Tennessee
💡 Last Updated October 2025. Written with contributions from both human authors and LLMs. If you find incorrect or outdated information let us know at support@optery.com.
Tennessee's TIPA gives you the right to opt out of data brokers.
What the TIPA does for you
Under the Tennessee Information Protection Act (TIPA), you have the right to know what personal information businesses collect about you, correct inaccuracies, request deletion, get a portable copy of your data, and opt out of the sale of your information, targeted advertising, and certain automated decision-making. These rights apply to Tennessee residents dealing with larger businesses that meet specific revenue or data-processing thresholds.
Your rights under the TIPA
Right to Know
You can ask a business whether it is processing your personal information and request access to that information. The business must respond within 45 days.
Exceptions: does not apply to de-identified or aggregate data not linked to a specific consumer; does not apply to trade secrets; does not apply if the controller cannot authenticate the request using commercially reasonable efforts.
Source: Tenn. Code Ann. § 47-18-3203(a)(2)(A)
Right to Delete
You can ask a business to delete personal information it has about you, whether you provided it directly or it was obtained from another source.
Exceptions: does not apply to aggregate or de-identified data not linked to you; a controller that obtained your data from a third party may comply by opting you out of further processing rather than deleting; does not apply to data needed to comply with legal obligations; does not apply to data needed for security, fraud prevention, or legal claims.
Source: Tenn. Code Ann. § 47-18-3203(a)(2)(C)
Right to Correct
You can ask a business to correct inaccuracies in the personal information it holds about you, taking into account the nature of the data and why it is being processed.
Exceptions: does not apply to de-identified or aggregate data; does not apply if the controller cannot authenticate the request.
Source: Tenn. Code Ann. § 47-18-3203(a)(2)(B)
Right to Opt Out of Sales
You can tell a business to stop selling your personal information to third parties for monetary consideration.
Exceptions: does not apply to disclosures to processors acting on behalf of the controller; does not apply to transfers as part of a merger or acquisition; does not apply to disclosures of information you intentionally made public.
Source: Tenn. Code Ann. § 47-18-3203(a)(2)(E)(i)
Right to Opt Out of Processing
You can opt out of a business using your personal information for targeted advertising — meaning ads chosen based on your activity across different websites and apps.
Exceptions: does not apply to ads based solely on activity within the controller's own website or app; does not apply to contextual ads based on your current search or page visit; does not apply to ads shown in response to your direct request for information.
Source: Tenn. Code Ann. § 47-18-3203(a)(2)(E)(ii)
Right to Opt Out of Automated Decisions
You can opt out of having your personal information used in automated profiling that produces decisions with significant effects on you, such as decisions about credit, housing, insurance, employment, or healthcare.
Exceptions: only applies to profiling in furtherance of decisions that produce legal or similarly significant effects; does not apply to profiling that does not produce legal or similarly significant effects.
Source: Tenn. Code Ann. § 47-18-3203(a)(2)(E)(iii)
Right to Data Portability
You can request a copy of personal information you previously provided to a business in a portable, usable format so you can transfer it to another company.
Exceptions: only applies to information you previously provided to the controller; only applies where processing is carried out by automated means; portability is required only to the extent technically feasible.
Source: Tenn. Code Ann. § 47-18-3203(a)(2)(D)
Right to Non-Discrimination
A business cannot discriminate against you for exercising your privacy rights — it cannot deny you goods or services, charge you different prices, or provide a lower quality of service because you exercised your rights.
Exceptions: does not prevent a business from offering different prices or features tied to a consumer's voluntary participation in a loyalty or rewards program; does not require a business to provide a product or service that requires personal information it does not collect; a business may offer different pricing if the consumer has exercised the opt-out right.
Source: Tenn. Code Ann. § 47-18-3204(a)(5)
Right to Limit Sensitive Data
Businesses must get your consent before processing sensitive personal information about you, such as your race, religion, health diagnosis, sexual orientation, biometric data, precise location, or data about children.
Exceptions: for data about known children, businesses may comply by following federal COPPA requirements instead of obtaining separate consent; does not apply to sensitive data that is de-identified.
Source: Tenn. Code Ann. § 47-18-3204(a)(6)
How to exercise your rights
- See which data brokers have your information. Optery scans 200+ brokers to show you what’s exposed. Start a free scan →
- Submit a TIPA deletion or opt-out request. Covered businesses have 45 days to respond (Tenn. Code Ann. § 47-18-3203(b)), with up to 45 additional days if they invoke the extension provision.
- Let Optery automate the whole process. We submit opt-out and deletion requests on your behalf, track compliance, and resubmit whenever brokers re-add your data. Sign up free →
Authorized agents
The TIPA does not mention authorized agents (Tenn. Code Ann. § 47-18-2101 et seq.). This means data brokers are not required to honor privacy requests submitted by someone other than you personally. Optery can help you submit requests directly — we prepare everything for you; you hit send.
Enforcement and penalties
The TIPA is enforced by Tennessee Attorney General and Reporter. Businesses that violate TIPA can be fined up to $7,500 per violation. If a court finds the violation was willful or knowing, treble (triple) damages may be awarded. Before filing suit, the Attorney General must give the business 60 days' written notice to fix the problem. There is no private right of action — only the Attorney General can bring enforcement actions.
Who does the TIPA apply to?
TIPA applies to businesses that conduct business in Tennessee, produce products or services targeting Tennessee residents, AND (1) exceed $25 million in annual revenue, AND (2) either process personal information of at least 25,000 consumers AND derive more than 50% of gross revenue from selling personal information, OR process personal information of at least 175,000 consumers during a calendar year. Nonprofits, financial institutions covered by Gramm-Leach-Bliley, HIPAA-covered entities, insurance companies, and institutions of higher education are exempt.
Frequently asked questions
Which businesses does TIPA actually cover?
TIPA covers businesses that do business in Tennessee, target Tennessee residents, AND bring in more than $25 million in revenue, AND either handle data on at least 175,000 Tennessee consumers per year OR handle data on at least 25,000 consumers while making more than 50% of their revenue from selling personal information (Tenn. Code Ann. § 47-18-3202). Nonprofits, insurance companies, HIPAA-covered healthcare entities, and higher education institutions are all exempt.
How long does a business have to respond to my privacy request?
A covered business must respond to your verified request within 45 days (Tenn. Code Ann. § 47-18-3203(b)(1)). If your request is complex or you have submitted multiple requests, the business can take one extension of up to 45 additional days, but it must tell you about the extension — and the reason for it — before the first 45 days expire.
Can I sue a business that violates my rights under TIPA?
No. TIPA does not give individual consumers a private right of action or the ability to bring a class action lawsuit (Tenn. Code Ann. § 47-18-3212(e)). Only the Tennessee Attorney General and Reporter can enforce TIPA. If you believe your rights have been violated, you can file a complaint with the Attorney General's office.
What happens if a business ignores my opt-out request or violates the law?
The Tennessee Attorney General must first give the business 60 days' written notice to fix the violation (Tenn. Code Ann. § 47-18-3212(b)). If the business does not cure the problem, the Attorney General can seek civil penalties of up to $7,500 per violation, and a court may award treble damages if the violation was willful or knowing (Tenn. Code Ann. § 47-18-3212(d)).
What counts as 'sensitive data' that requires my consent?
Sensitive data under TIPA includes information revealing your race or ethnicity, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data used to identify you, precise geolocation data (within 1,750 feet), and any personal information collected from a known child (Tenn. Code Ann. § 47-18-3201(26)). Businesses must obtain your consent before processing this type of data.