---
jurisdiction: "Tennessee"
slug: tennessee
countryCode: US
snapshotAsOf: "2026-06-12"
lastReviewed: "2026-06-06"
canonicalUrl: https://openagreements.org/legal/privacy/tennessee
license: CC BY 4.0
stale: false
---

> [!IMPORTANT]
> **Informational only — not legal advice.** This is a snapshot of an OpenAgreements practice note,
> provided for general information. It is not legal advice, does not create an attorney-client
> relationship, and is not a substitute for a licensed attorney in the relevant jurisdiction.
> Laws change; verify against the canonical version before relying on it.
>
> **Canonical:** https://openagreements.org/legal/privacy/tennessee · **Snapshot as of:** 2026-06-12 · License: CC BY 4.0 · © UseJunior

# Tennessee Consumer Privacy Law (TIPA)[^about]

The Tennessee Information Protection Act gives Tennessee consumers rights over their personal information and imposes notice, contracting, and consent duties on large controllers — it stands out for an unusually high entry bar (over $25 million in revenue plus large consumer-volume tests) and a one-of-a-kind affirmative defense for businesses that maintain a written privacy program conforming to the NIST privacy framework, enforced exclusively by the Attorney General with no private right of action.


## At a glance

| Question | Tennessee |
| --- | --- |
| **Summary** | If you exceed the $25 million revenue floor and meet Tennessee's large consumer-volume tests, TIPA requires a privacy notice, opt-in consent to process sensitive data, and processor contracts — enforced by the Attorney General with a 60-day cure period and no consumer lawsuits, and uniquely offering an affirmative defense to businesses that maintain a written privacy program conforming to the NIST privacy framework. |
| **Main law** | Tenn. Code Ann. §§ 47-18-3301 et seq. (Tennessee Information Protection Act) |
| **Privacy policy required?** | Yes — a reasonably accessible, clear, and meaningful notice with statutorily fixed contents |
| **Who does it cover?** | Persons doing business in Tennessee (or targeting residents) that exceed $25 million in revenue AND either process the information of 175,000+ consumers a year, or 25,000+ while deriving over 50% of gross revenue from selling personal information — a high entry bar; nonprofits, government, GLBA, HIPAA, and higher-education entities exempt |
| **Can consumers sue?** | No — enforcement is exclusively the Attorney General's |
| **Who enforces it?** | Tennessee Attorney General and Reporter (exclusive) |

## Does the Tennessee Information Protection Act apply to your business? {#does-tipa-apply}

**Short answer.** Only if you clear a high entry bar. TIPA applies to persons doing business in Tennessee or targeting its residents that exceed $25 million in revenue and either process the information of at least 175,000 consumers in a calendar year, or at least 25,000 consumers while deriving over 50% of gross revenue from selling personal information [^stat-3303-apply]. Many federally regulated entities and whole categories of organizations are carved out entirely [^stat-3311-exempt].

What sets Tennessee apart from most state privacy laws is the dollar floor: a business under $25 million in revenue is outside the statute no matter how much data it handles. That makes TIPA reach far fewer companies than laws that key applicability to consumer volume alone. On top of the threshold, section 47-18-3311 exempts government bodies, financial institutions and GLBA-covered data, HIPAA covered entities and protected health information, nonprofits, institutions of higher education, and FCRA-, FERPA-, and DPPA-regulated data, among others. A consumer is a Tennessee resident acting only in a personal context, so employee and business-contact data is out of scope.

## What must your Tennessee privacy policy contain? {#privacy-policy-contents}

**Short answer.** A controller must provide a reasonably accessible, clear, and meaningful privacy notice that lists the categories of personal information processed, the purpose for processing, how consumers exercise their rights and appeal a decision, the categories of personal information sold to third parties, and the categories of those third parties [^stat-3305-notice].

For a template privacy policy, section 47-18-3305(c) is the content checklist. TIPA also requires data minimization — collection limited to what is adequate, relevant, and reasonably necessary — and, where a controller sells personal information or processes it for targeted advertising, a clear and conspicuous disclosure of that processing and how to opt out. One Tennessee drafting note: items four and five of the notice are keyed to what the controller sells, not the broader idea of what it shares, so the notice should track the statute's wording rather than a looser paraphrase.

## What must your contracts with processors say? {#vendor-contracts}

**Short answer.** A contract between a controller and a processor must govern the processor's data processing on the controller's behalf — so a data processing agreement is a statutory requirement, not just a best practice [^stat-3306-contract].

Section 47-18-3306(b) then specifies the required terms: processing instructions, the nature and purpose of processing, the type of data and duration, a duty of confidentiality, deletion or return of data at the controller's direction, the information needed to demonstrate compliance, cooperation with assessments, and a requirement to bind subcontractors by written contract to the same obligations. A compliant template data processing agreement tracks each of these. Separately, section 47-18-3312 makes any contract term that waives or limits a consumer's TIPA rights void as against public policy.

## Do you need consent to process sensitive data? {#sensitive-data}

**Short answer.** Yes. A controller may not process a consumer's sensitive data without obtaining consent, and for a known child it must instead process the data in accordance with the federal Children's Online Privacy Protection Act [^stat-3305-consent]. Sensitive data includes information revealing race or ethnicity, religious beliefs, a mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; genetic or biometric data used to identify a person; information collected from a known child; and precise geolocation data [^stat-3302-sensitive].

This is the opt-in model, the opposite of a notice-and-opt-out approach. TIPA does not, however, require honoring a universal opt-out preference signal such as Global Privacy Control, so a Tennessee-only program can rely on its own opt-out mechanisms — though a multi-state template generally has to support universal signals to stay compliant elsewhere. A controller also needs consent before processing personal information for purposes beyond those reasonably necessary and compatible with the purposes it disclosed.

## Can a consumer sue your business under TIPA? {#consumer-lawsuit}

**Short answer.** No. The Attorney General and Reporter has exclusive authority to enforce TIPA, and the statute says a violation cannot be the basis for a private right of action, including a class action [^stat-3313-enforce]. Before suing, the Attorney General must give 60 days' written notice of the specific alleged violations and a chance to cure [^stat-3313-cure]. Uniquely, a business has an affirmative defense if it maintains a written privacy program that reasonably conforms to the NIST privacy framework [^stat-3314-nist].

A controller that cures within the 60-day window and certifies the cure in writing avoids the action; an uncured violation exposes it to civil penalties of up to $7,500 per violation, with treble damages for willful or knowing violations. Tennessee's signature feature is the affirmative defense in section 47-18-3314: a controller or processor that creates, maintains, and complies with a written privacy program conforming to the NIST privacy framework (or a comparable framework) and providing consumers the substantive rights TIPA requires can raise that program as a defense. No other state pairs comprehensive privacy duties with a NIST-based safe harbor like this, which makes building a documented, framework-aligned program both a compliance step and a litigation shield.

[^about]: By Steven Obiajulu, J.D. Published by [openagreements.org](https://openagreements.org) · Maintained by [UseJunior](https://usejunior.com). Last reviewed 2026-06-06. License: CC BY 4.0. Steven Obiajulu, J.D. is admitted in New York, not Tennessee. This article synthesizes Tennessee primary law and is not legal advice from a Tennessee-admitted attorney. This article is for informational purposes only and does not create an attorney-client relationship.

[^stat-3303-apply]: **Tenn. Code Ann. § 47-18-3303** — "This part applies to persons that conduct business in this state producing products or services that target residents of this state and that: - (1) Exceed twenty-five million dollars ($25,000,000) in revenue; and (2) - (A) Control or process personal information of at least twenty-five thousand (25,000) consumers and derive more than fifty percent (50%) of gross revenue from the sale of personal information; or - (B) During a calendar year, control or process personal information of at least one hundred seventy-five thousand (175,000) consumers." *Tenn. Code Ann. § 47-18-3303.* <https://law.justia.com/codes/tennessee/title-47/chapter-18/part-33/section-47-18-3303/#:~:text=This%20part%20applies%20to%20persons,hundred%20seventy%2Dfive%20thousand%20(175%2C000)%20consumers.>

[^stat-3311-exempt]: **Tenn. Code Ann. § 47-18-3311** — "This part does not apply to: - (1) A body, authority, board, bureau, commission, district, or agency of this state or of a political subdivision of this state; - (2) A financial institution, an affiliate of a financial institution, or data subject to Title V of the federal Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.);" *Tenn. Code Ann. § 47-18-3311(a).* <https://law.justia.com/codes/tennessee/title-47/chapter-18/part-33/section-47-18-3311/#:~:text=This%20part%20does%20not%20apply,U.S.C.%20%C2%A7%206801%20et%20seq.)%3B>

[^stat-3305-notice]: **Tenn. Code Ann. § 47-18-3305** — "A controller shall provide a reasonably accessible, clear, and meaningful privacy notice that includes: - (1) The categories of personal information processed by the controller; - (2) The purpose for processing personal information;" *Tenn. Code Ann. § 47-18-3305(c).* <https://law.justia.com/codes/tennessee/title-47/chapter-18/part-33/section-47-18-3305/#:~:text=A%20controller%20shall%20provide%20a,purpose%20for%20processing%20personal%20information%3B>

[^stat-3306-contract]: **Tenn. Code Ann. § 47-18-3306** — "A contract between a controller and a processor governs the processor's data processing procedures with respect to processing performed on behalf of the controller. The contract is binding and must clearly set forth instructions for processing data, the nature and purpose of processing, the type of data subject to processing, the duration of processing, and the rights and obligations of both parties." *Tenn. Code Ann. § 47-18-3306(b).* <https://law.justia.com/codes/tennessee/title-47/chapter-18/part-33/section-47-18-3306/#:~:text=A%20contract%20between%20a%20controller,and%20obligations%20of%20both%20parties.>

[^stat-3305-consent]: **Tenn. Code Ann. § 47-18-3305** — "Not process sensitive data concerning a consumer without obtaining the consumer's consent, or, in the case of the processing of sensitive data concerning a known child, without processing the data in accordance with the federal Children's Online Privacy Protection Act (15 U.S.C. § 6501 et seq.) and its implementing regulations." *Tenn. Code Ann. § 47-18-3305(a)(6).* <https://law.justia.com/codes/tennessee/title-47/chapter-18/part-33/section-47-18-3305/#:~:text=Not%20process%20sensitive%20data%20concerning,seq.)%20and%20its%20implementing%20regulations.>

[^stat-3302-sensitive]: **Tenn. Code Ann. § 47-18-3302** — "‘Sensitive data’ means a category of personal information that includes: - (A) Personal information revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; - (B) The processing of genetic or biometric data for the purpose of uniquely identifying a natural person; - (C) The personal information collected from a known child; or - (D) Precise geolocation data;" *Tenn. Code Ann. § 47-18-3302(26).* <https://law.justia.com/codes/tennessee/title-47/chapter-18/part-33/section-47-18-3302/#:~:text=%E2%80%9CSensitive%20data%E2%80%9D%20means%20a%20category,%2D%20(D)%20Precise%20geolocation%20data%3B>

[^stat-3313-enforce]: **Tenn. Code Ann. § 47-18-3313** — "A violation of this part shall not serve as the basis for, or be subject to, a private right of action, including a class action lawsuit, under this part or other law." *Tenn. Code Ann. § 47-18-3313(e).* <https://law.justia.com/codes/tennessee/title-47/chapter-18/part-33/section-47-18-3313/#:~:text=A%20violation%20of%20this%20part,this%20part%20or%20other%20law.>

[^stat-3313-cure]: **Tenn. Code Ann. § 47-18-3313** — "Prior to initiating an action under this part, the attorney general and reporter shall provide a controller or processor sixty-days' written notice identifying the specific provisions of this part the attorney general and reporter alleges have been or are being violated." *Tenn. Code Ann. § 47-18-3313(b).* <https://law.justia.com/codes/tennessee/title-47/chapter-18/part-33/section-47-18-3313/#:~:text=Prior%20to%20initiating%20an%20action,been%20or%20are%20being%20violated.>

[^stat-3314-nist]: **Tenn. Code Ann. § 47-18-3314** — "A controller or processor has an affirmative defense to a cause of action for a violation of this part if the controller or processor creates, maintains, and complies with a written privacy policy that: (1) - (A) Reasonably conforms to the National Institute of Standards and Technology (NIST) privacy framework entitled ‘A Tool for Improving Privacy through Enterprise Risk Management Version 1.0.’ or other documented policies, standards, and procedures designed to safeguard consumer privacy;" *Tenn. Code Ann. § 47-18-3314(a).* <https://law.justia.com/codes/tennessee/title-47/chapter-18/part-33/section-47-18-3314/#:~:text=A%20controller%20or%20processor%20has,designed%20to%20safeguard%20consumer%20privacy%3B>
