-details.jpg)
Data Privacy U.S. State Rankings: Key Findings
Cybercrime cost Americans $16 billion in 2024.
With 322 million Americans online (93% of the population), protecting digital trust is critical for governments and businesses.
DesignRush’s 2025 Data Security Index, now in its second year, ranks all 50 states on how well they protect residents’ personal data.
In the first half of 2025 alone, there have already been 1,732 reported breaches, up 10% from the same period last year.
For brands, these state rankings show where consumers feel safest doing business online.
To understand how privacy protections are developing in the U.S., we tracked three core measures of Americans’ digital safety.
The rise of AI-powered cyber threats means greater financial and reputational risk, even as reported breaches appear to be shrinking.
The minimal 1.8% gain in privacy protection laws shows that regulation is not keeping pace, leaving brands more exposed.
Cybersecurity companies advising clients will need to factor in stronger security messaging, compliance strategies, and consumer trust campaigns.
Against this backdrop, our index reveals which states are giving internet users the strongest protection heading into 2026.
Top 10 Safest States for Internet Users in 2025
The DesignRush Index ranks all 50 states by cybercrime per capita, breach rates, and privacy law strength, assigning each a Data Safety Score out of 100.
1. Kentucky Emerges as Safest State for Internet Users in 2025
Kentucky holds firm in the top spot for the second consecutive year.
It posts the lowest cybercrime rate in the country (134.4 per 100,000) and a near-zero breach rate of 0.07.
A major driver of this success is the Kentucky Consumer Data Protection Act.
In 2025, the AG sued Temu over alleged privacy and data misuse, showing the state enforces its laws.
Businesses that prioritize data safety can look to the Bluegrass State as a strong option for expansion or investment.
2. Montana Rises to #2, Cutting Data Breach Rate by 70% in 2025
Montana jumps seven spots after cutting its breach rate by more than 70%.
The state's Consumer Data Privacy Act brought broad rights and universal opt-out support.
Recently, State Sen. Daniel Zolnikov proposed safeguards for neural data, saying consumers should always “own their ideas and thoughts.”
Marketers targeting Montana residents should ensure their campaigns support Global Privacy Control signals.
They should also avoid collecting sensitive data without clear, documented user consent.
3. Tennessee Holds #3 With Breaches Reduced by Half in 2025
Tennessee retained its number three ranking by halving breaches and introducing an NIST-aligned “safe harbor.”
“This law protects consumers while giving businesses clear expectations,” said AG Jonathan Skrmetti.
For marketers and SaaS operators, following NIST-based security practices provides liability protection.
It also builds customer trust by showing clients and partners that their data is handled responsibly.
4. New Jersey Secures 4th Spot as Breach Rate Falls 72%
After years of lagging, New Jersey leapt nine spots by slashing its breach rate to 0.12 and passing the Data Privacy Law.
“These are some of the strongest protections in the nation,” said AG Matthew Platkin.
If you market in New Jersey, you must now treat opt-outs as universal and audit any nonprofit collaborations to ensure compliance.
5. Utah Breaks Into Top 5 With New AI Disclosure Law
Utah kept breaches low and passed an AI Policy Act requiring disclosure of AI use.
Though cybercrime rose slightly, the state remains a quiet leader in tech-sector data governance.
Businesses must now disclose AI use in customer-facing tools.
This makes it crucial for marketers to build privacy into automation and personalization strategies from the get-go.
6. Iowa Leads Nation With Lowest Data Breach Rate in 2025
Iowa now reports the lowest data breach rate in the U.S., even as cybercrime ticks upward.
The new Iowa Consumer Data Protection Act, effective January 2025, gives residents access, deletion, and opt-out rights.
“In our digital age, it’s never been more important to state, clearly and unmistakably, that consumers deserve a reasonable level of transparency and control over their personal data,” said Gov. Kim Reynolds.
Marketers should retool customer experiences in Iowa to center around data access and deletion requests.
Make sure to keep in mind that these rights are enforceable under the new law.
7. Texas Climbs to #7 After Cutting Breaches 65%
Texas cut breaches sharply from 0.26 to 0.09. It also filed the nation’s first DNA privacy lawsuit.
In August 2024, Texas sued a genetics testing company for mishandling consumer DNA data.
If you process consumer data in Texas, be prepared to register as a data broker if applicable and document your handling practices clearly to avoid scrutiny.
8. Minnesota Rises to #8 as Breach Rate Cut by Over Half
Minnesota’s steady improvements in breach prevention and a new comprehensive law earned it a spot in the top 10.
“Minnesota is now one of 19 states that have comprehensive consumer data privacy laws[…] Ours is among the strongest consumer data privacy laws in the country,” said Attorney General Keith Ellison.
Local marketers should honor Global Privacy Control signals and adjust targeting if using nonprofit or education data, which is now covered under the state’s law.
9. Virginia Falls to #9 as Cybercrime Surges 36%
An early leader, Virginia holds its position through consistent law enforcement and oversight.
It dropped in rank, though, as cybercrime rose to 198.2 per 100,000.
The state continues to demand explicit consent for sensitive data use.
Businesses operating in Virginia should secure clear consent for biometric and genetic data to avoid penalties.
10. Connecticut Rises to #10 as Breach Rate Drops by Two-Thirds
Connecticut jumps nine places after cutting its breach rate by two-thirds.
It became the first state to issue a public fine under its privacy law, mandating Global Privacy Control support and regulating biometric and smart device tracking.
Marketers should review tracking, facial recognition, and smart device integrations carefully, as these features now fall under the state's expanded regulatory scope.
Privacy Law Is Changing How We Market
From AI disclosures to opt-out protocols, the laws governing digital information are reshaping business operations.
These top 10 states demonstrate that data privacy is a brand value and a marketing necessity.
Brands that want to succeed will have to bake privacy into their messaging, their technology, and their customer experience by default.
What We Measured (and Why)
To make this ranking meaningful and transparent, we weighed and normalized the data using trusted public sources:
For comparison, we also included last year’s 2024 scores, so you can see which states are improving, stagnating, or falling behind.
This is the second year DesignRush has published this ranking.
View the 2024 Data Security Index here to see how states have improved (or worsened) since 2024.
