Tennessee Information Protection Act (TIPA) Reference Guide

TIPA applies to a person doing business in Tennessee or producing products or services targeted to Tennessee residents that exceeds $25 million in annual revenue and either controls or processes data of at least 175,000 consumers in a calendar year, or handles at least 25,000 consumers’ data and derives more than 50% of gross revenue from the sale of personal information. The revenue condition is not an alternative to those volume tests. Tennessee General Assembly: enacted HB 1181 / SB 73

The Attorney General lists government bodies, nonprofits, higher education, specified financial institutions and HIPAA-regulated entities among the exclusions. Commercial and employment-context individuals also fall outside the Act’s consumer definition. Counsel should confirm the entity and data exclusions against its actual business before applying website controls as TIPA obligations. Tennessee Attorney General: TIPA business and consumer guidance

Eligible consumers can confirm and access processing, correct inaccuracies, delete eligible information, receive a portable copy and opt out of sale, targeted advertising and specified profiling. A controller generally responds within 45 days; if it declines a request, it must explain why and provide an appeal path. Tennessee Attorney General: TIPA business and consumer guidance

The privacy notice should identify processed categories and purposes, how rights and appeals work, and third-party sharing categories. Controllers also need reasonable security, data minimization, consent before processing sensitive data and written processor contracts where applicable. Website settings must be connected to the systems that implement these decisions. Tennessee Attorney General: TIPA business and consumer guidance

The Tennessee Attorney General describes sale as an exchange of personal information by a controller to a third party for valuable monetary consideration, subject to enumerated exclusions. A marketing pixel or analytics request should therefore be evaluated with its contract, recipient and economic arrangement; the mere appearance of a third-party domain does not establish a sale under TIPA. Tennessee Attorney General: TIPA business and consumer guidance

Targeted advertising involves an advertisement selected using activity across nonaffiliated sites or apps over time. Review pixels, identity matching, conversion APIs and server-side events for this purpose, then test whether the advertised opt-out is reflected in each relevant flow. Measurement-only and contextual arrangements require their own classification. Tennessee Attorney General: TIPA business and consumer guidance

TIPA provides a right to opt out of sale, targeted advertising and specified profiling and requires the privacy notice to explain how residents can exercise it. The official Attorney General guidance reviewed for this page does not establish a broad universal opt-out signal requirement. A site can support GPC voluntarily or because another law applies, but a GPC test alone is not a complete TIPA test. Tennessee Attorney General: TIPA business and consumer guidance

Submit the direct request using a Tennessee test scenario. Record which tags, cookies and server events run before and after the choice, how long updates take to propagate, and whether the appeal and contact routes remain accessible. Keep implementation evidence separate from legal classification. Tennessee Attorney General: TIPA business and consumer guidance

The Tennessee Attorney General has exclusive authority to enforce TIPA. The state guidance describes written notice of alleged violations and a 60-day opportunity to cure before an enforcement action; a subsequent or continuing violation may still be actionable. Tennessee Attorney General: TIPA business and consumer guidance

TIPA includes a specific affirmative defense for a controller or processor that creates, maintains and complies with a written privacy program reasonably conforming to the NIST Privacy Framework or comparable framework, maintains required updates and provides TIPA’s substantive rights. A marketing scan alone cannot establish that program-level defense. Tennessee Attorney General: TIPA business and consumer guidance

First calculate annual revenue and consumer-data volumes with legal and finance teams, then document exclusions and the actual meaning of each sale arrangement. Prepare the notice, rights workflow, processor contracts and assessment inventory before declaring the site ready for TIPA. Tennessee Attorney General: TIPA business and consumer guidance

Engineering can inventory tags, consent platforms, APIs and ad-vendor platforms like Google Ads and Meta. Run choice-based tests, fix surviving flows that counsel classifies as subject to an opt-out, and retain dated evidence. Processing activities created or generated after July 1, 2024 may need a data protection assessment under TIPA’s timeline. Tennessee Attorney General: TIPA business and consumer guidance

Use separate browser sessions to compare the site’s initial behavior, its response to a direct opt-out, and its response to Global Privacy Control where relevant to your review. Record the page URL, test time, browser settings and exact choice made so the result can be reproduced.

Inspect cookies and network requests before and after each choice. Record which requests continue, their destinations and the controls involved. Browser evidence can help diagnose an implementation; it cannot establish statutory applicability, the legal purpose of every transfer or organization-wide compliance.

Legal interpretation, applicability, exemptions, privacy notices, vendor contracts, rights-request procedures, sensitive-data obligations, and organizational governance should be handled by qualified privacy counsel.

This guide uses the Tennessee Attorney General’s published TIPA guidance and the enacted General Assembly bill record. It differentiates the revenue condition from either data threshold and treats a technical scan as evidence of website behavior rather than proof of coverage or legal compliance.

Prepared by Etalon Editorial Team. Last reviewed September 28, 2026. Material corrections may be sent to contact@etalondata.com.

Etalon is not a law firm and does not provide legal advice. A passing scan or certificate does not guarantee that an organization satisfies every legal obligation.

Technical testing records observable website behavior. Your legal and privacy team remains responsible for coverage, exclusions, classifications, notices, requests, sensitive data, children, contracts, assessments and governance.