Privacy Law Library

Tennessee Information Protection Act

TIPA

Comprehensive privacy · Children · Health · Genetic · Biometric · Location

Tennessee's comprehensive consumer privacy law gives residents rights to access, correct, delete, and port their personal information and to opt out of sale, targeted advertising, and significant-decision profiling. It applies only to businesses with more than $25 million in revenue that also meet a data-volume threshold, requires opt-in consent for sensitive data, and gives a unique affirmative defense to businesses whose written privacy program reasonably conforms to the NIST Privacy Framework.

Where
Tennessee
Citation
Tenn. Code Ann. §§ 47-18-3301 to 47-18-3315 (enacted as 2023 Tenn. Pub. Acts ch. 408, HB 1181/SB 73; amended 2025 Tenn. Pub. Acts ch. 201)
Status
In force
In force since
2025-07-01
Last amended
2025-07-01
Enforced by
Tennessee Attorney General and Reporter (exclusive authority)
People can sue
No
Penalties
After a 60-day written notice and cure period, the Attorney General may seek declaratory and injunctive relief, civil penalties up to $7,500 per violation, and fees and investigative costs; treble damages are available for willful or knowing violations.
Applies to
  • Persons that conduct business in Tennessee producing products or services that target Tennessee residents, that exceed $25 million in revenue, and that either control or process personal information of at least 175,000 consumers in a calendar year, or of at least 25,000 consumers while deriving more than 50% of gross revenue from selling personal information
  • Processors acting on behalf of covered controllers
  • Exempt: state and local government bodies, GLBA financial institutions and their affiliates, licensed insurers, HIPAA covered entities and business associates, nonprofits, institutions of higher education, and listed data types such as PHI and Title 68 health records

What a privacy notice must say

  • Provide a clear privacy notice listing categories of personal information processed, purposes, how to exercise and appeal rights, categories sold, and categories of third-party buyers; clearly disclose any sale or targeted advertising and how to opt out.Tenn. Code Ann. § 47-18-3305(c)-(d) (enacted as § 47-18-3204(c)-(d))

Rights it gives people

  • Consumers may confirm processing and access, correct, delete, obtain a portable copy, and opt out of sale, targeted advertising, and profiling for decisions with legal or similarly significant effects; a parent may act for a known child.Tenn. Code Ann. § 47-18-3304(a) (enacted as § 47-18-3203(a))

Practices it requires

  • Do not process sensitive data (for example health diagnosis, sexual orientation, immigration status, biometric or genetic data for identification, precise geolocation) without consent, or, for a known child, except as COPPA allows.Tenn. Code Ann. § 47-18-3305(a)(6) (enacted as § 47-18-3204(a)(6)); definition at § 47-18-3302
  • Provide secure and reliable request methods and do not require a consumer to create a new account to exercise rights.Tenn. Code Ann. § 47-18-3305(e) (enacted as § 47-18-3204(e))
  • Conduct and document data protection assessments for targeted advertising, sale, risky profiling, sensitive data, and other heightened-risk processing created or generated on or after July 1, 2024; produce them to the Attorney General on a civil investigative demand.Tenn. Code Ann. § 47-18-3307 (enacted as § 47-18-3206)
  • Do not discriminate against consumers for exercising rights, except for bona fide loyalty or rewards programs.Tenn. Code Ann. § 47-18-3305(a)(5) (enacted as § 47-18-3204(a)(5))
  • Respond to authenticated requests within 45 days (one 45-day extension with notice), free up to twice a year, and explain any refusal with appeal instructions.Tenn. Code Ann. § 47-18-3304(b) (enacted as § 47-18-3203(b))
  • Offer a conspicuous, free appeal process and answer appeals in writing within 60 days; if denied, tell the consumer how to complain to the Attorney General.Tenn. Code Ann. § 47-18-3304(c) (enacted as § 47-18-3203(c))
  • Limit collection to what is adequate, relevant, and reasonably necessary for disclosed purposes, and get consent for incompatible secondary uses.Tenn. Code Ann. § 47-18-3305(a)(1)-(2) (enacted as § 47-18-3204(a)(1)-(2))

Security duties

  • Maintain reasonable administrative, technical, and physical data security practices appropriate to the volume and nature of the data.Tenn. Code Ann. § 47-18-3305(a)(3) (enacted as § 47-18-3204(a)(3))

Other duties

  • The nonprofit-organization exemption covers nonprofits "organized or regulated" under Tennessee law (previously only those organized under Tennessee law).Tenn. Code Ann. § 47-18-3302(16)(C) (as amended by 2025 Tenn. Pub. Acts ch. 201) · From 2025-07-01
  • Controller-processor contracts must set processing instructions and require confidentiality, deletion or return of data, compliance information, assessments, and flow-down to subcontractors.Tenn. Code Ann. § 47-18-3306(b) (enacted as § 47-18-3205(b))
  • Affirmative defense for a controller or processor that maintains and complies with a written privacy program reasonably conforming to the NIST Privacy Framework (updated within two years of a new revision) and that provides the law's substantive rights.Tenn. Code Ann. § 47-18-3314 (enacted as § 47-18-3213)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Codified section numbers: the act was enacted as §§ 47-18-3201 to -3213 and codified in part 33 with a one-section offset (short title § 47-18-3301, definitions § 47-18-3302, confirmed by 2025 Pub. Ch. 201; NIST defense § 47-18-3314). The middle-section mapping and whether the preemption clause sits at § 47-18-3315 are inferred, because the official Lexis code was not loaded. | Some secondary sources say TIPA requires opt-in consent for targeted advertising or sale of teens' (13-17) data. Neither the enacted text (Pub. Ch. 408) nor the 2025 amendment contains such a rule; treat that claim as an error unless a 2026 amendment added it. The 2026 session was not exhaustively checked for TIPA amendments; HB 1132 (2025, a 45-to-50-day change) was taken off notice.

Research reference, not legal advice.