#
Rights exist only at state/sector level; federal consumers outside covered states or sectors lack statutory access/erasure/portability rights.
Sub-modules (5)
Access RightAmber
Each US comprehensive state privacy law establishes a consumer right to access personal data held by covered businesses.
Claims (1):
- Each US comprehensive state privacy law establishes various consumer rights, including the ability to access, correct, and delete personal data held by companies.
Rectification And ErasureAmber
State comprehensive laws grant rights to correct and delete personal data; COPPA gives parents an independent right to require deletion of a child's data.
Claims (2):
- Each US comprehensive state privacy law establishes various consumer rights, including the ability to access, correct, and delete personal data held by companies.
- COPPA gives parents the right to require operators to delete personal information collected from their children.
Restriction And ObjectionAmber
State laws provide opt-out rights for targeted/cross-contextual behavioral advertising, sale of personal data, and profiling.
Claims (1):
- US state comprehensive privacy laws provide consumer opt-out rights for targeted or cross-contextual behavioral advertising, sale of personal data, and profiling.
Data PortabilityAmber
Portability rights are included among the fourteen provisions IAPP tracks across comprehensive state privacy bills; no dedicated federal portability right exists.
Absence provenance: unavailable. Searched: US federal data portability right 2026.
Deadlines And Response WindowsAmber
Response-window specifics vary by state statute (commonly 45 days) and by data-broker deletion mechanisms; California's DROP platform requires brokers to complete deletion sweeps within a defined window.
Claims (1):
- Under California's Delete Act, data brokers on the state registry must complete 45-day deletion sweeps once a consumer submits a request through the DROP platform.
Data Subject Rights
The newly effective Kentucky, Indiana, and Rhode Island comprehensive privacy laws are understood to grant consumers rights to access, correct, delete, and obtain copies of their personal data, consistent with the general rights structure seen in other state comprehensive privacy statutes. However, the specific scope and mechanics of these rights as codified in the Indiana, Kentucky, and Rhode Island statutes have not yet been independently verified against primary statutory text this cycle, and this summary should be read as a qualified account pending that verification.
This continues the pattern established by earlier state comprehensive privacy laws, extending broadly similar access, correction, deletion, and portability rights to residents of three additional states as of January 1, 2026.
Outlook
Independent verification of the specific data-subject-rights provisions in the Indiana, Kentucky, and Rhode Island statutes against primary legislative text remains an open item for a future cycle. Until that verification occurs, the precise contours of these rights, including any exemptions or thresholds, should be treated as provisional.
Sources and claims (4)
- ProbableIAPP — Each US comprehensive state privacy law establishes various consumer rights, including the ability to access, correct, and delete personal data held by companies.observed
- ProbableFTC — COPPA gives parents the right to require operators to delete personal information collected from their children.observed
- ProbableIAPP — US state comprehensive privacy laws provide consumer opt-out rights for targeted or cross-contextual behavioral advertising, sale of personal data, and profiling.observed
- ProbableIAPP — Under California's Delete Act, data brokers on the state registry must complete 45-day deletion sweeps once a consumer submits a request through the DROP platform.observed