Key Facts
Overview
Tennessee's TIPA uniquely offers a NIST safe harbor: controllers maintaining a written privacy program conforming to the NIST privacy framework can assert an affirmative defense against enforcement. The law has the highest consumer threshold (175,000) among US states and treble damages for willful violations.
What This Means for Your Website
- Opt-in consent is required for sensitive data and children under 13
- A NIST-conforming privacy program provides an affirmative defense (unique safe harbor)
- Treble damages may apply for willful/knowing violations
- The 60-day cure period is permanent
- Highest consumer threshold (175,000) limits applicability
Key Requirements
The Tennessee AG enforces TIPA with penalties up to $7,500 per violation, with treble damages for willful violations. Consumer requests must be fulfilled within 45 days. The dual threshold ($25M+ revenue AND 175,000+ consumers) creates the highest applicability bar alongside Utah.
How ConsentStack Handles This
ConsentStack detects Tennessee visitors and applies the TIPA opt-out model with opt-in for sensitive data. The platform's compliance approach aligns with NIST privacy framework principles.
Penalties
Up to $7,500 per violation; treble damages for willful/knowing violations.
Key Requirements
- Opt-in consent for sensitive data and children under 13
- Privacy notice detailing data practices
- Consumer rights: access, correct, delete, portability, opt-out
- Data protection assessments for high-risk processing
- Optional NIST-conforming privacy program for safe harbor
Notable Provisions
- Highest consumer threshold (175,000) among US states
- First NIST safe harbor (affirmative defense)
- Treble damages for willful violations
- Revenue + data volume dual threshold
Data Subject Rights
Confirm whether a controller is processing your personal information and access that information, free of charge up to twice a year.
Correct inaccuracies in your personal information, taking into account the nature of the information and the purposes of the processing.
Have a controller delete personal information you provided or that it obtained about you, except aggregate or de-identified data; for information from another source it may instead keep only a minimal record of your request to keep the data deleted, or opt you out of non-exempt processing.
Where processing is automated, obtain a copy of the personal information you previously provided in a portable and, where technically feasible, readily usable format you can transmit to another controller.
Opt out of the sale of your personal information, meaning its exchange for valuable monetary consideration by the controller to a third party.
Opt out of the processing of your personal information for targeted advertising based on your activities over time and across nonaffiliated websites or apps.
Opt out of solely automated profiling used for decisions that provide or deny financial or lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunities, healthcare services or access to basic necessities such as food and water.
Appeal a controller's refusal to act on your request, within a reasonable period after you receive the decision, through a conspicuous, no-cost process similar to the request process.
If your appeal is denied, the controller must give you an online mechanism, if available, or another method to contact the Tennessee Attorney General and Reporter and submit a complaint.
A controller may not discriminate against you for exercising your rights, such as by denying goods or services, charging different prices or providing lower quality, but it may vary price, quality or selection after you opt out or within a bona fide loyalty, rewards, premium features, discount or club card program.
US State Specifics
Other North America Regulations
Frequently Asked Questions
Stay compliant with TIPA
ConsentStack helps you implement Opt-out consent for Tennessee, United States automatically.