On this page
Tennessee's privacy law mostly does not apply to HIPAA-regulated healthcare. The Tennessee Information Protection Act (TIPA), in effect since July 1, 2025, exempts HIPAA covered entities, their business associates and nonprofit organizations, and it exempts protected health information. It applies only to larger businesses: those with more than 25 million dollars in revenue that also process personal data of 175,000 Tennessee consumers in a year, or 25,000 while earning over half their revenue from selling personal data. A large consumer health app, direct-to-consumer wellness or supplement brand, or med spa or cash-pay group that is not a covered entity can meet that bar, and the agencies and vendors that process its data must work under a written contract. For advertisers that do fall under it, Curve Compliance sends conversions to ad platforms server-side, with consent management, a fixed list of fields per platform and a BAA on every plan.
Is this legal advice? No. This page summarizes the statute and the Tennessee attorney general's guidance, with links to both. Talk to your counsel about how the law applies to your business.
For every state in one place, see the state health privacy laws reference table. Our guides to Montana, Indiana and Texas answer the same question, and managing overlapping state laws covers multi-state setups.
The Tennessee Information Protection Act at a glance
| Question | Answer |
|---|---|
| Statute | Public Chapter 408 of 2023 (House Bill 1181), in Tennessee Code Title 47, Chapter 18 |
| In effect | July 1, 2025 |
| Who must comply | Businesses in Tennessee, or targeting its residents, with over 25 million dollars in revenue that process personal data of 175,000 or more Tennessee consumers in a calendar year, or 25,000 or more while earning over 50% of gross revenue from selling personal data |
| Exempt in healthcare | HIPAA covered entities and business associates; protected health information; health records under Title 68 |
| Nonprofits | Exempt, including entities a nonprofit owns or controls |
| Health data | Sensitive data if it reveals a health diagnosis; consent required |
| Targeted advertising | Opt-out right; no opt-out signal provision in the statute |
| Enforcement | Attorney general only; no private right of action, including class actions |
| Penalty | Up to 7,500 dollars per violation; treble damages for willful or knowing violations |
| Cure period | 60 days |
Who is exempt
The Act does not apply to "a covered entity or business associate governed by the privacy, security, and breach notification rules issued by the United States department of health and human services, 45 CFR Parts 160 and 164 established pursuant to HIPAA," and the HITECH Act. It also exempts "protected health information under HIPAA," "health records for purposes of title 68" and substance use disorder patient records under 42 U.S.C. 290dd-2. The attorney general's FAQ lists the same health exemption.
The nonprofit exemption is wide. The Act defines a nonprofit organization to include a corporation under the Tennessee Nonprofit Corporation Act, any organization exempt from tax under sections 501 to 530 of the Internal Revenue Code, a public utility, and "an entity owned or controlled by a nonprofit organization." Licensed insurance companies are exempt too.
An exemption from TIPA is not an exemption from HIPAA. HHS says covered entities "must comply with the Rules' requirements to protect the privacy and security of health information."
Which health and wellness businesses it can reach
The attorney general says TIPA "generally applies to larger businesses that handle large amounts of data." In health and wellness, the question is HIPAA status. HHS says a health care provider is a covered entity "only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard." If a business is neither a covered entity nor a business associate, "it does not have to comply with the HIPAA Rules." Businesses outside HIPAA that meet the revenue and volume tests can include:
- Large consumer health, fitness and cycle-tracking apps.
- Direct-to-consumer wellness, nutrition and supplement brands.
- Med spa groups, cash-pay clinic chains and subscription telehealth brands that are not covered entities.
- Marketing agencies, analytics companies and ad-tech vendors that process personal data for those brands.
On vendors, the attorney general gives a marketing example: if a retailer "retains a marketing firm to analyze its customer purchase data," the firm "might qualify as a 'processor' under TIPA." The Act requires a written contract that makes the processor keep data confidential, delete or return it at the end, share what the controller needs to show compliance, allow reasonable assessments, and bind any subcontractor to the same terms.
Both tests must be met, and the Act counts Tennessee residents "acting only in a personal context."
Health data is sensitive data, and sensitive data needs consent
The Act defines sensitive data to include personal information revealing a "mental or physical health diagnosis," genetic or biometric data used to identify a person, data from a known child, and precise geolocation, meaning location accurate within a radius of 1,750 feet. A controller may "not process sensitive data concerning a consumer without obtaining the consumer's consent." Consent is "a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement."
Tennessee names a "diagnosis," as Texas does, while Montana also covers a health "condition." Which of your events reveal a diagnosis is a question for counsel. Precise location and biometric data need consent either way.
Targeted advertising: the opt-out right
Consumers can opt out of a controller's processing for "selling personal information about the consumer," "targeted advertising," and certain profiling. Targeted advertising means ads selected from a consumer's activities "over time and across nonaffiliated websites or online applications." It excludes ads based on activity on your own sites, ads based on the current search or page, and "personal information processed solely for measuring or reporting advertising performance, reach, or frequency." A sale is "the exchange of personal information for valuable monetary consideration" to a third party; disclosure to your own processor is not one.
The Act has no provision on opt-out preference signals or browser settings. Your privacy notice must explain how consumers exercise their rights and appeal a refusal, and you must answer requests within 45 days.
Controllers must document a data protection assessment for targeted advertising, the sale of personal information, certain profiling, "the processing of sensitive data" and other high-risk processing. The attorney general says this applies to processing activities "created or generated on or after July 1, 2024."
Book a call. Curve's team will go through what your site sends to ad platforms today and set up server-side conversions with consent rules for each state. Book a call with Curve.
Enforcement, penalties and the cure period
The attorney general and reporter "has exclusive authority to enforce this part." Before acting, the office must give "sixty-days' written notice" of the alleged violations. If the business cures them within 60 days and gives a written statement that they are cured and will not recur, no action follows.
After that, a court can grant a declaratory judgment, an injunction and a civil penalty "of up to seven thousand five hundred dollars" for each violation. If the court finds the violation was willful or knowing, it may award treble damages. The attorney general can also recover attorney fees and investigative expenses. A violation "shall not serve as the basis for, or be subject to, a private right of action, including a class action lawsuit."
The Act also offers an affirmative defense. Per the attorney general, a business qualifies if it keeps a written privacy program that reasonably conforms to the NIST Privacy Framework version 1.0 "or other comparable privacy framework," updates it within two years of a new revision, and gives consumers the rights TIPA requires.
A working checklist for brands in scope
- Decide with counsel whether each business is a covered entity, a business associate, a nonprofit or none of these, and check both scope tests.
- List what your pixels, tags and SDKs send, and flag events tied to a diagnosis or precise location.
- Collect consent before processing sensitive data, and offer a clear opt-out for targeted advertising and sale.
- Put written processor contracts in place and document data protection assessments.
- Consider documenting your program against the NIST Privacy Framework.
Where Curve Compliance fits
For brands in scope in Tennessee, Curve Compliance replaces browser ad pixels with one script and sends conversions from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives a fixed list of fields, and anything else is stripped. Page titles, free text and form answers are never sent, and contact identifiers are off by default and SHA-256 hashed when enabled.
Curve's consent management gives every US state its own opt-in or opt-out rule, records each decision in an audit log, and holds back tracking and ad forwarding for visitors who have not allowed it. Global Privacy Control is honored in every region as a decline of advertising. Curve also flags PHI-like patterns, such as condition names in URLs, before data reaches an ad platform. See what to configure in a consent banner, run the free compliance scanner to see which trackers your site loads, or read about conversion tracking.
Book a call. Curve signs a BAA on every plan, so the same setup serves covered entities and the brands these laws reach. Curve's team does the setup, typically live in about a week. Book a call with Curve.
Frequently Asked Questions
When did the Tennessee Information Protection Act take effect?
July 1, 2025. The attorney general notes that data protection assessments cover processing activities created or generated on or after July 1, 2024.
Does TIPA apply to hospitals and health systems?
Not if they are HIPAA covered entities or business associates, and not if they are nonprofits or owned or controlled by one. HIPAA still applies to covered entities.
Does the Tennessee Information Protection Act apply to small businesses?
Only businesses with more than 25 million dollars in revenue can be covered, and they must also meet a Tennessee consumer count of 175,000, or 25,000 with over half of revenue from selling personal data.
Is health data sensitive data under Tennessee law?
Personal information revealing a "mental or physical health diagnosis" is sensitive data, and processing it requires the consumer's consent.
What are the penalties under TIPA?
Up to 7,500 dollars per violation, and treble damages if a court finds the violation willful or knowing, after a 60-day notice and cure period.
Can consumers sue under the Tennessee Information Protection Act?
No. The Act rules out a private right of action, including a class action lawsuit. Only the attorney general enforces it.