Laws
Tennessee Information Protection Act (TIPA): your rights since July 2025
Quick answer
According to the Tennessee Attorney General, the Tennessee Information Protection Act, in force since July 1, 2025, lets you ask a covered company to show you, correct or delete your personal information, give you a portable copy, and stop using it for targeted ads, profiling or sale. It only reaches large businesses: more than $25 million in annual revenue plus a lot of Tennesseans' data. A company must answer within 45 days, and if it refuses you can appeal and then complain to the Attorney General's Division of Consumer Affairs.
All privacy laws“Under TIPA, Tennessee residents have the right to: ... (3) have a controller delete the personal information the controller obtains about them”
- Applies in
- Tennessee
- In force since
- Companies must answer within
- Within 45 days of receiving your request, according to the Tennessee Attorney General. We couldn't confirm from the statute text whether a company can extend that deadline or how quickly it must answer an appeal, so this page doesn't give those figures.
- Last updated
Head of Product & Co-Founder
Reviewed by Ludwig Sandgren
Head of Legal
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: tn.gov
Last verified against the official page:
Tennessee residents acting in a personal context. According to the Attorney General, a business is covered if it does business in Tennessee or targets Tennesseans, earns more than $25 million in annual revenue, and either handles the personal information of at least 175,000 Tennesseans in a calendar year, or handles data on at least 25,000 while getting 50% of its gross annual revenue from selling it. Nonprofits, state agencies and political subdivisions, financial institutions, HIPAA covered entities and colleges are exempt.
Your rights
-
Confirm and access
Ask a company whether it processes your personal information, and see it.
-
Correct
Have inaccuracies in your personal information fixed.
-
Delete
Have a company delete the personal information it obtains about you. It doesn't have to delete aggregated or de-identified information.
-
Get a portable copy
Get a copy of your personal information in a portable format.
-
Opt out
Stop the company using your personal information for targeted advertising, profiling or sale.
-
Appeal
If a company denies your request, it must tell you why and give you a way to appeal.
-
Consent for sensitive data
A company needs your consent before it processes sensitive data about you.
General information, not legal advice.
How to use it
- 1
Read the privacy notice
Covered companies must explain how you can use your rights, including how to appeal a decision. Look for the request method in the privacy notice.
- 2
Send your request
Say which right you're using: access, correction, deletion, a copy or an opt-out. A line like "Under the Tennessee Information Protection Act, please delete the personal information you hold about me" is enough to start.
- 3
Wait up to 45 days
According to the Attorney General, a company must respond within 45 days of receiving your request.
- 4
Appeal if the company refuses
If the company says no, it has to explain why and give you a process to appeal. Use it and keep copies of every reply.
- 5
Complain to the Division of Consumer Affairs
File a complaint with the Attorney General's Division of Consumer Affairs through its complaint page, which offers an online portal and a form you can send by mail, fax or email.
No answer in time? Complain to Tennessee Attorney General, Division of Consumer Affairs .
Who has to follow TIPA
TIPA is aimed at big companies. According to the Attorney General, a business has to earn more than $25 million a year and handle the personal information of at least 175,000 Tennesseans in a year. A business that gets 50% of its revenue from selling personal information is covered from 25,000 Tennesseans. Both the revenue test and a data test apply, so many smaller data brokers will fall outside it.
What the deletion right covers
The Attorney General's consumer FAQ describes the right as having a company delete "the personal information the controller obtains about" you, minus aggregated or de-identified information. Its business FAQ words the right a little differently, so if a company reads it narrowly, ask it to tell you exactly which data it kept and why.
Before a company can be penalized
The Attorney General enforces TIPA. Before acting it has to give the company written notice and 60 days to fix the problem. A company also has a defense if its privacy program reasonably conforms to the NIST Privacy Framework, a voluntary framework from the federal National Institute of Standards and Technology.
The Attorney General's guidance doesn't mention browser opt-out signals such as Global Privacy Control, so don't count on them in Tennessee. Send each opt-out to each company.
Why a company can say no
According to the Attorney General, nonprofits, state agencies, financial institutions, HIPAA covered entities and colleges are exempt. If a company says it's one of these, that's likely the reason. Our guide on what to do when a company won't delete your data covers the options.
About our sources
Everything on this page comes from the Tennessee Attorney General's TIPA guidance published on April 30, 2025. We couldn't read the statute text itself, so we don't quote section numbers. Check the official code if you need the exact wording.
Where Serus fits
TIPA's revenue test leaves many smaller data brokers out, and those are often the people-search sites that list your address. Serus finds the data brokers that operate where you live, sends the opt-out and removal requests and checks whether you show up again. The steps above are free if you'd rather do them yourself.
Data brokers that list people in United States
Each guide shows how to opt out of that site, step by step.
- Remove yourself from CourtRecords.us
- Remove yourself from TruePeopleSearch
- Remove yourself from Spokeo
- Remove yourself from LexisNexis
- Remove yourself from TruthFinder
- Remove yourself from FastPeopleSearch
- Remove yourself from BeenVerified
- Remove yourself from Intelius
Let Serus send the requests for you
Serus finds the data brokers that list you where you live and removes you from them.
Related
Frequently asked
Who has to comply with TIPA?
According to the Attorney General, businesses with more than $25 million in annual revenue that handle the data of 175,000 or more Tennesseans, or of 25,000 or more while getting 50% of their revenue from selling it.
How long does a business have to respond?
45 days from receiving your request, according to the Attorney General.
How do I complain?
Through the Division of Consumer Affairs complaint portal, or by mail, fax or email with its complaint form.
Who enforces TIPA?
The Tennessee Attorney General. Before taking action it must give the company written notice and 60 days to fix the problem.
Can a business avoid penalties by fixing problems?
Yes. Besides the 60-day right to cure, a company whose privacy program reasonably conforms to the NIST Privacy Framework has an affirmative defense, according to the Attorney General.
Sources
Something wrong or out of date? Tell us and we'll re-check it.