HB 1181 / SB 73, Public Chapter 408 of 2023: Tennessee Information Protection Act (consumer privacy, including the right to opt out of profiling)

Summary

Tennessee's comprehensive consumer privacy law. It applies to businesses with more than $25 million in revenue that either process the personal information of at least 175,000 Tennessee consumers in a year, or of at least 25,000 consumers while deriving more than half of gross revenue from selling personal information. Consumers may opt out of the sale of their personal information, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects. Profiling is defined as solely automated processing to evaluate or predict a person's economic situation, health, preferences, reliability, behavior or location. Controllers must conduct data protection assessments for profiling that presents a reasonably foreseeable risk of unfair treatment, disparate impact or financial injury, for processing begun on or after July 1, 2024. Financial institutions and data subject to the Gramm-Leach-Bliley Act, and licensed insurers, are exempt. The Attorney General enforces it exclusively, after a 60-day notice and cure opportunity, with civil penalties of up to $7,500 per violation and treble damages for willful violations. There is no private right of action, and a written privacy program that reasonably conforms to the NIST privacy framework is an affirmative defense.

Key dates

1. May 11, 2023Enacted
2. July 1, 2025Takes effect
3. October 16, 2026Checked against sources
4. October 21, 2026Checked against sources

Developments are added when the record is reviewed. Next review: October 16, 2027.

Evidence

Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.

1. Effective date(s) 07/01/2025 05/24/2023 Pub. Ch. 408 05/24/2023 Signed by Governor. 05/11/2023

   Supports: Signing date, chapter and effective date

   As enacted, enacts the "Tennessee Information Protection Act."

   Supports: Name of the act as enacted

   HB 1181 bill information, 113th General Assembly Tennessee General Assembly Primary source

2. "Profiling" means a form of solely automated processing performed on personal information to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person's economic situation, health, personal preferences, interests, reliability, behavior

   Supports: Definition of profiling

   Profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

   Supports: Right to opt out of profiling

   The processing of personal information for purposes of profiling, where the profiling presents a reasonably foreseeable risk of: (A) Unfair or deceptive treatment of, or unlawful disparate impact on, consumers; (B) Financial, physical, or reputational injury to consumers

   Supports: Data protection assessment for risky profiling

   Data protection assessment requirements apply to processing activities created or generated on or after July 1, 2024, and are not retroactive.

   Supports: Assessment start date

   A financial institution, an affiliate of a financial institution, or data subject to Title V of the federal Gramm-Leach-Bliley Act

   Supports: GLBA exemption

   A court may impose a civil penalty of up to seven thousand five hundred dollars ($7,500) for each violation of this part.

   Supports: Civil penalty

   The attorney general and reporter has exclusive authority to enforce this part.

   Supports: Exclusive AG enforcement

   the attorney general and reporter shall provide a controller or processor sixty-days' written notice identifying the specific provisions of this part

   Supports: 60-day notice and cure

   This act takes effect July 1, 2025, the public welfare requiring it.

   Supports: Effective date

   Amendment No. 1 to HB1181 (HA0348) Tennessee General Assembly Primary source