Tennessee Privacy Law (TIPA): Compliance Guide
The Tennessee Information Protection Act, effective July 1, 2025, sets the highest consumer-volume bar in the country — 175,000 Tennessee residents — alongside a $25 million revenue prong, making it one of the narrowest comprehensive state privacy laws. For-profit businesses that do clear the bar get a familiar, business-friendly framework: access, deletion, portability, and opt-out rights, with no universal opt-out signal mandate.
- Effective
- July 1, 2025
- GPC / universal opt-out
- Not required
- Required link text
- “Your Privacy Choices”
Last reviewed July 19, 2026 · Tennessee Information Protection Act (TIPA)
Applicability
Who must comply with the TIPA
The Tennessee Information Protection Act applies to businesses that meet the following criteria:
- For-profit businesses that meet at least one of the following:
- Annual revenue above $25 million
- Control or process the personal data of 175,000 or more Tennessee consumers
- Control or process the personal data of 25,000 or more Tennessee consumers and derive 50% or more of revenue from the sale of personal data
Consumer rights
What Tennessee consumers can demand
- Right to access personal data
- Right to delete personal data
- Right to data portability
- Right to opt out of targeted advertising and the sale of personal data
Opt-out mechanics
Tennessee opt-out & GPC requirements
Like every US state privacy law, the TIPA uses an opt-out model: you do not need a GDPR-style cookie banner, but you must provide a clear and conspicuous opt-out link. The accepted text for Tennessee is “Your Privacy Choices”.
Global Privacy Control: Not required
TIPA does not require honoring universal opt-out signals such as Global Privacy Control. The opt-out link remains the required mechanism.
Enforcement
TIPA penalties & enforcement
- Enforced by the Tennessee Attorney General
Cure period: Our reference lists no specific cure period for Tennessee; enforcement runs through the Tennessee Attorney General.
State quirks
What makes Tennessee different
Tennessee's defining choice was restraint. Its 175,000-consumer threshold is 75% higher than the 100,000 bar most states use, it applies only to for-profit businesses, and it skipped the GPC mandate that most 2025 laws adopted. The result is arguably the narrowest comprehensive law in the country — but businesses above the bar still owe Tennessee consumers a working opt-out for targeted advertising and data sales.
Highest consumer threshold in the country
175,000 Tennessee consumers — 75% higher than the 100,000 bar most states use.
For-profit only
The law applies only to for-profit businesses.
Automation
How ConsentKit handles Tennessee
- ConsentKit's widget is served from Cloudflare's edge and receives the visitor's US state server-side, so Tennessee visitors are identified before any consent UI renders — no client-side geo-lookup delay.
- Tennessee visitors see a persistent “Your Privacy Choices” link — the exact statutory text — available to new and returning visitors alike.
- Tennessee does not legally require honoring Global Privacy Control. ConsentKit applies automatic GPC honoring in the 12 states that mandate it; in Tennessee the opt-out link remains the visitor's control.
- Every opt-out is recorded server-side with a timestamp and jurisdiction metadata, reviewable and exportable (CSV) from the dashboard — the audit trail regulators ask for.
- Google Consent Mode v2 stays in sync: analytics and advertising tags update the moment a Tennessee visitor makes a choice.
Tennessee's high bar doesn't change the mechanics: the “Your Privacy Choices” link, instant opt-out enforcement, and a server-side record of every choice.
FAQ
Tennessee TIPA FAQ
Does TIPA apply to my business?
Only to for-profit businesses, and only above one of the highest bars in the country: annual revenue above $25 million, 175,000 or more Tennessee consumers, or 25,000 or more consumers with 50% or more of revenue coming from data sales.
Is Global Privacy Control required in Tennessee?
No. Tennessee declined to mandate universal opt-out signals. The “Your Privacy Choices” opt-out link remains the required mechanism for targeted advertising and sale opt-outs.
What rights do Tennessee consumers have?
Tennessee consumers can access and delete their personal data, obtain a portable copy of it, and opt out of targeted advertising and the sale of their personal data.
How is TIPA enforced?
Enforcement runs through the Tennessee Attorney General. Our reference lists no specific per-violation dollar figure or cure period for Tennessee.
This guide is for informational purposes and is not legal advice. Work with qualified counsel to confirm your obligations under the TIPA.
Comply with Tennessee's TIPA — and the other 19 state laws
ConsentKit detects each visitor's state at the Cloudflare edge, renders the exact opt-out link their law requires, honors GPC automatically where mandated, and records every choice for your audit trail.