Open workspace

Guide · US state law

TIPA: Tennessee's privacy law without the legalese

The Tennessee Information Protection Act has been in force since July 1, 2025 and reaches only large businesses. In this guide you will understand who must comply, what rights visitors gained, how the NIST-based defense works and what changes for a site with AdSense or Ad Manager.

Audit my site for the USRead the guide
  • ✓Based on the text of the law and the Tennessee attorney general's summary
  • ✓Practical examples for sites with ads
  • ✓Read-only scan, no changes to the site
$25Min annual revenue: below that, the business is outside the law
175,000Tennessee consumers per year: the main volume threshold
60 daysto cure after the attorney general's notice, with no end date
45 daysto respond to consumer requests, with an explanation and appeal when denied

What it is

A state privacy law focused on large businesses

The TIPA is the general privacy law of the state of Tennessee, in the United States. It was passed in 2023 and took effect on July 1, 2025. The law gives residents of the state rights over their data and creates duties for the businesses that use that data.

The model follows the laws of Virginia and Colorado. The visitor can ask for access, correction and deletion of data and can refuse the sale of data, targeted advertising and certain types of automated profiling. Sensitive data can only be used with consent.

Two things make the TIPA different. The first is the high threshold: only businesses with annual revenue above $25 million come under the law. The second is the NIST-based defense: a business that maintains a written privacy program aligned with the NIST Privacy Framework can use that as a defense in a lawsuit.

For the owner of a Brazilian site with visitors in the United States, the practical question is simple: does your business pass the thresholds? If it does, the site needs a full privacy notice, a clear path to opt out and care about what ad partners do with the data.

Checklist

What you need to meet

If your company exceeds the TIPA thresholds, these points need to be working.

  1. Path to opt out of sale and ads

    Tennessee residents can opt out of targeted advertising, the sale of data and certain profiling. The site must offer this path and make the opt-out change the ad request.

    Example

    Google's state regulations message shows the Do Not Sell or Share My Personal Information link to Tennessee visitors.

    <!-- AdSense: anúncio sem dados de comportamento -->
<ins class="adsbygoogle" ...
     data-restrict-data-processing="1"></ins>

// GPT (Ad Manager)
googletag.pubads().setPrivacySettings({
  'restrictDataProcessing': true
});

  2. Accessible privacy notice

    The company needs a reasonably accessible privacy notice. It explains how the visitor exercises rights and how to appeal a negative response.

    Example

    A Privacy link in the footer of every page, leading to the full notice.

  3. Policy with the sentences Google requires

    AdSense requires the privacy policy to warn about the ad cookies of Google and other vendors. It must also say how the visitor opts out of personalized ads.

    Example

    Third-party vendors, including Google, use cookies to serve ads based on a user's previous visits to your website or other websites. You can opt out of personalized advertising in Google's Ads Settings.

  4. Response within 45 days

    Access, correction, deletion, portability and opt-out requests need a response within 45 days of receipt.

    Example

    A privacy email with tracking of the arrival date of each request.

  5. Consent for sensitive data

    Sensitive data can only be processed with the visitor's consent.

    Example

    A health site asks before using the topic read to choose ads: Do you accept? Yes or No.

In practice

Right and wrong

Official tools

Certified CMPs and official links

Google does not require a certified CMP or GPP for Tennessee, so you can use Google's own message or a CMP with GPP.

Who must comply

The thresholds that bring a business under the TIPA

The law applies to anyone who does business in Tennessee or offers products and services targeted to residents of the state. But only if the business passes the two filters below.

Revenue above $25 million

This is the first filter and it is mandatory. A business with annual revenue below that is outside the TIPA, even if it has many Tennessee visitors.

175,000 consumers

Besides revenue, the business must control or process data of at least 175,000 Tennessee consumers in a calendar year.

Or 25,000 and data sales

The other way in: data of at least 25,000 consumers and half or more of gross revenue coming from selling personal information.

Who is left out

Public agencies, financial institutions, health entities covered by HIPAA, nonprofits and higher education institutions are exempt.

Definitions

The words of the law, in plain site-owner language

The TIPA uses the term personal information instead of personal data. The meaning is the same as in other state laws, with one important difference in the definition of sale.

Personal information

Any information linked, or that can be linked, to an identified or identifiable person. In a site's day-to-day, this includes cookies, ad identifiers, IP address and newsletter email.

Sensitive information

Racial or ethnic origin, religious belief, health diagnosis, sexual orientation, immigration status, genetic and biometric data, children's data and precise geolocation, within a 1,750-foot radius.

Sale

Under the TIPA, sale is the exchange of personal information for money with a third party. The law does not mention other valuable consideration, as states such as Delaware and Montana do.

Targeted advertising

An ad chosen based on the visitor's behavior over time on other companies' sites and apps. An ad based on the context of the page does not fall under this definition.

People's rights

What a Tennessee resident can ask your site for

Requests must be answered within 45 days. If the business refuses, it must explain the reason and offer an appeal path.

Confirm and access

Find out whether the business processes their data and receive access to that data.

Fix

Ask for wrong data to be corrected, taking into account the type of data and the purpose of the use.

Delete

Ask for the data they provided or that was obtained about them to be deleted. Aggregated or de-identified data is left out.

Portability

Receive a copy of the data in a format that can be taken to another service, when technically possible.

Refuse targeted ads and sale

Ask that the data not be used for targeted advertising and not be sold. This is the right that affects sites with ads the most.

Refuse automated profiling

Refuse the use of data in profiling that leads to decisions with legal or similarly significant effects, such as credit, housing or employment.

Site obligations

What a covered business must have working

  1. Full privacy noticeThe notice must say what the data is used for, which categories are processed, which categories are sold to third parties, how to exercise rights and how to appeal a denial. It must also explain the right to opt out of sale.
  2. Collect only what is neededCollection must be limited to what is reasonably necessary for the purposes disclosed. Using the data for another purpose requires consent.
  3. Consent for sensitive dataSensitive data can only be processed with consent. Data of children under 13 follows the rules of the federal COPPA law.
  4. Data protection assessmentBefore using data for targeted advertising, sale, risky profiling or sensitive data, the business must record a risk and benefit assessment. The rule applies to activities created or generated from July 1, 2024.
  5. Contracts with processorsVendors that process data on the business's behalf need a written contract covering confidentiality, return or deletion of data, help with assessments and the same rules for subcontractors.
  6. Reasonable securityThe business must maintain security practices suited to the volume and sensitivity of the data, and cannot process data in a way that violates anti-discrimination laws.

Enforcement and the NIST defense

Who enforces it, the cure period and the program that can serve as a defense

Only the Tennessee attorney general can enforce the TIPA, and consumers cannot sue the business under this law. Before filing an action, the attorney general must send written notice and give the business 60 days to fix the problem. If the business fixes it and reports so in writing, the case stops, unless the violation repeats. Unlike in other states, this period has no end date.

If the violation is not fixed in time, the attorney general can take the case to court and seek the civil penalties set out in the law. The attorney general can act on his own investigations or on consumer complaints, which can be sent through the website, by email or by mail. The exact fine amounts are in the text of the law, and it is worth checking them with a lawyer.

The TIPA also has an affirmative defense. A business that maintains and follows a written privacy program, reasonably in line with the NIST Privacy Framework, the US standards and technology institute, or a comparable model, can use that as a defense. The program must give consumers the rights in the law and be updated within two years of each new version of the framework. Global CBPR certification can also be taken into account.

A document in a drawer is not enough. The size of the program is measured by the size of the business, the type of activity and the sensitivity of the data. For people who live off ads, documenting which data the site collects, which partners receive that data and how the opt-out works is already the start of that program.

Timeline

TIPA dates

The law had a long adjustment period. As of November 2026, it has been in force for over a year.

  1. 2023

    Law passed

    Tennessee passes the Tennessee Information Protection Act and joins the list of states with a general privacy law.

  2. July 1, 2024

    Assessment milestone

    Processing activities created or generated from this date fall under the data protection assessment rule. Earlier activities are not reached.

  3. July 1, 2025

    Entry into force

    The TIPA takes effect. Covered businesses must answer requests, offer opt-out and maintain the full privacy notice.

  4. 2025

    Attorney general materials

    The attorney general publishes a summary of the law, frequently asked questions for consumers and businesses and a channel for privacy complaints.

Sites with AdSense and Ad Manager

How the Tennessee opt-out reaches Google

The TIPA does not require a business to recognize universal opt-out signals, such as the Global Privacy Control, or GPC, sent by some browsers. The visitor must use the path the site offers. Even so, honoring the GPC is good practice and avoids problems with states where it is mandatory.

Google offers a US state regulations message in AdSense and Ad Manager, in the Privacy & messaging area. It includes Tennessee among the states covered and shows the Do Not Sell or Share link. When the visitor opts out, Google turns on restricted data processing, called RDP, and starts delivering ads that do not use behavior history.

Anyone using their own CMP can pass the choice through the GPP, the IAB Tech Lab protocol. There is a specific Tennessee section in the GPP, but Google's list of accepted sections does not include it. For Google, the path is the US National section: an opt-out of sale, sharing or targeted advertising in that section turns on RDP.

It is also possible to turn on RDP directly in the tag, with the restrictDataProcessing parameter in GPT or the data-restrict-data-processing attribute in AdSense, only for people who asked to opt out. What matters is that the visitor's opt-out really changes the ad request.

In practice

What is and is not allowed with the TIPA

Examples for a business that passes the law's thresholds and monetizes sites with programmatic ads.

Allowed

  • Show contextual ads, chosen by the subject of the page, to people who opted out
  • Use Google's state regulations message to offer the Do Not Sell or Share link
  • Keep a single privacy notice for all states, as long as it covers what the TIPA asks for
  • Reuse risk assessments made for other state laws, if they are comparable
  • Use the NIST-based privacy program as a defense, if it is written and up to date

Not allowed

  • Keep sending data for personalized ads after the visitor opted out
  • Collect precise geolocation for ads without consent
  • Leave the privacy page without saying how to appeal a denied request
  • Require the visitor to create an account to request deletion or opt-out
  • Treat NIST as a badge: without a program actually followed, there is no defense

Common errors

Where sites trip up with the TIPA

These problems show up often on sites that already take care of the GDPR and California, but forget Tennessee.

Message only for California

The opt-out message was set up years ago only for California. Tennessee visitors never see the link.

A link that does nothing

The footer has the opt-out link, but it leads to a text page. The ad request stays the same after the click.

Notice without sale and ads

The privacy policy talks about cookies, but does not say that data is used for targeted advertising or how to opt out.

GPP without the US National section

The CMP generates only state sections that Google does not read. The opt-out exists, but does not reach Google ads.

Assessment never done

The business has used data for targeted ads since 2024, but has no data protection assessment recorded.

Thinking you are too small

The group adds up several sites and passes $25 million in revenue, but each site is treated as if it were outside the law.

In ConsentMode

What the audit checks for Tennessee

  • Opens the site as a visitor from the United States and looks for the opt-out link in the footer, the menu and the privacy message.
  • Identifies the CMP or Google's message from the page code.
  • Reads the GPP string in the ad requests and checks that the US National section exists and changes after the opt-out.
  • Turns on the GPC signal in the audit browser and shows whether the behavior of the page and the ad requests changes.
  • Checks that the privacy page mentions sale, targeted advertising, rights, appeal and a way to contact.
Run an auditSee everything that is checked

Frequently asked questions

My Brazilian site has Tennessee visitors. Do I have to comply with the TIPA?

Only if your business passes the thresholds: annual revenue above $25 million and data of at least 175,000 consumers in the state, or 25,000 consumers with half or more of revenue coming from selling data. Most small sites are outside it. Even so, states with lower thresholds, such as Delaware, Maryland and Nebraska, may reach your business, so it is worth offering the opt-out for all US traffic.

Does the TIPA require honoring the GPC?

No. The law does not require recognizing universal opt-out signals. But several other states do, so most CMPs already handle the GPC for all US traffic.

What happens to revenue when the visitor opts out?

Google uses restricted data processing and delivers ads that do not use the visitor's history. Revenue per thousand impressions is usually lower for this audience, but the ad still appears.

Does the TIPA require a cookie banner?

No. The law works on an opt-out model: the site can use data for ads until the visitor opts out. The exception is sensitive data, which requires prior consent.

Do I need a NIST program to comply with the law?

No. The NIST-based program is an optional defense. It helps if there is an investigation, but the business must comply with the law either way.

Does ConsentMode settle TIPA compliance?

ConsentMode is not a law firm or a CMP. The audit shows what the site actually does with the opt-out, the GPP and the privacy page, so you can fix it with your vendor and your lawyer.

Library

Official sources

This guide was written from these official pages. Read them directly at the source:

See whether your site's opt-out reaches the ads

The audit opens the site as a US visitor and shows what to fix, without changing anything.

Start the audit