Tennessee Information Protection Act

Requires $25M+ revenue AND (175,000+ consumers — the highest consumer threshold of any state — OR 25,000+ consumers with 50%+ revenue from selling personal data). Notable for an affirmative defense if you maintain a written privacy program reasonably conforming to the NIST Privacy Framework — no other state offers this. (Note: many secondary sources incorrectly cite this as §47-18-3201 — that section is a repealed, unrelated "Booting Consumer Protection Act" provision; the correct TIPA codification is §47-18-3301 et seq.)