If your business handles personal data from Tennessee residents, this article is for you.

The Tennessee Information Protection Act (TIPA) took effect on July 1, 2025. It is one of the most detailed state privacy laws in the United States, with some features that set it apart from every other state-level regulation currently in force.

This guide covers everything you need to know: who must comply, what the key definitions mean, how consumer rights work, what cookies have to do with all of this, and how to prepare your business for compliance without losing your mind.

TIPA was enacted in May 2023 and took effect on July 1, 2025. Businesses had over two years to prepare.

The Tennessee Information Protection Act (Tenn. Code Ann. § 47-18-3201 et seq.) is a state data privacy law that gives Tennessee residents specific rights over their personal data and imposes clear obligations on businesses that collect and process it.

Think of it as the rules of the road for how companies handle personal information in Tennessee. If you drive in their state, you follow their rules. If you handle data from their residents, you follow TIPA.

TIPA applies to entities that conduct business in Tennessee or produce products or services targeted at Tennessee residents, with annual gross revenue exceeding $25 million, and that during a calendar year meet at least one of the following criteria:

Control or process personal data of at least 175,000 consumers, or

Control or process personal data of at least 25,000 consumers and derive more than 50% of gross revenue from the sale of personal data.

Both conditions must be present: the revenue threshold and at least one of the consumer volume thresholds. This combined filter means smaller businesses with high revenue from data sales are still covered, and large data processors with lower revenue may fall outside the scope.

Several categories of entities and types of data are exempt from TIPA:

State agencies and political subdivisions.

Financial institutions governed by the Gramm-Leach-Bliley Act.

Insurance companies, which is a notable distinction from most other state privacy laws.

Entities governed by HIPAA and HITECH.

Nonprofit organizations.

Institutions of higher education.

De-identified data is explicitly excluded from the definition of personal data under TIPA.

Data processed for journalistic, academic, or literary purposes may also be exempt, recognizing the balance between privacy and freedom of expression.

Any data that can be used on its own or in combination with other data to identify, contact, or locate a person. This includes names, email addresses, phone numbers, IP addresses, and other digital identifiers. The definition is intentionally broad to ensure any information that can trace back to an individual is covered.

A natural person who is a resident of Tennessee acting only in an individual or household context. This definition explicitly excludes individuals acting in a commercial or employment context, which affects how businesses filter incoming requests.

Consent under TIPA must be a clear affirmative act. It cannot be assumed or implied. A user must take a deliberate and unambiguous action, such as clicking an "I agree" button, to indicate they agree to their data being processed. Pre-checked boxes and passive browsing do not qualify.

Sensitive data refers to a specific category of personal information that requires heightened protection due to the risk of harm if misused. Under TIPA, this includes:

Racial or ethnic origin, religious beliefs, mental or physical health diagnoses, sexual orientation or sex life, citizenship or immigration status.

Genetic or biometric data processed to uniquely identify an individual.

Precise geolocation data.

Personal data of a known child under 13.

Financial information, social security numbers, and similar high-risk identifiers.

The main decision-maker regarding personal data. The controller determines the purpose and means of processing. If your company decides what to do with the data it collects, it is a controller under TIPA. This role carries the primary compliance responsibilities.

Any person or entity that processes personal data on behalf of a controller, following their instructions. Processors do not make decisions about how the data is used. A contract between the controller and processor must explicitly define the processor's obligations.

The transfer of personal information to a third party for monetary or other valuable consideration. This definition directly affects businesses that share data with advertising partners, data brokers, or other commercial parties.

Displaying ads customized based on personal data derived from an individual's activities over time and across non-affiliated websites or applications. TIPA requires informed consent for this type of processing and gives consumers the right to opt out of it.

Cookies are small text files placed on a user's device when they visit a website. They power everything from session memory and login persistence to behavioral tracking and personalized advertising.

Under TIPA, cookies that store personal information or enable user identification must be handled with care. Businesses must inform users about the cookies they use and obtain consent before placing non-essential cookies on a visitor's device.

A Consent Management Platform (CMP) is the practical tool for managing this. It displays a cookie notice to visitors, collects and records their preferences, and ensures that no non-essential cookies or trackers are loaded before consent is given.

TIPA also requires businesses to honor the Global Privacy Control (GPC) signal. If a visitor arrives at your site with GPC enabled in their browser, your system must recognize that signal and automatically apply it as an opt-out for targeted advertising and data sales. This is handled at the cookie notice and CMP level.

TIPA grants Tennessee consumers five core rights over their personal data. Any formal request to exercise one of these rights is called a DSAR, or Data Subject Access Request.

Right to confirm and access: Consumers can ask whether a business is processing their data and request a copy of it.

Right to correct: Consumers can request the correction of inaccurate or outdated personal data.

Right to delete: Consumers can request the deletion of personal data provided by them or collected about them, with certain exceptions for legally mandated retention.

Right to data portability: Consumers can request their data in a portable, machine-readable format that allows transfer to another service provider.

Right to opt out: Consumers can opt out of the processing of their data for targeted advertising, the sale of their personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects.

Controllers must respond to authenticated consumer requests within 45 days. This deadline can be extended once by an additional 45 days when reasonably necessary, with written notice to the consumer within the initial period. For appeals of denied requests, the response window is 60 days.

Responses must be provided free of charge at least twice annually per consumer.

If a controller denies a request, the consumer has the right to appeal that decision. The appeal process must be conspicuously available and functionally similar to the original request submission process. If the appeal is denied, the business must provide information on how the consumer can contact the Tennessee Attorney General to file a complaint.

TIPA prohibits businesses from discriminating against consumers who exercise their privacy rights. A business cannot deny goods or services, charge different prices, or provide a lower quality of service to consumers who choose not to share their data or who exercise their TIPA rights.

This is arguably the most distinctive feature of TIPA among all US state privacy laws currently in force.

TIPA allows a business to raise an affirmative defense in an enforcement action if it can demonstrate that it maintains and implements a comprehensive privacy program that reasonably conforms to the NIST Privacy Framework or the ISO 27701 standard.

This is not an exemption from liability. It is a documented risk reduction mechanism. A business with a well-documented, framework-aligned compliance program significantly reduces its regulatory exposure, even if a violation is alleged.

This incentivizes businesses to invest in structured privacy by design practices and maintain documentation that can be presented as evidence of proactive compliance.

Data collected under TIPA can only be used for the specific, explicit, and legitimate purposes for which it was collected. Further processing that is incompatible with those original purposes is prohibited without additional consent.

Controllers must limit the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the disclosed purposes of processing. Collecting data "just in case" is not compliant.

TIPA requires businesses to implement appropriate technical and organizational security measures to protect personal data against unauthorized access, accidental loss, or unlawful processing. The level of security must be proportional to the volume and sensitivity of the data involved.

Controllers must conduct a Data Protection Assessment before initiating processing activities that present a heightened risk to consumers. This includes processing for targeted advertising, selling personal data, using profiling for significant decisions, and processing sensitive data.

These assessments must identify and weigh the benefits of the processing against the potential risks to consumer rights, and document the safeguards the business will implement to mitigate those risks.

Businesses must provide clear and accessible information about how they process personal data, typically through a privacy policy that is easy to understand and readily available.

When businesses outsource data processing to third parties, binding contracts must define the processor's obligations, the nature and purpose of processing, the types of data involved, and the duration of the arrangement. Understanding the difference between controllers and processors is fundamental to structuring these contracts correctly.

Processing sensitive data requires explicit consent from the consumer before any processing begins. This cannot be bundled with general terms of service or implied through passive behavior.

For data involving known children under 13, additional protections apply, aligned with the federal Children's Online Privacy Protection Act (COPPA).

Managing cookie consent effectively under TIPA involves three things working together:

First, an informed and affirmative consent from users before any non-essential cookies are placed on their device.

Second, clear and accessible information about what cookies are in use, what categories they belong to, and what purposes they serve. Proper tag categorization is what makes this information accurate.

Third, an easy mechanism for users to withdraw consent at any time, as simple as the mechanism used to give it.

A CMP like AdOpt handles all three automatically. It scans the site for active trackers, presents a compliant cookie notice, manages consent preferences, blocks non-consented trackers before they fire, and documents each consent for audit purposes.

Start by understanding what personal data your business collects, where it lives, how it is used, and with whom it is shared. A proper data mapping process is the foundation of every other compliance step.

Your privacy policy must reflect the realities of your data processing. It needs to inform consumers about the categories of data collected, the purposes for processing, how they can exercise their rights, and how long data is retained. Your cookie policy must be specific about each category of tracker and its purpose.

Establish a clear and accessible mechanism for consumers to submit DSARs, track deadlines, and manage responses. A data processing registry makes it operationally possible to respond accurately and within the 45-day window.

Your marketing, legal, and technology teams need to understand what TIPA requires and how their daily processes interact with those requirements. Reviewing high-risk marketing practices is a good starting point.

A CMP is not optional under TIPA. If your site uses any non-essential cookies or trackers, you need a system that collects, records, and enforces user consent. AdOpt handles this automatically, including GPC signal compliance.

To be able to invoke the TIPA affirmative defense, the business needs a documented privacy compliance program aligned to the NIST Privacy Framework or ISO 27701. This means policies, procedures, risk assessments, and ongoing monitoring, not just a privacy policy page.

The Tennessee Attorney General has exclusive authority to enforce TIPA. There is no private right of action.

Before filing an action, the Attorney General must provide written notice of the violation and give the business a 30-day cure period. If the business cures the violation and provides written documentation within that window, no action can be filed for that specific violation.

If the business fails to cure, or if the violation is found to be willful, civil penalties (in Portuguese) can reach up to $7,500 per violation, plus attorney's fees and investigative costs.

The penalty is calculated per violation, not per case. A broken consent system affecting thousands of Tennessee consumers can generate thousands of individual violations.

TIPA stands out from this group in three ways. The combined revenue-plus-volume threshold filters out smaller operators more precisely than laws with no revenue requirement. The explicit inclusion of insurance companies in the entity-level exemptions is unique. And the affirmative defense mechanism tied to recognized international frameworks like NIST and ISO 27701 exists nowhere else in this list.

When compared to the LGPD in Brazil and the GDPR in Europe, TIPA follows the same structural logic: consumer rights, controller obligations, consent requirements, and enforcement with meaningful penalties. The differences are in the thresholds, the specific rights, and the enforcement mechanisms.

AdOpt is the infrastructure that makes compliance operational, not just theoretical.

The automatic site scan identifies every active tracker. The cookie notice collects and records consumer preferences. The platform blocks non-consented trackers before they fire. Every interaction is logged as a consent record that supports your DSAR responses and your affirmative defense documentation.

When a consumer opts out of targeted advertising, the consent management platform propagates that opt-out in real time across all relevant tools. And when the law changes, the platform updates to maintain compliance automatically.

Over 60,000 sites operate with AdOpt. From free plans to enterprise-level operations with global audiences.

Privacy is not a banner. It is a position.

Ready to build a TIPA-compliant data infrastructure? Talk to our team.

Compliance with the TIPA rests on three documents that have to agree with each other: the cookies policy, which declares every tracker and its purpose; the privacy policy, which explains what you do with the data; and the privacy portal, where the consumer exercises their rights and you keep the record of it.

What is TIPA?
The Tennessee Information Protection Act is a state data privacy law that took effect on July 1, 2025. It gives Tennessee consumers rights over their personal data and imposes compliance obligations on businesses that process it.

When does TIPA take effect?
July 1, 2025.

Who must comply with TIPA?
Businesses with annual gross revenue exceeding $25 million that conduct business in Tennessee or target Tennessee residents, and that process data of at least 175,000 consumers or at least 25,000 consumers while deriving more than 50% of gross revenue from data sales.

What rights do consumers have under TIPA?
The right to confirm and access their data, correct inaccuracies, request deletion, obtain a portable copy, and opt out of targeted advertising, data sales, and certain profiling activities.

What is the affirmative defense under TIPA?
A business can raise an affirmative defense in an enforcement action by demonstrating it maintains a comprehensive privacy program aligned with the NIST Privacy Framework or ISO 27701.

What are the penalties for non-compliance?
Up to $7,500 per violation, plus attorney's fees and costs, enforced exclusively by the Tennessee Attorney General. There is no private right of action.

How does TIPA handle cookies?
Cookies that store personal information or enable user identification require informed consent before being placed on a device, except for strictly necessary cookies. The Global Privacy Control signal must also be recognized and honored.

What is sensitive data under TIPA?
Racial or ethnic origin, health and mental health data, sexual orientation, genetic and biometric data, precise geolocation, immigration status, financial identifiers, and personal data of known children under 13.

How does TIPA define consent?
A clear, affirmative, specific, informed, and unambiguous act by the consumer. Implied consent and pre-checked boxes do not qualify.

How does the cure period work?
The Tennessee Attorney General must give the business 30 days written notice before filing an enforcement action. If the violation is cured and documented within that window, no action can be filed for that specific violation.

How does TIPA handle data of minors?
Controllers offering online services to consumers they know or reasonably should know are under 13 must take reasonable care to avoid creating heightened risks of harm to those minors.

How does TIPA compare to other state privacy laws?
TIPA shares the basic structure of CCPA, VCDPA, and TDPSA, but distinguishes itself through the combined revenue and volume threshold, the explicit insurance company exemption, and the unique affirmative defense mechanism tied to recognized compliance frameworks. Learn more in our global privacy law comparison.