# [Tennessee Information Protection Act (TIPA) - a comprehensive guide](https://www.cookiebot.com/en/tennessee-information-protection-act-tipa/) **The Tennessee Information Protection Act became the eighth data privacy law enacted at the state level in the United States. It was signed into law on the same day as Montana's privacy legislation.** · [Get started](https://manage.cookiebot.com/en/signup) --- Tennessee became the eighth American state to enact consumer privacy legislation, which will take effect on July 1, 2025. This law was passed on May 11, 2023, giving organizations just over two years from then to prepare for compliance with the Tennessee Information Protection Act (TIPA). ## What is the Tennessee Information Protection Act? The [Tennessee Information Protection Act (TIPA)](https://legiscan.com/TN/text/SB0073/id/2817209) was drafted as bill HB 1181, which aims to safeguard the privacy and personal information rights of approximately seven million residents in Tennessee. It also establishes data privacy obligations for companies operating within the state or offering products and services to its residents. These organizations handle the personal information of consumers as part of their business activities. Similar to California and other states with data privacy laws, Tennessee defines a consumer as a resident who is not engaged in commercial or employment-related activities. TIPA follows an opt-out approach, which aligns with the comprehensive data privacy regulations enacted in all other states thus far where data privacy laws have been passed. Under this model, businesses that must comply with TIPA are required to inform consumers about their data collection and processing practices, like what specific types of data are being collected, for what purposes it will be used, any third parties involved in sharing this data, etc. ## Important definitions in the Tennessee Information Protection Act Tennessee’s law, like other states that have passed privacy legislation, focuses on key principles of data privacy and protection and the related duties of various organizations accessing personal data. It is important to establish definitions that strike a balance between being clear and comprehensive, while also being flexible enough to adapt to technological advancements for efficient implementation and enforcement of regulations into the future. ### How TIPA defines personal information TIPA refers to personal information, which is also called personal data in some other laws, as: *“information that identifies, relates to, or describes a particular consumer or is reasonably capable of being directly or indirectly associated or linked with a particular consumer”*. The law provides a fairly lengthy list of examples, which some other states’ laws don’t. It does exclude publicly available information, aggregated data, or [de-identified data](https://usercentrics.com/knowledge-hub/data-anonymization/), which are common exemptions in US privacy laws. ### How the TIPA defines consent According to TIPA, consent is *"an explicit and voluntary action indicating a consumer's informed and unequivocal agreement to process personal information related to the consumer."* This includes written statements, whether in electronic form or otherwise, as well as clear affirmative actions. --- ## Which companies have to comply with the Tennessee Information Protection Act? The TIPA applies to organizations doing business in Tennessee, and any company providing products or services targeted to Tennessee residents. There are two primary threshold criteria for organizations (“controllers”): - control or process the personal information of at least 100,000 Tennessee residents during a calendar year, **or** - control or process the personal information of at least 25,000 Tennessee consumers during a calendar year, **and** derive more than 50% of their gross revenue from the sale of personal information ## Tennessee Information Protection Act and the rights of consumers The data privacy law gives individuals a number of rights over their privacy and personal data. These are consistent with rights granted by other US states’ privacy laws as well. Children cannot exercise their rights or provide consent, but parents or legal guardians of known children can invoke a child’s rights. ## How to comply with the Tennessee data privacy act? Organizations are required to inform consumers of their rights and the methods by which they can exercise them. The controller should include clear instructions on how consumers can exercise their rights in their privacy notice or privacy policy page on their website. In order to exercise data privacy rights under the TIPA, individuals must submit a verifiable request to the company. --- ## Tennessee Information Protection Act compliance preparation Businesses operating in Tennessee have until 2025 to get ready for complying with the TIPA. If they have already met the requirements of other state-level data privacy laws in the United States, a significant amount of that work has already been completed. It is always beneficial for organizations to adopt a [privacy by design](https://usercentrics.com/knowledge-hub/what-is-privacy-by-design/) approach, whether it is specifically for regulatory compliance or overall operational best practices. ## Cookiebot CMP is a plug-and-play solution that helps automate compliance with data privacy laws. Sign up today and implement Cookiebot CMP straight from the cloud with a few lines of JavaScript. [Get started](https://manage.cookiebot.com/en/signup) *Used by: Pepco, rural-king, orbico, credit-exchange, canon, bauhaus* --- ## Product [Cookiebot™ Consent Solution](https://www.cookiebot.com/en/cookie-consent-solution/) · [Usercentrics for Wix](https://www.cookiebot.com/en/cookiebot-for-wix-by-usercentrics-app/) · [WordPress Plugin](https://www.cookiebot.com/en/new-wp-cookie-plugin/) · [Pricing](https://www.cookiebot.com/en/pricing/) ## Regulations [DMA (EU)](https://www.cookiebot.com/en/digital-markets-act-dma/) · [GDPR (EU)](https://www.cookiebot.com/en/gdpr/) · [CCPA (California)](https://www.cookiebot.com/en/what-is-ccpa/) · [VCDPA (Virginia)](https://www.cookiebot.com/en/virginia-vcdpa/) · [LGPD (Brazil)](https://www.cookiebot.com/en/lgpd/) · [TCF v2.3 (IAB)](https://www.cookiebot.com/en/tcf/) · [Google Consent Mode](https://www.cookiebot.com/en/cookiebot-cmp-google-consent-mode/) · [Microsoft UET Consent Mode](https://www.cookiebot.com/en/microsoft-consent-mode-cmp/) ## Partners [Become an affiliate](https://www.cookiebot.com/en/affiliates/) · [Become a partner](https://www.cookiebot.com/en/resellers/) · [Find a partner](https://www.cookiebot.com/en/cookiebot-reseller/) ## Resources [Blog](https://www.cookiebot.com/en/blog/) · [Digital Markets Act Hub](https://www.cookiebot.com/en/digital-markets-act-dma-resources/) · [Google Consent Mode Hub](https://www.cookiebot.com/en/google-consent-mode-resources/) · [Google Consent Mode V2 Certification](https://courses.usercentrics.com/course/google-consent-mode-v2) · [Google Consent Audit Fixes](https://www.cookiebot.com/en/google-consent-audit-fixes/) · [Developer documentation](https://www.cookiebot.com/en/developer/) · [Cookiebot vs CookieYes](https://www.cookiebot.com/en/cookiebot-best-cookieyes-alternative/) · [Cookiebot vs OneTrust](https://www.cookiebot.com/en/onetrust-alternative/) · [Cookie Banner Cost Calculator](https://www.cookiebot.com/en/cookie-banner-pricing-calculator/) ## Company [About us](https://www.cookiebot.com/en/about/) · [Careers](https://usercentrics.com/career/) · [Support](https://support.cookiebot.com/hc/en-us/) --- [Privacy Policy](https://www.cookiebot.com/en/privacy-policy/) · [Terms of Service](https://www.cookiebot.com/en/terms-of-service/) · [Cookie Declaration](https://www.cookiebot.com/en/cookie-declaration/) · [Data Processing Agreement](https://www.cookiebot.com/en/data-processing-agreement/) ©2026 Cookiebot™ by [Usercentrics](https://usercentrics.com/)