Tennessee Information Protection Act (TIPA)

Key definitions in TIPA

The Tennessee data privacy law introduces several critical terms that businesses and consumers need to understand, as defined in § 47-18-3203 of the Tennessee Code.

• Consumer: An individual residing in Tennessee acting in a personal context, excluding those acting in employment or commercial capacities.
• Controller: An entity that determines the purposes and means of processing personal data.
• Processor: An entity that processes personal data on behalf of a controller.
• Personal data: Information linked or reasonably linkable to an identified or identifiable individual, excluding de-identified or publicly available data.
• Sensitive data: A subset of personal data including information like racial or ethnic origin, religious beliefs, health data, and precise geolocation.

Who must comply with TIPA?

The Tennessee data privacy law applies to entities conducting business in Tennessee or targeting Tennessee residents, provided they meet one of the following criteria:

• Control or process personal data of at least 175,000 consumers annually.
• Derive over 50% of gross revenue from the sale of personal data and control or process personal data of at least 25,000 consumers.

"Consumer" means a natural person who is a resident of Tennessee acting only in an individual or household context. It does not include a natural person acting in a commercial or employment context.

- § 47-18-3203 of the Tennessee Code

TIPA exemptions

The Tennessee Information Protection Act exempts certain entities and data types:

Entity exemptions

• Government agencies
• Financial institutions under Gramm-Leach-Bliley Act (GLBA).
• Entities covered by the Health Insurance Portability and Accountability Act (HIPAA).
• Nonprofit organizations
• Higher education institutions

Data-level exemptions

• Personal data regulated by HIPAA, GLBA, FCRA, FERPA, and DPPA
• Employment-related data
• Data collected in a commercial or business-to-business context

These exemptions ensure that federally regulated data and certain industries are not subject to overlapping compliance requirements.

Key provisions of TIPA

TIPA outlines several obligations for data controllers:

• Data minimization: Collect only data that is adequate, relevant, and limited to what is necessary for the intended purposes.
• Purpose limitation: Process personal data solely for disclosed purposes, unless the consumer consents to other uses.
• Data security: Implement reasonable administrative, technical, and physical measures to protect the confidentiality and integrity of personal data.
• Non-discrimination: Refrain from discriminating against consumers who exercise their rights under TIPA.

Understanding Tennessee consumer rights

Additionally, the Tennessee privacy law grants consumers specific rights, including:

• Access: The right to confirm whether a controller is processing their personal data and to access that data.
• Correction: The right to correct inaccuracies in their personal data.
• Deletion: The right to request the deletion of personal data provided by or obtained about them.
• Data portability: The right to obtain a copy of their personal data in a portable and readily usable format.
• TIPA opt-out for targeted advertising: The right to opt out of the sale of personal data, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects.

"Consumers will also be able to opt out of the selling of their personal data to third parties without discrimination."

- State Representative Johnny Garrett

Is TIPA opt-in or opt-out?

The Tennessee Information Protection Act primarily follows an opt-out model, allowing consumers to opt out of targeted advertising, data sales, and certain profiling. However, it requires opt-in consent for processing sensitive data, such as health information, biometric data, and precise geolocation.

The price of non-compliance

Enforcement of TIPA falls under the purview of the Tennessee Attorney General. 

‍TIPA fines

Under the Tennessee data privacy law, violations are considered unfair or deceptive trade practices and are enforced by the Tennessee Attorney General. Penalties for noncompliance include:

• Fines of up to $7,500 per violation
• Additional penalties for willful violations
• Possible injunctive relief and orders to correct violations
• A 60-day cure period to fix issues before enforcement action

The impact of TIPA on businesses

What businesses need to know about TIPA

Businesses operating in Tennessee or targeting its residents must assess their data practices to ensure compliance with TIPA. This may involve updating privacy policies, implementing robust data security measures, and establishing processes to respond to consumer rights requests. 

Companies should also review their data processing agreements with third parties to ensure alignment with TIPA's requirements.

"Beginning in 2025, large technology companies like Google, Instagram and TikTok will be required to fully disclose to users what information is being collected about them and how it will be used." 

- State Representative Johnny Garrett

What are the TIPA requirements for businesses?

Businesses subject to the Tennessee Information Protection Act must:

1. Honor consumer rights – Allow consumers to access, delete, and obtain a copy of their data, and opt out of targeted ads, data sales, and profiling.
2. Provide transparency – Maintain a clear privacy notice disclosing data collection, use, and consumer rights.
3. Obtain opt-in for sensitive data – Explicit consent is required for processing sensitive personal data (e.g., health, biometric, and geolocation data).
4. Conduct data protection assessments – Evaluate risks of targeted ads, profiling, and sensitive data processing.
5. Implement security measures – Use reasonable data protection practices to secure consumer data.
6. Establish contracts with data processors – Ensure third parties follow TIPA compliance obligations.

These requirements align with other state privacy laws but include Tennessee-specific compliance measures.

The impact of TIPA on consumers

The Tennessee Information Protection Act gives consumers greater control over their personal data by granting rights to access, delete, and obtain copies of their data. It allows them to opt out of targeted advertising, data sales, and profiling while requiring businesses to provide clear privacy notices. Additionally, opt-in consent is required for processing sensitive data, enhancing consumer privacy protections.

How TIPA compares to other U.S. data privacy laws

TIPA shares similarities with data privacy laws in states like California (CCPA) and Virginia (VCDPA), particularly in granting consumer rights and imposing obligations on businesses. However, there are distinctions in applicability thresholds, definitions, and specific provisions. 

For instance, TIPA's applicability is based on the volume of data processed and revenue derived from data sales, which may differ from criteria in other states.

TIPA vs other state privacy laws

‍

‍

What makes TIPA stand out?

Tennessee's opt-in consent requirement for sensitive data, including biometric, health, and precise geolocation information, sets it apart from many U.S. state privacy laws. This stricter approach aligns more closely with Europe’s GDPR, which mandates explicit consent before processing such data.

For businesses handling sensitive information, this means higher compliance obligations and a greater emphasis on consumer transparency. Unlike other U.S. states that primarily use opt-out models, companies operating under the TIPA must proactively obtain affirmative consent before collecting or processing sensitive data.

This raises the stakes for businesses in industries such as healthcare, financial services, and technology, where biometric authentication, health records, and precise location tracking are commonly used. Failure to secure proper consent could lead to enforcement actions by the Tennessee Attorney General, including fines of up to $7,500 per violation.

Ultimately, Tennessee’s opt-in standard for sensitive data pushes businesses to adopt stricter privacy safeguards, improve consumer trust, and align more closely with global privacy frameworks rather than just meeting the minimum requirements seen in other U.S. state laws.

It’s also notable that similar to laws in Utah, Virginia, and Iowa, the TIPA does not explicitly require businesses to adhere to universal opt-out mechanisms (UOOMs), like the Global Privacy Control. 

How to ensure TIPA compliance

If you’ve read this far, you know that building a privacy-compliant business is important, but also far from easy. Here are some key steps every business should take to ensure they don’t fall foul of regulators:

What is TIPA compliance

TIPA compliance means businesses follow the Tennessee Information Protection Act by honoring consumer rights (access, delete, opt-out), conducting data protection assessments, securing personal data, and providing clear privacy notices. It also requires opt-in consent for sensitive data and compliance with enforcement by the Tennessee Attorney General.

How to comply with TIPA

To meet the TIPA compliance requirements, businesses should:

1. Conduct data mapping: Identify and document the personal data collected, processed, and stored.
2. Review and update privacy policies: Ensure transparency in data collection and usage practices.
3. Implement consumer rights processes: Establish procedures to handle consumer requests regarding their data.
4. Assess data security measures: Adopt appropriate safeguards to protect personal data.
5. Train employees: Educate staff on TIPA requirements and data privacy best practices.
6. Review third-party agreements: Ensure contracts with processors comply with TIPA's mandates.

How Ketch can simplify TIPA compliance

With the Ketch Data Permissioning Platform, you can:

Ketch can simplify TIPA compliance by automating key privacy requirements, including:

1. Consumer rights management – Streamlines data access, deletion, and opt-out requests through a centralized platform.
2. Universal opt-out handling – Supports automated opt-out mechanisms for targeted ads and data sales.
3. Data protection assessments – Automates risk assessments for high-risk processing like profiling and sensitive data handling.
4. Consent management – Ensures opt-in compliance for sensitive data through automated consent collection and tracking.
5. Policy enforcement – Helps businesses maintain real-time privacy notices and compliance monitoring.

By integrating Ketch, businesses can ensure seamless and scalable TIPA compliance while reducing operational burdens.

‍

‍

When you automate these processes, you enable your internal stakeholders: 

• Your developers and marketers can do their jobs without fretting about regulations
• Your legal team can set guidelines for notice and consent, secure in the knowledge that any changes they make will ripple through your whole data ecosystem (including vendors or third-party companies using your data!)

Final thoughts: Preparing your business for TIPA

TIPA compliance requires businesses to adopt a proactive approach to data privacy by implementing robust data management practices, ensuring transparency, and staying informed about evolving regulatory requirements.

Contact Ketch today to streamline your compliance and future-proof your privacy strategy. 

Read further: 2025 U.S. State Privacy Laws: what you need to know

FAQs about the Tennessee privacy regulation