Instruments
Each one links to its
LexLint note, which carries what it requires and what it flags on.
Adult content age verification (AV)
Requires an individual or commercial entity that publishes or distributes a website on which one third or more of total content is content harmful to minors to perform reasonable age verification before granting access, and to re-verify after each age-verified session of at most 60 minutes. Verifiers must retain seven years of anonymized age verification data and may not retain personally identifying information. A violation is a Class C felony.
Note and primary source →
Comprehensive regime
TIPA governs private-sector processing of Tennessee residents' personal information, enacted as House Bill 1181, Public Chapter 408 of the 113th General Assembly. The bill passed the House April 21, 2023 and was approved by the Governor in May 2023; a floor amendment moved the general effective date from an engrossed print's July 1, 2024 to the signed Public Chapter's July 1, 2025, which the Secretary of State's official publication confirms as authoritative.
A separate data protection impact assessment look-back date, July 1, 2024, is unaffected by the general effective-date correction.
What it asks of an app →
Data subject rights
Tennessee consumers may confirm processing, access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and certain profiling. A controller must respond without undue delay and in all cases within 45 days of receipt, extendable once by 45 additional days when reasonably necessary; a denial must be communicated within 45 days, and an appeal decision must issue within 60 days of receipt.
What it asks of an app →
Enforcement supervision
TIPA is enforced exclusively by the Tennessee Attorney General and Reporter, who must provide a controller or processor 60 days' written notice identifying the specific violated provisions before suing; this cure notice is mandatory, not discretionary, and this research pass found no sunset clause anywhere in the text, unlike Maryland's and Minnesota's expiring cure mechanisms.
A court may award relief to each affected consumer regardless of actual damages, and treble damages for a willful or knowing violation. TIPA's own compliance-program provision requires a written privacy program reasonably conforming to the NIST privacy framework, and grants an affirmative defense to liability for a controller or processor that creates, maintains, and complies with such a program, a structural feature no other state in this wave ties to liability this directly. TIPA bars any private right of action, including a class action, under TIPA or other law.
What it asks of an app →
Sensitive categories
TIPA classifies information revealing racial or ethnic origin, religious beliefs, a mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; the processing of genetic or biometric data to uniquely identify a natural person; a known child's personal information; and precise geolocation data as sensitive data.
"Biometric data" is defined as data generated by automatic measurement of biological characteristics used to identify a specific individual, but categorically and unconditionally excludes a physical or digital photograph, video recording, or audio recording, or data generated from one, with no claw-back for an identification purpose.
This is the single most consequential difference from Maryland, Minnesota, and New Jersey in this same wave: a faceprint or voiceprint a product derives from a recording specifically to identify a person is never "biometric data" in Tennessee, and therefore never triggers TIPA's sensitive-data consent duty on that basis alone. No dedicated Tennessee biometric-privacy statute beyond TIPA's sensitive-data treatment was found in this pass.
What it asks of an app →
Social media and minors
Requires social media companies to verify the age of prospective Tennessee account holders, obtain express parental consent before a minor under 18 can create or keep an account, let a parent revoke that consent, and provide parents supervisory tools including privacy settings visibility, daily time restrictions, and mandatory breaks.
Note and primary source →
