State PIRG Summary of State Security Freeze and Security Breach Notification Laws
State PIRG Main Consumer Page State PIRG Model Identity Theft Law Page U.S. PIRG Home Page State PIRGs Home Page Updated 18 July 2006

Credit Report and Identity Theft Pages Home

1) Prevent ID Theft Page

2) Clean Up ID Theft Page

3) All About Bureaus and Credit Reports Page

State Model Law Page

We updated this page 18 July 2006. Please send updates/errors to this page to edm (ATSIGN) pirg (dot) org (convert to an address). As of that date, 25 states have enacted legislation that either already grants or will soon give all or some consumers the right to prevent identity theft by placing a security freeze on their credit reports. Twenty (20) states have enacted laws that already or will give all their residents the right to a security freeze: California, Colorado, Connecticut, Delaware, Florida, Illinois, Kentucky, Louisiana, Maine, Minnesota, Nevada, New Hampshire, New Jersey, New York, North Carolina, Oklahoma, Rhode Island, Utah, Vermont and Wisconsin. An additional 5 states currently provide this option only to ID theft victims -- Hawaii, Kansas, South Dakota, Texas and Washington State (WA victims definition includes consumers who've received a security breach notice.)

In response to numerous security breaches, and to the failure of credit bureaus and creditors to give consumers control over their confidential consumer information that leads to credit card fraud, debit card/checking account fraud and identity theft, a number of states are also enacting a variety of other identity theft laws to protect consumers. This page also summarizes state activity on security breach notification laws, which require companies and other entities (often, state agencies) that have lost data to notify affected consumers.

These state security freeze and security breach notification laws are based on the state PIRG/Consumers Union Clean Credit and Identity Theft Model Act.

Summary of State Security Freeze and Security Breach Notification Laws

Generally, fees listed, if any, are for "any consumer." Victims of identity theft, and in some cases, senior citizens, do not pay fees, even in states with fees for others. Generally, victims must provide either a "police report" or an "identity theft report" to prove their victim status. Not all police departments take "police reports" from identity theft victims. To obatin a security freeze right, you can generally instead file a simpler identity theft report (more information available here from FTC). Ask the credit bureau for a form to fill out and send in.

Security freezes protecting you from identity theft can be temporarily lifted, unfrozen or thawed, when you seek credit yourself. The terms mean the same thing.

State Security Freeze Laws:

California: available for all consumers.

Passed: September 2001.

Effective: January 1, 2003.

Freeze Fee: none for victims, others pay up to $10 per freeze.

Thaw (or Temporary Lift) Fee: $10 for temporary lifting for a given period, $12 for temporary lift for one creditor.

Colorado: available for all consumers.

Passed: June 2005

Effective: July 1, 2006.

Freeze Fee: none for first freeze, $10 per subsequent freeze.

Thaw (or Temporary Lift) Fee: $10 for temporary lifting for a given period, $12 for temporary lift for one creditor.

Connecticut: available for all consumers.

Passed: June 24, 2005.

Effective: January 1, 2006.

Freeze Fee: $10.

Thaw (or Temporary Lift) Fee: $10 for temporary lifting for a given period, $12 for temporary lift for one creditor.

Delaware: available for all consumers.

Passed: June 24, 2005.

Effective: September 28, 2006

Freeze Fee: $20.

Thaw (or Temporary Lift) Fee: free to temporarily lift for a given period or for a specific creditor.

Florida: available for all consumers.

Passed: April 2006.

Effective: July 1, 2006.

Freeze Fee: none for victims of identity theft with investigative report or seniors aged 65+.  For others, the fee is $10.

Thaw (or Temporary Lift) Fee: $10 to temporarily lift or remove.

Hawaii: available only for victims of identity theft with a police investigative report or complaint filed with a law enforcement agency.

Passed: April 2006.

Effective: January 1, 2007.

Freeze Fee: none.

Thaw (or Temporary Lift) Fee: none.

Illinois: After January 1, 2007, the freeze will be available for all consumers.  Prior to this date, the law only applies to identity theft victims.

Passed: May 24, 2006

Effective: January 1, 2007.

Freeze Fee: none for seniors 65+, $10 for others.

Thaw (or Temporary Lift) Fee: none for seniors 65+, $10 for others to remove or temporarily thaw.

Kansas: available only for victims of identity theft with a policy investigative report or a complaint filed with a law enforcement agency.

Passed: April 2006.

Effective: January 1, 2007.

Freeze Fee: none.

Thaw (or Temporary Lift) Fee: none.

Kentucky: available for all consumers.

Passed: March 24, 2006.

Effective: July 1, 2006.

Freeze Fee: none for victims of identity theft with a police report, $10 for others.  Note: the freeze expires 7 years from date of placement.

Thaw (or Temporary Lift) Fee: none for victims of identity theft with a police report, $10 for others to remove, temporarily thaw, or have PIN reissued.

Louisiana: available for all consumers.

Passed: 2004.

Effective: July 1, 2005.

Freeze Fee: none for victims of identity theft or individuals age 62 or older, $10 for others.

Thaw (or Temporary Lift) Fee: none for victims of identity theft, $8 for others.

Maine: available for all consumers.

Passed: May 2005.

Effective: February 1, 2006.

Freeze Fee: none for victims of identity theft who provide a police report, $10 for others.

Thaw (or Temporary Lift) Fee: none for victims of identity theft who provide a police report, $10 to remove, temporarily thaw, or have PIN reissued, and $12 to lift for a specific creditor.

Minnesota: available for all consumers.

Passed: May 2006.

Effective: August 1, 2006.

Freeze Fee: none for victims of identity theft who provide a police report, $5 for others.

Thaw (or Temporary Lift) Fee: none for victims of identity theft who provide a police report; for others, $5 to remove, temporarily thaw, have PIN reissued, or lift for a specific creditor.

Nevada: available for all consumers.

Passed: June 2005.

Effective: October 1, 2005.

Freeze Fee: none for victims of identity theft who provide a police report, $15 for others.

Thaw (or Temporary Lift) Fee: none for victims of identity theft who provide a police report; for others, $18 to remove and $20 to lift for a specific creditor.

New Hampshire: available for all consumers.

Passed: May 2006.

Effective: January 1, 2007.

Freeze Fee: none for victims of identity theft who provide a police report, investigative report, or complaint to a law enforcement agency, and $10 for others.

Thaw (or Temporary Lift) Fee: none for victims of identity theft who provide a police report, investigative report, or complaint to a law enforcement agency, and $10 for others.

New Jersey: available for all consumers.

Passed: September 22, 2005.

Effective: January 1, 2006.

Freeze Fee: none for initial freeze

Thaw (or Temporary Lift) Fee: up to $5 to remove, thaw, or have PIN reissued. 

Note: requested can be made directly to consumer reporting agencies via email.

New York: available for all consumers.

Passed: June 2006.

Effective: November 1, 2006.

Freeze Fee: none for initial freeze, and, for non-victims, $5 for subsequent freezes.

Thaw (or Temporary Lift) Fee: none for victims of identity theft, $5 for others. 

Oklahoma: available for all consumers.

Passed: May 2006.

Effective: January 1, 2007.

Freeze Fee: none for victims of identity theft or seniors 65+, $10 for others.

Thaw (or Temporary Lift) Fee: none for victims of identity theft or seniors 65+, $10 for others. 

Note: to find the bill, click “Oklahoma,” select Senate, 2006 Regular Session and Enrolled—then click search.  Scroll to SB 1748.

North Carolina: available for all consumers.

Passed: September 21, 2005.

Effective: December 1, 2005.

Freeze Fee: none for victims of identity theft, $10 for others.

Thaw (or Temporary Lift) Fee: none for victims of identity theft, $10 for others to remove or temporarily thaw.

Rhode Island: available for all consumers.

Passed: June 30, 2006.

Effective: September 28, 2006.

Freeze Fee: none for victims of identity theft or seniors 65+, $10 for others.

Thaw (or Temporary Lift) Fee: none for victims of identity theft or seniors 65+, $10 for others to remove or temporarily thaw.

South Dakota: available for victims of identity theft with a police report.

Passed: March 2006.

Effective: July 1, 2006.

Freeze Fee: none. 

Thaw (or Temporary Lift) Fee: none.

Note: the freeze expires 7 years from the date of placement or upon consumer’s request.

Texas: available for victims of identity theft with a police report.

Passed: June 2003.

Effective: September 1, 2003.

Freeze Fee: none. 

Thaw (or Temporary Lift) Fee: none.

Utah: available for all consumers.

Passed: March 2006.

Effective: September 1, 2008.

Freeze Fee: “reasonable” rates. 

Thaw (or Temporary Lift) Fee: “reasonable” rates.

Vermont: now is available for all consumers (before July 1, 2006, only for identity theft victims).

Passed: originally approved June 2004.

Effective: originally July 1, 2005.

Freeze Fee: None for victims, up to $10 others

Thaw (or Temporary Lift) Fee: None for victims, up to $5 others

Washington: available for identity theft victims, including persons who receive a notice of a security breach of computerized personal information.

Passed: May 2005.

Effective: July 24, 2005.

Freeze Fee: none. 

Thaw (or Temporary Lift) Fee: none.

Wisconsin: available for all consumers.

Passed: March 16, 2006.

Effective: January 1, 2007.

Freeze Fee: none for an “individual who submits evidence satisfactory to the CRAs that the individual made a report to a law enforcement agency,” and up to $10 for others. 

Thaw (or Temporary Lift) Fee: none for an “individual who submits evidence satisfactory to the CRAs that the individual made a report to a law enforcement agency,” and up to $10 for others to remove or temporarily thaw. 

State Security Breach Laws: We only know about the ChoicePoint security breach because of a California law requiring businesses, nonprofits, and state public institutions to notify consumers when their personal information has been compromised.   As of July 18, 2006 at least 34 states have passed security breach notification laws. Had a weaker, "risk-based" trigger law been in place in California, it is likely we would not have learned about ChoicePoint or other subsequent breaches.

Acquisition-based trigger--means strong consumer-oriented notification requirement based on loss of information.

Risk-based trigger--means loss of information does not trigger notice automatically. Notice is subject to some analysis by breached entity of the degree of risk to consumers before notice is required. Some risk-triggers are more consumer-friendly than others. (For example, S 1789 and HR 4127 as proposed in the 2006 Congress require a presumption of notice unless "no risk" exists. Weaker laws require some risk before notice.)

Note also that some state breach notice laws may only apply to breaches by corporations and/or other private entities, or to state agencies but not to both. Other state laws may unnecessarily exempt certain institutions, such as financial instiutions covered by weak federal financial agency breach notice rules (even though those federal rules explicitly allow stronger state laws).

Arkansas

Trigger: risk-based.

Arizona

Trigger: risk-based.  

California

Trigger: acquisition-based.  

Colorado

Trigger: risk-based.  

Connecticut

Trigger: risk-based.  

Delaware

Trigger: acquisition-based.  

Florida

Trigger: acquisition-based.  

Georgia (data brokers only)

Trigger: acquisition-based  

Hawaii

Trigger: acquisition-based 

Idaho

Trigger: risk-based.  

Illinois

Trigger: acquisition-based.  

Indiana (state agencies only)

Trigger: acquisition-based.  

Kansas

Trigger: risk-based (note: does not take effect until January 1, 2007).  

Louisiana

Trigger: risk-based.  

Maine (Information brokers only)

Trigger: acquisition-based.  

Minnesota

Trigger: acquisition-based (note: does not apply to financial institutions or HIPAA entities).

Montana

Trigger: risk-based.  

Nebraska

Trigger: risk-based.  

Nevada

Trigger: acquisition-based.  

New Hampshire

Trigger: risk-based. (note: not in effect until January 1, 2007).  

New Jersey

Trigger: risk-based. 

New York

Trigger: acquisition-based.  

North Carolina

Trigger: risk-based.  

North Dakota

Trigger: acquisition-based.  

Ohio

Trigger: risk-based.  

Oklahoma (state agencies only)

Trigger: acquisition-based.  

Pennsylvania

Trigger: risk-based.  

Rhode Island

Trigger: acquisition-based (note: does not include HIPAA entities).

Tennessee

Trigger: acquisition-based.  

Texas

Trigger: acquisition-based.  

Utah

Trigger: risk-based (note: does not take effect until January 1, 2007).  

Washington

Trigger: risk-based.  

Wisconsin

Trigger: risk-based.  

PIRG's Reports and Materials On Threats To State Authority To Enact Stronger Consumer and Environmental Laws
Return to the state PIRG Main Credit Reporting and Identity Theft Page.