Overview
The Tennessee Information Protection Act (TIPA) is a comprehensive state privacy law designed to provide Tennessee residents with greater control over their personal data while establishing clear compliance obligations for businesses. Signed into law in May 2023, TIPA takes effect on July 1, 2025.
TIPA is considered one of the most business-friendly U.S. privacy laws, with broad exemptions, an affirmative defense option for businesses, and no private right of action. However, it still imposes strict rules on data processing, consumer rights, and security measures.
Who Must Comply?
The TIPA applies to businesses that conduct business in Tennessee or target Tennessee residents and meet one of the following criteria:
✔ Process personal data of at least 175,000 Tennessee consumers annually
✔ Process personal data of at least 25,000 Tennessee consumers and derive over 50% of gross revenue from selling personal data
Exemptions:
The law does not apply to:
🚫 Government entities
🚫 Nonprofits
🚫 Financial institutions subject to GLBA
🚫 HIPAA-covered entities (hospitals, insurers, healthcare providers)
🚫 Higher education institutions
Key Consumer Rights Under TIPA
✔ Right to Access – Consumers can request a copy of their personal data.
✔ Right to Correct – Consumers can request corrections to inaccurate personal data.
✔ Right to Delete – Consumers can request the deletion of personal data.
✔ Right to Data Portability – Consumers can receive their data in a portable format.
✔ Right to Opt-Out – Consumers can opt out of:
- Targeted advertising
- Sale of personal data
- Automated profiling that affects legal or financial decisions
Business Compliance Requirements
✔ Affirmative Defense Option – Businesses that implement a written privacy program aligned with industry standards (such as NIST or ISO 27701) may use it as a legal defense against enforcement actions.
✔ Obtain Opt-In Consent for Sensitive Data Processing – Companies must get explicit consumer consent before processing:
📌 Racial/ethnic origin
📌 Religious beliefs
📌 Biometric data
📌 Health conditions
📌 Children’s data
✔ Universal Opt-Out Mechanisms (Starting January 1, 2026) – Businesses must recognize Global Privacy Control (GPC) signals.
✔ Privacy Notices & Transparency – Businesses must provide clear, detailed privacy policies explaining data collection practices.
✔ Data Security & Protection – Companies must apply reasonable security measures to protect personal data from breaches.
✔ Risk Assessments – Businesses must conduct Data Protection Assessments (DPA) for:
📌 Targeted advertising
📌 Data sales
📌 Automated decision-making
Real-World Enforcement Cases
The Tennessee Attorney General is responsible for enforcing TIPA, with penalties of up to $7,500 per violation.
Since TIPA does not take effect until July 2025, enforcement cases are yet to be seen. However, Tennessee’s law is expected to target data brokers, AI-driven profiling, and businesses failing to honor consumer opt-outs.
📌 Comparison with Other State Privacy Laws
The Tennessee TIPA is often seen as more business-friendly than laws like California’s CPRA and Colorado’s CPA because:
✅ Affirmative Defense Available – Businesses with strong privacy programs can limit liability.
✅ Higher Compliance Threshold (175,000 consumers) – Fewer businesses are affected.
✅ No Private Right of Action – Consumers cannot sue companies directly.
Future of TIPA Regulation
📌 Expansion of opt-out mechanisms in 2026 to include AI-based decision-making.
📌 Tougher enforcement for businesses failing to honor privacy requests.
📌 Potential updates to align with a federal privacy law if passed.
Tennessee’s TIPA is one of the most business-friendly privacy laws while still giving consumers key data rights. It serves as a model for future state and federal privacy frameworks.
