Two Tennessee laws worth knowing before you automate.

The Tennessee Information Protection Act

Tennessee’s comprehensive privacy law took effect on July 1, 2025. According to the Attorney General, it applies to a business that does business in Tennessee or targets its residents, earns more than $25 million in annual revenue, and either processes the personal information of at least 175,000 Tennessee consumers in a year, or processes at least 25,000 consumers’ information while getting more than half its revenue from selling it.

Most small businesses are outside it, because both conditions must be met. It still matters to you if your larger customers or partners are covered, because they will ask how you handle the data they share.

The Attorney General has exclusive authority to bring actions under the law, and a court can impose civil penalties of up to $7,500 per violation.

The ELVIS Act

The Ensuring Likeness Voice and Image Security Act, signed in March 2024, added a person’s voice to Tennessee’s existing protection for their name, photograph, and likeness. The state described it as a response to AI tools that can clone how someone sounds.

It is not only a music-industry law.Any business that uses a generated voice, a sound-alike, or a real person’s likeness in marketing or on a phone line is in the territory it covers. Use your own voice or a clearly synthetic one, and get documented permission before using anyone else’s.

Federal rules still apply

Tennessee law sits alongside federal rules that often matter more to a small business: health information under HIPAA for healthcare practices, fair-housing rules for real estate, and professional confidentiality duties for law and accounting firms. The industry pages cover the ones relevant to each trade.