🇺🇸United States

The United States does not have one omnibus privacy law

The United States privacy framework is best understood as a layered system. There is no single federal statute that plays the role of a general data protection law for all organisations and all personal data. Instead, privacy obligations come from federal sectoral laws, state consumer privacy statutes, regulator rules, marketing and communications laws, health privacy rules, financial privacy rules and consumer reporting rules.

This means the first compliance question in the United States is not simply “do we process personal data?” The better question is: what kind of data is involved, who is processing it, why is it being used, where is the consumer located, and which sector-specific rule applies?

The federal privacy layer is sectoral

Several federal laws regulate specific data practices or sectors. HIPAA focuses on protected health information handled by covered entities and business associates. GLBA focuses on nonpublic personal information handled by financial institutions. FCRA governs consumer reports, credit reporting, furnishers, users of reports and related accuracy and permissible-purpose controls. COPPA protects children under 13 in online services. CAN-SPAM regulates commercial email. TCPA regulates certain calls, texts, prerecorded messages, autodialed calls and fax advertising. The CLOUD Act governs cross-border access to electronic communications and records through lawful government process and qualifying executive agreements.

These laws do not operate as a single privacy code. Each has its own scope, definitions, exemptions, enforcement model and compliance vocabulary. A fintech, hospital, edtech platform, advertising business, lender, SaaS provider or marketplace may therefore face very different obligations even when each processes information that looks like “personal data” in ordinary language.

Additional federal coverage on this site includes FTC Act Section 5, ECPA and the Stored Communications Act, FERPA, HITECH, 42 C.F.R. Part 2, the Video Privacy Protection Act, the Privacy Act of 1974, FCC customer proprietary network information rules, the Drivers Privacy Protection Act and the Genetic Information Nondiscrimination Act.

The state privacy layer is now a major compliance programme

Alongside federal law, a large group of states have enacted consumer privacy laws. These laws usually give residents rights such as access, deletion, correction, data portability and opt-out rights for targeted advertising, sale of personal data or certain profiling. They also impose duties on controllers, processors and businesses that decide why and how personal data is processed.

California is the most detailed privacy regime in this site’s United States coverage. The CCPA, as amended and implemented through California Privacy Protection Agency regulations, contains detailed rules on notice, consumer requests, sale, sharing, sensitive personal information, opt-out preference signals, service provider contracts, cybersecurity audits, risk assessments and automated decisionmaking technology.

The site also covers the comprehensive regimes in Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia. Enacted future-effective laws for Oklahoma, Louisiana, Alabama and Vermont are included so organisations can prepare before their operative dates.

Current state-law implementation status

The state-law pages are based on official legislature, code and Attorney General sources. They account for material amendments such as Utah’s July 2026 rights changes, Connecticut’s July 2026 operative text and enacted October 2026 changes, Montana’s October 2025 revision and New Jersey’s June 2026 sensitive-data and data-broker legislation. The source for each database entry points to an official government publication, and the project source register records additional enactments that must be read with a base law.

Specialist state privacy laws still apply alongside comprehensive laws

Broad state privacy statutes do not displace specialist protections. This site separately covers Washington’s My Health My Data Act, Nevada’s consumer health data law, the Illinois and Washington biometric laws, Texas Chapter 503 and California’s Delete Act and data broker requirements. These instruments can apply to a narrower activity with stricter consent, authorization, retention, deletion or enforcement consequences.

California data brokers must now operate through the official DROP system and, from August 1, 2026, retrieve and process deletion requests at least every 45 days. Illinois BIPA uses the current text amended in 2024, while Texas Chapter 503 includes provisions effective January 1, 2026. Proposed bills and draft regulations are not treated as operative law.

Why US privacy compliance is operationally difficult

The difficult part is not only interpreting the law. It is mapping the correct law to the correct workflow. A single organisation may need a California privacy notice, a children’s privacy workflow under COPPA, a GLBA privacy notice for financial services, HIPAA business associate terms for healthcare clients, FCRA controls for credit-related data, TCPA consent records for SMS outreach and CAN-SPAM unsubscribe processes for email campaigns.

Exemptions are also important. State privacy laws often exclude data regulated by HIPAA, GLBA, FCRA, FERPA or other federal laws, but the exemption may apply to the data, the entity, or only a specific activity. Treating every exemption as a full organisational exemption can create serious compliance gaps.

How to approach US privacy readiness

Start by classifying the organisation’s data by sector and use case. Identify whether the data is health data, financial customer information, consumer report information, children’s data, marketing contact data, call or SMS data, general consumer data, sensitive personal data or employee data. Then map the applicable federal and state laws to each processing activity.

For most organisations, the practical build should include a privacy notice architecture, consumer rights workflow, consent and opt-out records, vendor and processor terms, retention controls, security safeguards, incident response procedures and regulator-facing evidence.