US Regulatory Landscape at a Glance
The United States does not have one comprehensive federal privacy law covering all personal data across every industry. Instead, organisations may be subject to different requirements depending on their location, business activities, the types of information they process, and the sectors in which they operate.
A business may need to comply with several laws simultaneously, including state consumer privacy legislation, federal consumer protection requirements, healthcare privacy rules, financial privacy obligations, and cybersecurity or breach notification requirements.
- Jurisdiction
- United States
- Key privacy frameworks
- CCPA/CPRA and other applicable state privacy laws
- Key regulatory authorities
- Federal Trade Commission (FTC), California Privacy Protection Agency (CPPA), California Attorney General, US Department of Health and Human Services (HHS), and relevant state Attorneys General and sector regulators.
Key US Privacy and Regulatory Frameworks
California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)
The CCPA, as amended by the CPRA, establishes privacy rights and business obligations for covered organisations handling the personal information of California residents.
Depending on applicability, obligations may include:
- Providing appropriate privacy notices.
- Responding to applicable consumer privacy requests.
- Supporting rights to know, delete, and correct personal information.
- Providing required opt-out mechanisms for the sale or sharing of personal information.
- Honouring applicable opt-out preference signals, including Global Privacy Control where required.
- Assessing sensitive personal information requirements.
- Managing service-provider, contractor, and third-party relationships.
- Implementing reasonable security practices and meeting applicable accountability requirements.
The California Privacy Protection Agency and California Attorney General have regulatory responsibilities under the California privacy framework.
Organisations should assess the applicable statutory thresholds, exemptions, and requirements rather than assuming that every business handling California residents' data is automatically covered.
Other State Comprehensive Privacy Laws
A growing number of US states have enacted comprehensive consumer privacy legislation. These laws differ in scope, applicability thresholds, exemptions, consumer rights, and enforcement mechanisms.
Relevant examples include privacy laws in Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, New Jersey, Maryland, and other states with applicable legislation.
Depending on the jurisdiction and applicable law, organisations may need to address:
- Consumer access, correction, deletion, and portability requests.
- Opt-outs from targeted advertising, sales of personal data, or certain profiling activities.
- Privacy notices and transparency obligations.
- Data minimisation and purpose limitation.
- Assessments for certain high-risk processing activities.
- Consent requirements for specified data or processing activities.
- Contractual requirements for processors and other service providers.
- Appeals processes for certain consumer privacy requests.
Requirements vary by state, and new laws or amendments may introduce additional obligations. Businesses operating nationally should maintain a state-by-state compliance register and verify the requirements applicable to their activities.
Federal Trade Commission Act
Section 5 of the Federal Trade Commission Act prohibits unfair or deceptive acts or practices within the FTC's jurisdiction.
Privacy and data security practices may raise concerns where an organisation makes misleading privacy representations, fails to honour relevant commitments, or engages in practices considered unfair under applicable law.
Organisations should ensure that their privacy notices, consent interfaces, security claims, advertising practices, and actual data handling are consistent.
The FTC's authority is subject to statutory jurisdictional limits and does not replace every other federal or state regulatory regime.
Health Insurance Portability and Accountability Act (HIPAA)
HIPAA establishes privacy and security requirements for protected health information handled by covered entities and business associates within its scope.
Applicable organisations may need to address:
- Permitted uses and disclosures of protected health information.
- Privacy and security policies and procedures.
- Administrative, physical, and technical safeguards.
- Risk analysis and risk management.
- Business associate agreements.
- Individual rights and applicable access procedures.
- Breach assessment and notification.
- Workforce training and compliance documentation.
HIPAA does not apply to every organisation that processes health-related information. Businesses should determine whether they qualify as covered entities or business associates and whether other federal or state health privacy laws apply.
Gramm-Leach-Bliley Act (GLBA)
The GLBA establishes privacy and safeguarding requirements for covered financial institutions.
Depending on the organisation and applicable rules, requirements may include privacy disclosures, restrictions on certain information-sharing practices, safeguards for customer information, and oversight of service providers.
The FTC and relevant federal banking and financial regulators have responsibilities under different parts of the financial privacy and safeguards framework.
Organisations should identify the specific GLBA provisions and implementing rules relevant to their business activities.
Children's Online Privacy Protection Act (COPPA)
COPPA applies to covered operators of websites and online services directed to children under 13 and certain other operators with actual knowledge that they collect personal information from children under 13.
Applicable requirements may include:
- Providing notices about data collection and use.
- Obtaining verifiable parental consent where required.
- Giving parents applicable rights concerning their children's information.
- Limiting collection, use, and retention of personal information.
- Implementing reasonable safeguards.
- Managing third-party service providers and data disclosures appropriately.
Businesses offering apps, games, educational technology, or other online services should evaluate whether COPPA and additional state children's privacy laws apply.
Family Educational Rights and Privacy Act (FERPA)
FERPA protects the privacy of education records at educational agencies and institutions that receive funds under applicable US Department of Education programmes.
Relevant obligations may concern access to education records, disclosure restrictions, parental and eligible student rights, and institutional record-handling practices.
Organisations providing technology or services to educational institutions should assess their role, contractual arrangements, and applicable restrictions before processing education records.
Sarbanes-Oxley Act (SOX)
SOX establishes corporate governance, financial reporting, and internal control requirements for covered public companies and other entities within its scope.
While it is not a general consumer privacy law, its internal control requirements may affect systems that support financial reporting, data integrity, access management, and audit evidence.
Organisations should distinguish SOX-related control requirements from privacy obligations and coordinate them where the same systems or processes are involved.
State Data Breach Notification Laws
All US states, along with certain US territories and other jurisdictions, have data breach notification requirements. Definitions of covered information, notification triggers, deadlines, and recipient requirements differ.
Depending on the incident and applicable laws, an organisation may need to notify affected individuals, state Attorneys General, consumer reporting agencies, or other entities.
Businesses should maintain a breach response process that identifies the potentially applicable jurisdictions, evaluates notification requirements, preserves evidence, and coordinates legal, security, privacy, and communications teams.
Consumer Privacy Rights in the United States
Consumer rights vary depending on the applicable law and individual circumstances. Under covered privacy frameworks, rights may include:
Right to Know or Access
Consumers may have rights to obtain information about certain personal data collected, processed, disclosed, or retained by a business.
Right to Delete
Consumers may be able to request deletion of personal information, subject to applicable exceptions and legal retention requirements.
Right to Correct
Some state privacy laws provide rights to request correction of inaccurate personal information.
Right to Data Portability
Where applicable, consumers may request personal information in a portable format.
Right to Opt Out
Depending on the applicable law, consumers may be able to opt out of the sale of personal information, targeted advertising, or certain profiling activities.
Rights Relating to Sensitive Information
Some laws establish additional requirements or rights concerning sensitive personal information, such as precise geolocation, health information, biometric data, or other protected categories.
Protection Against Discrimination
Applicable laws may restrict discriminatory treatment because a consumer exercises their privacy rights.
Organisations should map the specific rights and response requirements applicable to each relevant jurisdiction rather than adopting a single process without evaluating state-level differences.
US Compliance Considerations for International Businesses
Companies based outside the United States may still be subject to US privacy or sector-specific laws if their activities fall within the relevant legal scope.
Determine State-Level Applicability
Assess whether your business meets the thresholds or other conditions for applicable state privacy laws. Consider the types and volumes of personal information processed and the nature of your commercial activities.
Review Data Collection and Advertising Practices
Evaluate tracking technologies, targeted advertising, sale or sharing of personal information, consent mechanisms, and opt-out preference signals where relevant.
Establish Consumer Request Workflows
Create documented procedures to receive, verify, route, and respond to applicable consumer privacy requests within the relevant statutory deadlines.
Review Vendor and Contractual Arrangements
Identify service providers, processors, advertising partners, and other recipients of personal information. Review contracts and data-sharing arrangements against applicable requirements.
Prepare for Security Incidents
Develop incident response procedures that account for different state breach notification laws and any additional federal or sector-specific obligations.
Monitor Regulatory Developments
Track new state laws, amendments, regulations, enforcement decisions, and implementation dates that may affect your business.
How RegulatoryBridge Supports US Compliance
RegulatoryBridge helps organisations assess US regulatory obligations and coordinate privacy and compliance activities across their domestic and international operations.
US Privacy Compliance Assessment
Review relevant data processing activities, privacy notices, consumer rights workflows, data-sharing arrangements, and organisational controls to identify potential compliance gaps.
Multi-State Privacy Programme
Map potentially applicable state privacy laws, identify differences in requirements, and coordinate a compliance programme across relevant jurisdictions.
Consumer Privacy Request Management
Review intake, identity verification, request routing, response workflows, and recordkeeping for applicable consumer rights requests.
Cookie Consent and Advertising Privacy
Assess cookie consent interfaces, tracking practices, privacy disclosures, opt-out mechanisms, and applicable requirements for advertising technologies.
Data Breach Readiness
Review incident response procedures, escalation processes, evidence handling, and applicable notification requirements across relevant jurisdictions.
Sector-Specific Compliance Coordination
Coordinate privacy-related activities with applicable healthcare, financial services, children's privacy, education, and corporate governance requirements.
Regulatory Monitoring and Risk Management
Monitor relevant regulatory developments and support the review of policies, processes, and remediation priorities as applicable requirements change.
The scope of support depends on the relevant laws, service arrangements, and the responsibilities that may lawfully be performed by RegulatoryBridge.
Our Approach to US Regulatory Compliance
- 01
Map Your US Operations
Identify your business activities, customer locations, data categories, processing purposes, and applicable industry requirements.
- 02
Determine Applicable Laws
Assess potentially applicable federal and state frameworks, thresholds, exemptions, and sector-specific obligations.
- 03
Assess Compliance Gaps
Review privacy notices, data inventories, consumer request procedures, vendor contracts, advertising technologies, and security controls.
- 04
Develop a Compliance Roadmap
Prioritise actions according to legal applicability, business risk, implementation effort, and relevant deadlines.
- 05
Monitor and Improve
Review regulatory changes and update your compliance programme as your business expands or applicable requirements evolve.
Frequently Asked Questions
Build a Structured US Compliance Programme
Managing US privacy obligations requires a practical understanding of federal laws, state-specific requirements, industry rules, and changing enforcement expectations.
RegulatoryBridge can help your organisation identify relevant requirements, assess potential compliance gaps, and coordinate a structured approach to US privacy and regulatory risk management.