Tennessee (US)
Full entry AI-checked Checked 5 November 2026
Read this together with United States (federal), which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| Tennessee Information Protection Act | Tenn. Code Ann. 47-18-3201 to 47-18-3213 (Pub. Ch. 408, 2023, HB 1181) | In force | 1 July 2025 |
| Release of personal consumer information (breach notice) | Tenn. Code Ann. 47-18-2107 (Pub. Ch. 473, 2005; amended by Pub. Ch. 692, 2016, and Pub. Ch. 91, 2017) | In force | 1 July 2005 |
| Protecting Children from Social Media Act | Tenn. Code Ann. 47-18-5701 to 47-18-5706 (Pub. Ch. 899, 2024, HB 1891) | In force | 1 January 2025 |
| AI systems presented as mental health professionals | Tenn. Code Ann. 33-1-205 (Pub. Ch. 647, 2026, SB 1580) | In force | 1 July 2026 |
| Ensuring Likeness, Voice, and Image Security (ELVIS) Act of 2024 | Tenn. Code Ann. 47-25-1101 et seq. (Pub. Ch. 588, 2024, HB 2091) | In force | 1 July 2024 |
- Tennessee Information Protection Act: The enacted text is House Amendment 1 (HA0348), which replaced the bill. Pub. Ch. 201 (2025) widened the non-profit exemption to public utilities regulated in Tennessee.
- Protecting Children from Social Media Act: Challenged in NetChoice v. Skrmetti (M.D. Tenn. No. 3:24-cv-01191). On 28 August 2026 the Sixth Circuit vacated the denial of a preliminary injunction and sent the case back. On 27 October 2026 the district court denied the old motion as moot and invited a renewed one; no injunction was in place.
- Ensuring Likeness, Voice, and Image Security (ELVIS) Act of 2024: Makes a person’s voice a protected property right, including simulated voices, and covers tools made to copy a specific person’s voice or likeness.
Regulators
Section titled “Regulators”What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”Applies to businesses in Tennessee whose products or services target its residents, that earn over $25 million in revenue, and either process data of 175,000+ consumers in a calendar year or of 25,000+ while earning over half of gross revenue from selling personal information. Non-profits, colleges, government, licensed insurers, GLBA financial institutions and HIPAA-regulated bodies are exempt. Employees and B2B contacts aren’t consumers.
Sources: capitol.tn.gov/Bills/113/Amend/HA0348.pdf · wapp.capitol.tn.gov/apps/BillInfo/Default.aspx
Lawful bases
Section titled “Lawful bases”No GDPR-style lawful bases. Controllers give a privacy notice and honour rights to access, correct, delete and port data and to opt out of sale, targeted advertising and profiling for significant decisions, within 45 days (extendable once by 45). Sensitive data needs opt-in consent, and collection must be limited to what’s reasonably necessary for the disclosed purposes.
Sources: capitol.tn.gov/Bills/113/Amend/HA0348.pdf
Consent age for online services
Section titled “Consent age for online services”A child is under 13. A known child’s sensitive data must be processed as COPPA requires, and a parent or guardian exercises the child’s rights. TIPA has no teen rule, but the social media act needs verified parental consent for any account holder under 18.
Sources: capitol.tn.gov/Bills/113/Amend/HA0348.pdf · capitol.tn.gov/Bills/113/Amend/SA0929.pdf
Children
Section titled “Children”Since 1 January 2025, social media companies must verify the age of anyone opening an account, need verified parental consent before a minor under 18 opens one, and must give parents tools to see privacy settings, set time limits and enforce breaks. They must not keep the identifying data used for checks. The AG enforces with Consumer Protection Act penalties. NetChoice’s federal challenge continues (see laws); as of 27 October 2026 no court order blocked the Act.
Sources: capitol.tn.gov/Bills/113/Amend/HA0668.pdf · capitol.tn.gov/Bills/113/Amend/SA0929.pdf · wapp.capitol.tn.gov/apps/BillInfo/Default.aspx · opn.ca6.uscourts.gov/opinions.pdf/26a0250p-06.pdf · govinfo.gov/content/pkg/USCOURTS-tnmd-3_24-cv-01191/pdf/USCOURTS-tnmd…
Cookies and similar technologies
Section titled “Cookies and similar technologies”No cookie-consent rule. A controller that sells personal information or uses it for targeted advertising must say so clearly and explain how to opt out. TIPA doesn’t require honouring a universal opt-out signal such as Global Privacy Control; 2025–2026 bills to add one did not pass.
Sources: capitol.tn.gov/Bills/113/Amend/HA0348.pdf · wapp.capitol.tn.gov/apps/Indexes/BillsBySubject
Electronic marketing
Section titled “Electronic marketing”Telephone solicitors must not call or text numbers on the Tennessee Public Utility Commission’s Do-Not-Call/Do-Not-Text register, which covers home and mobile numbers, unless an exemption applies, such as express permission or a business relationship in the past 12 months. The Commission handles solicitor applications. Federal CAN-SPAM and the TCPA apply too.
Sources: tn.gov/tpuc/services/tennessee-do-not-call-program.html
Breach notification
Section titled “Breach notification”Notify affected Tennessee residents immediately, and no later than 45 days after discovering the breach or being told of it, unless law enforcement needs a delay. A business holding data for another must tell the owner within the same limit. If more than 1,000 people are notified at once, also tell the national consumer reporting agencies. There’s no duty to notify the Attorney General. Encrypted data is covered only if the key was also taken. GLBA- and HIPAA-regulated entities are exempt.
Sources: capitol.tn.gov/Bills/109/Amend/HA0750.pdf · wapp.capitol.tn.gov/apps/BillInfo/Default.aspx · wapp.capitol.tn.gov/apps/BillInfo/Default.aspx · capitol.tn.gov/Bills/110/Bill/SB0547.pdf · capitol.tn.gov/Bills/104/Amend/HA0424.pdf · wapp.capitol.tn.gov/apps/BillInfo/Default.aspx
Registration and fees
Section titled “Registration and fees”TIPA has no registration or fee, and we found no Tennessee data broker registry. A 2025–2026 bill to make controllers register with the Attorney General did not pass.
Sources: capitol.tn.gov/Bills/113/Amend/HA0348.pdf · wapp.capitol.tn.gov/apps/Indexes/BillsBySubject
Data protection officer
Section titled “Data protection officer”No duty to appoint a data protection officer.
Sources: capitol.tn.gov/Bills/113/Amend/HA0348.pdf
International transfers
Section titled “International transfers”No cross-border transfer rules in Tennessee law (federal rules are in us-federal). Processors must work under a contract that sets processing instructions and duties.
Sources: capitol.tn.gov/Bills/113/Amend/HA0348.pdf
Impact assessments
Section titled “Impact assessments”Controllers must conduct and document an assessment of targeted advertising, sale, sensitive data, risky profiling and other high-risk processing created on or after 1 July 2024. The Attorney General can obtain it through a civil investigative demand; it stays confidential.
Sources: capitol.tn.gov/Bills/113/Amend/HA0348.pdf
Automated decisions and AI
Section titled “Automated decisions and AI”Consumers can opt out of profiling for decisions with legal or similarly significant effects. Since 1 July 2026, developers and deployers must not advertise or present an AI system as a qualified mental health professional ($5,000 per violation). The ELVIS Act creates liability for sharing tools made to produce a specific person’s voice or likeness without permission.
Sources: capitol.tn.gov/Bills/113/Amend/HA0348.pdf · capitol.tn.gov/Bills/114/Bill/SB1580.pdf · capitol.tn.gov/Bills/113/Amend/HA0578.pdf
Penalties
Section titled “Penalties”Only the Attorney General enforces, after a 60-day notice and cure that doesn’t expire. Courts can impose up to $7,500 per violation, and treble damages for wilful or knowing violations. There’s no private right of action. It’s an affirmative defence to keep a written privacy program that reasonably conforms to the NIST Privacy Framework 1.0 (1.1 is still a draft) or other documented privacy policies, is updated within 2 years of a revised framework, and gives the Act’s rights.
Sources: capitol.tn.gov/Bills/113/Amend/HA0348.pdf · nist.gov/privacy-framework
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/us-tn.yaml.