Every U.S. state has a law requiring companies to notify residents when their personal information is exposed in a data breach — but the details vary significantly from state to state: how fast a company must notify you, what counts as "personal information," and whether the state Attorney General must also be notified.
We actively monitor filings across 16 states. Here's how notification laws generally work, and what to know about the states we track.
What Data Breach Notification Laws Generally Require
While the specifics differ by state, most data breach notification statutes share a common structure:
A trigger for notification
Typically, notification is required when unencrypted personal information — like a Social Security number, driver's license number, or financial account number combined with a name — is reasonably believed to have been accessed by an unauthorized party.
A notification deadline
Most states require notice "without unreasonable delay," and a growing number set a hard cap — commonly somewhere between 30 and 60 days from discovery, depending on the state.
An Attorney General filing requirement
Many states require companies to also notify the state Attorney General's office directly, often when the breach affects more than a set number of residents. This is the exact filing data our registry tracks.
Required contents of the individual notice
Most states require the notice to describe what happened, what data was involved, and what protective steps are being offered — as covered in our guide on how to read a data breach notification letter.
States We Actively Monitor
Our registry tracks daily Attorney General filings across the following states. Each state's AG office publishes breach notifications a little differently — some post searchable databases, others publish periodic filings — which is exactly why we built a single registry to track them all in one place:
Why This Matters for You
If you received a data breach notification letter, the state where you live — and the state where the breach was filed — can affect:
- How much detail the company was legally required to give you
- Whether the state Attorney General is actively reviewing the incident
- In some cases, whether you have additional rights under your state's specific consumer protection or data breach statutes
This is part of why we cite the exact state and filing date on every case file in our registry — it's not just a formality, it can matter for understanding your situation.
Find cases filed in your state
Our registry tracks breach filings across 16 states. Search by company name or filter by state to see what's been filed near you.
Browse the Registry →Frequently Asked Questions
Do all states require data breach notification?
Yes — all 50 states, along with the District of Columbia and several U.S. territories, have data breach notification laws. However, the specific requirements — timelines, thresholds, and definitions of "personal information" — vary by state.
Does my state's law affect whether I can join a class action?
It can. State law can affect what claims are available and what has to be proven. This is something worth discussing with an attorney rather than assuming based on general information. A free case review can help determine your specific situation and options.
What's the difference between notifying me and notifying the Attorney General?
Individual notice is meant to inform the people directly affected. Attorney General notice creates a public regulatory record — which is exactly the data source this registry is built on. A company can be required to do both.
Why do some breaches only get filed in certain states?
Filing requirements are typically triggered by where affected residents live, not where the company is headquartered. A breach affecting residents in multiple states often gets filed with multiple state Attorneys General separately, which is why the same breach sometimes appears in more than one state's records.