Note: This article is for informational purposes only and is not legal advice.
If you work in privacy, compliance, ad tech, product, or basically any job that involves the phrase “Can Legal take a quick look at this?”, July 2025 was not exactly a sleepy summer month. It was more like a compliance obstacle course wearing flip-flops. New Jersey hit an important universal opt-out milestone. Tennessee’s privacy law went live on July 1. Minnesota arrived on July 31 with sharper profiling rights. Vermont’s new Kids Code started its rulemaking runway. Texas, never one to enter a room quietly, pushed AI governance into the privacy conversation with TRAIGA. And California kept doing California things by moving major automated decision-making, risk assessment, and cybersecurity rules forward in late July.
In other words, July 2025 was not just another month in the state privacy patchwork. It was a month that showed where U.S. privacy law is heading next: less patience for vague notices, more pressure for real operational controls, tighter standards for children’s data, sharper rules around profiling and automated tools, and a growing overlap between privacy governance and AI governance.
Why July 2025 Mattered So Much
Privacy law in the United States used to be easy to describe and hard to love. There was no single national omnibus law, and companies mostly worked through a patchwork of sectoral rules, state statutes, and enforcement risk. By July 2025, that patchwork had become a full quilt, and the stitching got more complicated.
What made July stand out was not just that laws existed on paper. July was about activation. Deadlines hit. Obligations became operational. Product teams had to think about defaults. Marketing teams had to think about browser-based opt-out signals. Data teams had to revisit profiling, retention, and minimization. Engineering teams had to translate legal language into workflows, toggles, logs, and controls. Privacy had moved from the policy page to the build queue.
Vermont’s Kids Code Put Design, Not Just Disclosure, Under the Microscope
Vermont’s Age-Appropriate Design Code Act, often called the Vermont Kids Code, was one of the most talked-about youth privacy developments of the summer. Signed in June 2025, it gave privacy professionals plenty to digest in July because its rulemaking provisions kicked in on July 1, even though the law’s broader operative date lands later.
What makes Vermont different?
First, Vermont is not aiming at kids under 13 only. The law covers minors under 18, which is a much broader category than the classic federal COPPA framework. Second, the law does not merely say “please write a better privacy notice” and call it a day. It goes straight at product design and data practices.
Covered businesses offering online services, products, or features likely to be accessed by minors have to set default privacy settings to the highest level of privacy for covered minors. The law also restricts collection, sale, sharing, or retention of a minor’s personal data unless it is necessary for the service the minor is actively and knowingly using. It limits the use of a minor’s personal data for algorithmic recommendations except in narrow, user-driven circumstances. It bars certain late-night push notifications. And it requires a conspicuous signal when a minor’s activity or location is being monitored, even by a parent or guardian.
That last point is especially notable. Vermont is not treating privacy as a purely backend compliance issue. It is treating privacy as part of the user experience. In plain English: if you track, recommend, nudge, or notify minors, the state wants those choices to be intentional, constrained, and visible.
Why companies paid attention in July
Even though the law’s general effective date is later, July 2025 mattered because the rulemaking runway had started. Companies were no longer looking at a hypothetical kids-design law. They were looking at a real statute with real obligations and future attorney general rules on age assurance and compulsive-use design practices. For social platforms, gaming services, streaming apps, edtech tools, and youth-heavy communities, that meant one thing: waiting politely was not a strategy.
The practical takeaway is simple. Vermont is part of a broader U.S. trend toward privacy by default and safety by design for minors. If your product team still treats youth privacy as a checkbox in the footer, Vermont is basically sending a legal postcard that says, “That won’t do.”
NJDPA Turned a July Date Into a Real-World Engineering Problem
New Jersey’s comprehensive privacy law had already taken effect in January 2025, but July 15 was the deadline that made many compliance teams spill coffee on their keyboard. By that date, controllers had to honor consumer opt-out signals sent through universal opt-out mechanisms.
This matters because a universal opt-out signal is not the same thing as a tiny “Do Not Sell or Share” link buried where only archaeologists can find it. It is a more automated, user-selected signaloften browser or device basedthat tells a business the consumer wants out of certain processing, especially data sales and targeted advertising.
In practical terms, NJDPA forced companies to answer hard operational questions:
- Can our sites and apps detect valid opt-out preference signals?
- Do those signals propagate correctly across consent tools, ad tech stacks, and internal data flows?
- Are our privacy notices and request workflows actually aligned with what the systems do?
- Can we prove compliance if a regulator asks awkwardly specific questions?
New Jersey also gives consumers familiar rights: access, correction, deletion, portability, and the ability to opt out of targeted advertising, data sales, and certain profiling activities. But July’s big story was not the existence of those rights. It was the moment when passive compliance stopped being good enough. A law becomes much more interesting when it demands technical recognition of user signals rather than just legal promises written in a calm serif font.
Another reason NJDPA deserves attention is that it reflects the maturing U.S. privacy model. More states are moving beyond static disclosures and toward standardized consumer controls. That may sound boring, but in privacy law, “boring” is often just another word for “wildly expensive to retrofit later.”
Tennessee’s TIPA Went Live on July 1
On July 1, 2025, the Tennessee Information Protection Act officially took effect. That gave July an immediate headline: one more state had moved from draft decks and webinars into active compliance territory.
TIPA looks familiar in some ways. Consumers get rights to confirm whether their data is being processed, access it, correct inaccuracies, delete it, obtain a portable copy, and opt out of targeted advertising, profiling, or sale. Controllers must provide privacy notices, limit collection to what is relevant and reasonably necessary, and obtain consent for sensitive data.
But Tennessee also brought its own twist: an affirmative defense tied to a written privacy program that reasonably conforms to the NIST Privacy Framework or another comparable framework. That is a pretty loud signal that Tennessee wants businesses to build structured privacy governance rather than wing it with a couple of policy PDFs and a prayer.
For privacy teams, TIPA’s arrival meant that governance maturity suddenly mattered more. If your organization had data maps, risk reviews, documented policies, and a framework-based privacy program, Tennessee looked manageable. If your privacy strategy was “we have a cookie banner and optimism,” July probably felt longer than usual.
Minnesota Arrived on July 31 With Stronger Profiling Rights
Just when July looked ready to sit down, Minnesota entered the chat. The Minnesota Consumer Data Privacy Act took effect on July 31, 2025, and it is especially interesting because of how it treats profiling and significant automated decisions.
Like other state privacy laws, Minnesota gives consumers rights to access, correct, delete, obtain their data, and opt out of targeted advertising, sale, and profiling tied to legal or similarly significant effects. But Minnesota goes a step further. Consumers have the right to question a profiling result, learn why the profiling led to the decision, review the personal data used, and seek correction and reevaluation if the decision relied on inaccurate data.
That is not just a privacy notice issue. It is a model governance issue. It is documentation. It is explainability. It is process design. It is cross-functional work between legal, analytics, engineering, trust and safety, and anyone else who has ever used the phrase “the model says so.”
Minnesota therefore matters beyond its borders. It shows how state privacy law is increasingly intersecting with automated decision-making oversight. The old idea that privacy rules stop at collection, notice, and deletion is fading fast. Profiling is now a front-and-center topic, and July 31 helped prove it.
TRAIGA Made AI Governance a Privacy Issue Too
Then there is Texas. The Texas Responsible Artificial Intelligence Governance Act, or TRAIGA, was signed on June 22, 2025, but it became a major July talking point because businesses immediately started planning for its January 1, 2026 effective date.
TRAIGA is not a copy of Colorado’s AI law, and it is not just “privacy law wearing a robot costume.” Its structure is different. The statute focuses heavily on prohibited practices, government use cases, enforcement powers, and a regulatory sandbox program, rather than building a purely risk-tiered compliance architecture.
Key themes include bans or limits on AI used to intentionally manipulate behavior in dangerous ways, unlawfully discriminate, support unconstitutional infringements, enable certain social scoring by government, or facilitate certain biometric and sexually explicit misuse scenarios. The law also gives the Texas Attorney General enforcement authority and creates a sandbox framework for testing innovative AI systems under specified guardrails.
So why does an AI governance statute belong in a privacy roundup? Because privacy teams will end up doing a lot of the homework anyway. AI systems rely on personal data, sensitive data, training data, outputs, monitoring, vendor terms, testing, and documentation. The same organizations that manage privacy risk often manage the early governance layers around data quality, bias controls, retention, access restrictions, and human review. TRAIGA did not politely knock on privacy’s door. It walked in and asked where the documentation lives.
In that sense, TRAIGA symbolized a broader truth of July 2025: the wall between privacy compliance and AI compliance is getting thinner. In some companies, it is already drywall dust.
And More: California, Maryland, and Nebraska Stayed Busy
If that were not enough, California also kept the regulatory treadmill moving. On July 24, 2025, the California Privacy Protection Agency board approved a major package of rules covering automated decision-making technology, cybersecurity audits, and risk assessments. It also continued advancing work tied to the Delete Act’s data broker deletion mechanism. Translation: California was still California, which is to say, never exactly resting.
For companies already juggling New Jersey, Tennessee, Minnesota, and Vermont, California’s July moves were a reminder that the privacy future is not just about honoring consumer requests. It is about proving governance around high-risk data use, security posture, and automated tools.
Maryland also stayed on the radar. Its Online Data Privacy Act was not yet effective in July 2025, but businesses were already preparing for the October 1, 2025 start date. Maryland’s law stood out because of its stronger data minimization approach and more restrictive stance on certain sensitive and youth-related data practices. Smart teams were already planning ahead rather than waiting for autumn to become dramatic.
Nebraska deserves a mention too. Its Age-Appropriate Online Design Code Act, signed in May 2025, added another signal that youth-focused design rules were not a one-state experiment. Even where details differ, the trend is clear: states increasingly want products used by minors to be built with privacy and safety defaults, not retrofitted after the fact.
What July 2025 Meant for Businesses in Real Life
If you zoom out, July 2025 told businesses three important things.
1. Privacy by default is no longer a slogan
Vermont, Maryland, California, and several youth-safety proposals all point in the same direction. Regulators are less impressed by long notices and more interested in what the product actually does by default.
2. Opt-out rights now require technical muscle
NJDPA’s July milestone made that obvious. If your stack cannot recognize and honor standardized opt-out signals, your compliance program is basically a PowerPoint with ambitions.
3. AI governance is merging with privacy governance
Minnesota’s profiling rights, California’s ADMT rules, and Texas’s TRAIGA all point to the same reality: businesses can no longer separate “data privacy” from “automated decision-making” as if one lives in legal and the other lives in a magical data science cave.
Experience From the Privacy Trenches: What July 2025 Felt Like
Here is the part that rarely makes it into statutory summaries: July 2025 felt like a month when privacy work became intensely human. Not because the laws were soft or sentimental. Quite the opposite. The laws were technical, layered, and often maddeningly specific. But inside companies, the real experience was a long series of conversations between people trying to turn abstract legal language into daily decisions.
For privacy counsel, July felt like translating three dialects at once. One conversation was with marketing teams asking whether universal opt-out signals would affect campaign measurement, audience building, and retargeting. Another was with product leaders who wanted a practical answer to questions like, “When you say highest privacy setting, how high is high?” A third was with engineers who were trying very hard to be cooperative while also gently reminding everyone that systems do not magically rebuild themselves because a statute has excellent intentions.
For engineering and data teams, July felt like the month when “privacy requirement” stopped meaning “add a paragraph to settings.” Suddenly it meant event logs, suppression logic, account-state design, flag hierarchies, consent propagation, profiling reviews, retention limits, and browser signal handling. The work was not cinematic. Nobody kicked down a door yelling, “Deploy the opt-out parser!” But the pressure was real. Quietly real. Spreadsheet real. Ticket queue real.
For product managers, July 2025 was a lesson in how law changes user experience. Vermont’s Kids Code, for example, was not merely about what data a company could hold. It was about what features should do by default, who could see whom, when notifications should fire, and whether monitoring was visible. That pushes privacy upstream into design choices. Suddenly, a roadmap discussion about friend suggestions, messaging permissions, or recommendation tuning could become a legal-risk discussion before lunch.
For executives, July felt like the month when privacy and AI stopped being separate briefing topics. Minnesota, California, and Texas all helped make that obvious. If a model influences a meaningful decision, if an algorithm ranks or recommends, if a system uses sensitive data, or if a product relies on automated logic that affects people in a serious way, privacy and AI governance start sharing the same conference room. Usually with too few chairs.
And for consumers, even if they never read a statute number in their life, July 2025 mattered because the legal changes were inching closer to something they can actually feel. More meaningful opt-out controls. Greater rights around profiling. Stronger defaults for minors. More accountability for data-heavy systems. Privacy law still moves slower than the internet, which is admittedly like saying a bicycle moves slower than a meteor. But July showed that state lawmakers are trying to make digital products behave a little less like surveillance machines and a little more like services with boundaries.
That is probably the biggest “experience” lesson from the month. July 2025 did not just add more legal text. It changed the daily experience of building, marketing, auditing, and governing digital products. Privacy got less theoretical. More operational. More product-centered. More technical. More exhausting. Also, for teams that like order, controls, and reasonable data practices, weirdly satisfying.
Final Takeaway
July 2025 was a turning-point month in the U.S. privacy landscape because it showed how the modern state-law wave is evolving. The new pressure points are not only collection and disclosure. They are defaults, signals, profiling, algorithmic systems, age-appropriate design, data minimization, and governance frameworks that companies can actually run.
Vermont’s Kids Code showed how far youth privacy can extend into product design. NJDPA made universal opt-out recognition a real operational demand. Tennessee pushed structured governance through its framework-oriented approach. Minnesota raised the stakes for profiling and meaningful review. TRAIGA pulled AI into the same risk conversation. California kept expanding the infrastructure around risk assessments, ADMT, and deletion rights. Maryland and Nebraska made clear that more change was already on deck.
So yes, July 2025 was a roundup month. But it was also a preview month. If this is where state privacy law was heading in mid-2025, the message for businesses was obvious: build smarter systems now, or prepare to do expensive emergency repairs later. And in compliance, emergency repairs are rarely fun unless your hobby is reading statutes with cold pizza nearby.