What your business needs to know about TIPA Tennessee
The Tennessee Information Protection Act (TIPA), effective July 1, 2025, is a state data privacy law designed to protect Tennessee residents. It applies standards similar to other state laws and enforces privacy practices through compliance requirements, consumer rights, and penalties.
What does TIPA Tennessee compliance require?
To verify readiness for TIPA compliance, businesses need to:
Conduct an audit:
Perform a full audit of data collection and sharing practices and identify personal data collected and its purposes
Update privacy policy:
Review and update privacy and cookie policies with TIPA-specific disclosures.
Implement consent management:
Implement cookie consent banners and opt-out flows to automate consent capture and preference management
Ensure consumer rights:
Establish mechanisms to respond to consumer rights requests within 45 days
Perform Data Protection Assessments:
Safeguard privacy with regard to targeted advertising, data sales, profiling, or processing sensitive data.
Who needs to comply with TIPA Tennessee?
Compliance with TIPA is required for any forprofit business that:
Do business in Tennessee or targets Tennessee residents;
Have ≥$25 million in annual revenue;
And either processes data of ≥175,000 Tennesseans, or ≥25,000 while earning ≥50% of revenue from selling that data
Exemptions include:
Non-profits, state agencies, higher education institutions, HIPAA-covered entities, state licensed insurance companies, and GLBA-regulated financial institutions and data.
Consumer rights under TIPA Tennessee
Tennessee consumers are granted the:
Right to access
Consumers can access and confirm processing of personal data
Right to correct
Consumers can request to correct inaccuracies
Right to delete
Consumers can request that their personal data be deleted
Right to data portability
Consumers have a right to port/download/transmit their information in a usable format
Right to opt-out
Consumers can opt out of the sale of personal data, targeted advertising, and profiling that produces legal/significant effect
Right to know and confirm
Consumers can find out what third parties have received their data and confirm whether an entity is processing it
Controllers must respond to rights requests within 45 days (extendable another 45).
Why cookies as part of TIPA Tennessee compliance
Cookies that collect personal data (e.g., IP address, identifiers) require:
- Clear disclosure
- Implied optout for general data
- Explicit optin for sensitive data or children’s data
Strictly necessary cookies remain exempt.
Controls must also provide clear cookie notices and optout mechanisms to meet transparency and compliance obligations.
Penalties for TIPA Tennessee non-compliance
Enforcement lies with the Tennessee Attorney General. Violations carry:
A 60-day cure period before formal penalties
After curing, must submit a written statement of resolution
Noncured violations risk up to 7,500 USD per consumer per violation, with potential triple damages for willful breaches
Courts may also award injunctive relief and investigative costs
No private right of action under TIPA.
How to comply with TIPA Tennessee
TIPA compliance has specific actions associated, but you can also check that your approach to data privacy aligns with general best practices:
Audit:
Conduct a data audit to identify all cookies and trackers on their websites
Categorize:
Categorize cookies (e.g., necessary, preference, analytics, marketing)
Implement consent management:
Ensure consent banners are implemented correctly with granular choices, enable users to withdraw consent at any time, and maintain consent logs
Check third-party contracts:
Review third-party data-sharing practices
Frequently Asked Questions
It applies to for profit companies doing business in Tennessee targeting its residents, with ≥$25 million revenue and meeting consumer-data thresholds (≥175k total or ≥25k with ≥50% revenue from data sales).
Any data linked or reasonably linkable to an identified or identifiable person—name, IP, browsing history, geolocation, email, health app data—but not deidentified or publicly available data.
Includes racial/ethnic origin, religion, health, sexual orientation, citizenship, genetic/biometric data, precise geolocation, and data from known children.
The Tennessee Attorney General enforces TIPA, including issuing 60day cure notices, penalties, and legal actions.
Nonprofits, governmental/higheredu entities, HIPAA-covered persons, state-licensed insurers, and GLBA-regulated businesses/data are exempt.
Official Tennessee code (Title 47 Chapter 18 Part 32) can provide the full background for TIPA Tennessee.
Last updated:
Disclaimer: The information provided on this page is for general reference purposes only and is not intended to constitute legal or regulatory advice. Data privacy regulations are complex and subject to frequent updates, interpretations, and jurisdictional variations. While efforts are made to keep the material accurate and up to date, we cannot guarantee its completeness or applicability to your specific circumstances. For guidance on compliance or legal obligations, please consult qualified legal professionals or the appropriate regulatory authorities.
