing for certain purposes.

JurisdictionTennessee
CategoryPrivacy & Data Protection
StatusActive
Effective date
Latest development

Analysis

Key Requirements

The Tennessee Information Protection Act (TIPA) establishes several key requirements for businesses:

  • Applicability: TIPA applies to businesses that conduct business in Tennessee or produce products/services targeted to Tennessee residents, have annual revenue exceeding $25 million, and either:
  • Control/process personal information of at least 175,000 Tennessee consumers, or
  • Control/process personal information of at least 25,000 Tennessee consumers and derive over 50% of gross revenue from selling personal information Source: Tennessee General Assembly
  • Consumer Rights: Businesses must honor consumer rights, including:
  • Right to access personal data
  • Right to correct inaccuracies
  • Right to delete personal data
  • Right to data portability
  • Right to opt-out of data processing for sales, targeted advertising, or profiling Source: Tennessee Attorney General's Office

Compliance Challenges

Organizations face several challenges in complying with TIPA:

Implementation Best Practices

To implement TIPA requirements effectively:

Recent Updates

TIPA is a relatively new law with the following key dates:

No significant amendments have been made since its passage, but businesses should monitor the Tennessee Attorney General's Office for potential updates or guidance.

Related Regulations

TIPA shares similarities with other state privacy laws:

These laws interact by creating a patchwork of state-level privacy regulations in the absence of comprehensive federal legislation.

Industry Impact

TIPA will significantly impact various industries:

Sources

Recent developments

  • — TIPA formally became enforceable on July 1, 2026, and this piece outlines key compliance obligations, enforcement by the Tennessee Attorney General, and recommended steps businesses should take to prepare and reduce enforcement risk.[4] (source)
  • — Law firm guidance highlighting that covered businesses must be ready for Tennesseans’ new access, correction, deletion, portability, and opt‑out rights, and emphasizing heightened duties around sensitive data, children’s data, vendor contracts, and data protection assessments as TIPA’s enforcement date approached.[5] (source)
  • — Privacy vendor analysis explaining TIPA’s scope thresholds, consumer rights, opt‑out model, consent requirements for sensitive data and children, and exclusive enforcement by the Attorney General, positioning TIPA within the broader trend of state privacy laws and advising companies on alignment with other regimes.[6] (source)
  • — Commentary on TIPA’s role in making Tennessee the 8th state with a comprehensive privacy law, describing consumer rights, mandatory data protection assessments, and the unique affirmative defense for companies that implement NIST‑aligned privacy programs, which many in the industry view as a significant compliance incentive.[7] (source)
  • — TN Attorney General’s Office consumer‑facing guidance detailing who must comply with TIPA, the law’s effective dates (including earlier applicability of data protection assessments), and the specific rights Tennessee residents can exercise, signaling the enforcement authority’s expectations for business compliance.[2] (source)
  • — Employer‑focused reminder that TIPA’s effective date is July 1, 2025, highlighting obligations for businesses handling Tennessee residents’ data and prompting HR and compliance teams to update policies and processes accordingly.[3] (source)
  • — Detailed overview of TIPA’s applicability thresholds, consumer rights, controller duties (including 45‑day response deadlines and data protection assessments), and the absence of a universal opt‑out signal requirement, informing businesses’ practical implementation and industry benchmarking efforts.[1] (source)
  • — Industry commentary noting that TIPA’s opt‑out structure, limited scope to larger businesses, and AG‑only enforcement are influencing companies’ multi‑state privacy strategies, with many aligning Tennessee programs to existing Virginia/Colorado‑style frameworks to streamline compliance.[6] (source)
  • — Analysis from a regional law firm indicating that penalties up to $7,500 per violation (and triple for willful violations) are prompting impacted companies to invest in data mapping, privacy notice updates, and consumer request workflows, reflecting growing industry concern over enforcement exposure.[5] (source)
  • — Legal update stressing that TIPA’s affirmative defense tied to NIST‑conformant privacy programs is driving some organizations to adopt structured privacy frameworks, which practitioners see as both a compliance strategy and a way to mitigate litigation and enforcement risks across multiple jurisdictions.[7] (source)
  • — Tennessee Attorney General issues consumer guidance on the Tennessee Information Protection Act, outlining key rights (access, correction, deletion, portability, and opt‑out of targeted advertising/profiling/sale) and reminding businesses of upcoming obligations as the law’s main effective date of 2025-07-01 approaches[1]. (source)
  • — The AG clarifies that TIPA applies to businesses with over $25 million in annual revenue that meet specified consumer‑data processing thresholds, and highlights that data protection assessment requirements already apply to processing activities created on or after 2024-07-01, signaling increased regulatory scrutiny of high‑risk data uses[1]. (source)

Read the full guide to Tennessee Information Protection Act (TIPA)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates