Tennessee Information Protection Act (TIPA)

The Tennessee Information Protection Act (TIPA) was signed into law on May 11, 2023, and takes effect on July 1, 2025. Tennessee joins the growing number of US states enacting comprehensive consumer data privacy legislation.

What Is the TIPA?

The TIPA grants Tennessee residents rights over their personal data and places obligations on businesses that collect or process that data. The law follows the opt-out model for general personal data and requires opt-in consent before processing sensitive data. A notable feature is its safe harbor provision for businesses that maintain a privacy program aligned with the NIST Privacy Framework.

Who Does the TIPA Apply To?

The TIPA applies to businesses that conduct business in Tennessee or produce products or services targeted to Tennessee residents, and that during the prior calendar year had annual revenue of at least $25 million, and either:

• Controlled or processed the personal data of at least 175,000 consumers; or
• Controlled or processed the personal data of at least 25,000 consumers and derived more than 50% of gross revenue from the sale of personal data.

Consumer Rights Under the TIPA

Tennessee residents are entitled to:

• Right to access: confirm whether a business processes their personal data and request a copy
• Right to correction: request correction of inaccurate personal data
• Right to deletion: request deletion of their personal data
• Right to data portability: obtain a portable copy of their personal data
• Right to opt out: opt out of targeted advertising, sale of personal data, and profiling for significant decisions
• Right to appeal: appeal a business's denial of a rights request

Businesses must respond to verified consumer requests within 45 days, extendable by an additional 45 days when reasonably necessary.

Sensitive Data

Processing sensitive data requires opt-in consent from consumers. Sensitive data under the TIPA includes racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data processed to uniquely identify an individual, precise geolocation data, and personal data of known children.

NIST Privacy Framework Safe Harbor

A unique feature of the TIPA is its safe harbor provision. Businesses that create, maintain, and comply with a written privacy program that reasonably conforms to the NIST Privacy Framework are entitled to an affirmative defense against claims of violations. This incentivizes businesses to adopt recognized privacy best practices.

Enforcement

The Tennessee Attorney General enforces the TIPA. There is no private right of action. Businesses have a 60-day cure period upon receiving notice of a violation. Civil penalties of up to $7,500 per violation may be imposed. For willful or knowing violations, treble damages (three times the civil penalty) may be awarded.

How UniConsent Supports TIPA Compliance

UniConsent provides the tools businesses need to meet TIPA requirements:

• Opt-out and opt-in consent banners configurable by state
• Global Privacy Control (GPC) signal recognition
• Consumer rights request management
• Sensitive data consent workflows
• Integration with websites, mobile apps, and tag managers

Get started with UniConsent or explore our features.

Other US State Privacy Laws

• CCPA: California Consumer Privacy Act, learn more at CCPA
• CPRA: California Privacy Rights Act, learn more at CPRA
• CPA: Colorado Privacy Act, learn more at CPA
• VCDPA: Virginia Consumer Data Protection Act, learn more at VCDPA
• UCPA: Utah Consumer Privacy Act, learn more at UCPA
• CTDPA: Connecticut Data Protection Act, learn more at CTDPA
• TDPSA: Texas Data Privacy and Security Act, learn more at TDPSA
• DPDPA: Delaware Personal Data Privacy Act, learn more at DPDPA
• NHPA: New Hampshire Privacy Act, learn more at NHPA
• MTCDPA: Montana Consumer Data Privacy Act, learn more at MTCDPA
• FDBR: Florida Digital Bill of Rights, learn more at FDBR
• NJDPA: New Jersey Data Protection Act, learn more at NJDPA
• INCDPA: Indiana Consumer Data Protection Act, learn more at INCDPA
• ICDPA: Iowa Consumer Data Protection Act, learn more at ICDPA
• MODPA: Maryland Online Data Privacy Act, learn more at MODPA
• MNCDPA: Minnesota Consumer Data Privacy Act, learn more at MNCDPA
• NDPA: Nebraska Data Privacy Act, learn more at NDPA
• OCPA: Oregon Consumer Privacy Act, learn more at OCPA
• RIDTPPA: Rhode Island Data Transparency and Privacy Protection Act, learn more at RIDTPPA

Compare different US State Privacy Laws