Tennessee TIPA
Tennessee Information Protection Act (Public Chapter 408 of 2023, HB 1181)
The TIPA is Tennessee's consumer privacy law, effective 1 July 2025. It has the highest applicability thresholds of the state laws, including a 25 million dollar revenue floor, and is the only one to offer an affirmative defense for controllers whose written privacy program reasonably conforms to the NIST Privacy Framework.
Who it applies to
Persons doing business in Tennessee or targeting its residents with annual revenue over 25 million dollars that control or process the personal data of at least 175,000 consumers in a year, or at least 25,000 consumers while deriving more than 50 percent of gross revenue from selling personal data.
Identity requirements
- Obtain opt-in consent before processing sensitive data, including biometric and genetic data and data of known children
- Conduct data protection assessments for targeted advertising, sale, profiling and sensitive-data processing
- Honor rights to access, correct, delete and port data and to opt out of sale, targeted advertising and profiling
- Maintain a written privacy program; reasonable conformity with the NIST Privacy Framework is an affirmative defense
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Customer identity & consent (CIAM) | Opt-in consent for biometric and other sensitive data must be captured and enforced. |
| Identity governance (IGA) | A NIST Privacy Framework aligned program, including governed access to personal data, supports the affirmative defense. |
| Audit, logging & accountability | Assessments and program documentation are central to defending enforcement actions. |
Penalties
The Attorney General may seek civil penalties of up to 7,500 dollars per violation, with treble damages for wilful or knowing violations, after a 60-day cure notice.
Status and dates last verified against primary sources on 2026-10-31.
Tennessee TIPA: frequently asked questions
- When did the Tennessee Information Protection Act take effect?
- It took effect on 1 July 2025.
- What is the NIST Privacy Framework defense?
- A controller or processor that maintains a written privacy program reasonably conforming to the NIST Privacy Framework has an affirmative defense to an enforcement action under the Act.