Data Privacy Regulations in the US: Federal, State, and Your Rights

Data privacy regulations in the United States do not come from one master statute. Federal law covers specific industries — health care, banking, children’s online services, schools, and electronic communications — while roughly 20 states have passed broad consumer privacy laws that apply across industries. Every state, plus the District of Columbia and U.S. territories, also requires businesses to notify people after a data breach. Which rules protect your information depends on where you live, what kind of data is involved, and who is holding it.

Congress has considered comprehensive federal privacy legislation, including the American Data Privacy and Protection Act in 2022 and the SECURE Data Act introduced in 2026, but no such bill has become law. Until that changes, the federal floor is the sector-specific set of statutes below, and state law does most of the work on general consumer data.

Federal Laws by Industry

Federal privacy law in the U.S. is sectoral. Each statute targets a category of sensitive information and is enforced by a specific agency.

Health Information

The Health Insurance Portability and Accountability Act sets national standards for “protected health information.” It covers doctors, hospitals, pharmacies, health insurers, and health care clearinghouses that process claims electronically.¹ Those covered entities must put administrative and technical safeguards in place to prevent unauthorized access to medical records.² Civil penalties are tiered by the violator’s level of awareness and adjusted annually for inflation, with the top tier reaching $2,190,294 per violation for uncorrected willful neglect in 2026.³

Financial Records

Banks, lenders, insurance companies, and investment advisors are governed by the Gramm-Leach-Bliley Act. GLBA requires financial institutions to explain their information-sharing practices to customers and to maintain a security program protecting sensitive financial data.⁴ The FTC’s Safeguards Rule, which implements the security side of the statute, now also requires notification to the FTC within 30 days of discovering a breach affecting 500 or more consumers.⁵

Children Under 13

The Children’s Online Privacy Protection Act applies to websites and online services directed at children under 13, and to any service with actual knowledge it is collecting information from a child.⁶ Operators must get verifiable parental consent before collecting personal information, which the rule defines broadly to include names, addresses, phone numbers, photos, voice recordings, geolocation, and persistent identifiers like cookies and IP addresses.⁷ The FTC enforces COPPA, and violations carry civil penalties up to $53,088 per violation.⁸

Student Records

The Family Educational Rights and Privacy Act protects education records at any school receiving federal funding, from elementary schools through universities. Parents, or students once they turn 18, can inspect records, request corrections, and control disclosure of personally identifiable information. Schools have 45 days to respond to access requests. Instead of monetary fines, the Department of Education can withhold federal funding from institutions that violate the rules.⁹

Electronic Communications

The Electronic Communications Privacy Act of 1986 protects wire, oral, and electronic communications in transit and while stored. Its Title II, the Stored Communications Act, governs when law enforcement can obtain stored emails, subscriber records, and IP addresses from service providers. Some information can be pulled with a subpoena; email content generally requires a search warrant.¹⁰ The statute predates cloud storage and modern email, but it remains the primary federal law on government access to digital communications.

State Comprehensive Privacy Laws

Because Congress hasn’t acted broadly, states have. About 20 states have comprehensive consumer privacy statutes in force, with more taking effect through 2026 and beyond. Unlike the federal sector laws, these apply to personal data across industries.

California Set the Template

The California Consumer Privacy Act, expanded by the California Privacy Rights Act, applies to for-profit businesses that do business in California and meet any one of three thresholds: gross annual revenue over $25 million, buying, selling, or sharing personal information of 100,000 or more California residents or households, or deriving 50 percent or more of annual revenue from selling personal information.¹¹ The CPRA also created the California Privacy Protection Agency, the first state agency dedicated entirely to privacy enforcement.¹²

Other States

Virginia’s Consumer Data Protection Act uses different thresholds: it applies to businesses that control or process data of at least 100,000 consumers, or at least 25,000 consumers if the business derives over half its revenue from selling that data. The Attorney General has exclusive enforcement authority, penalties reach $7,500 per violation, and businesses get a 30-day cure period before enforcement can begin.¹³ Connecticut, Colorado, Texas, Oregon, Indiana, Kentucky, Nebraska, and more than a dozen other states have their own versions. The scope and thresholds differ, but the architecture is shared: broad definitions of personal data, a set of consumer rights, and obligations on businesses that process large volumes of it.

These laws define personal data more broadly than the federal sector statutes. Browsing history, biometric identifiers, geolocation data, and inferences drawn from other data all count. Most laws apply to any business that either operates in the state or targets its residents, so an online company can end up subject to several state laws at once.

Rights These Laws Give You

State comprehensive laws, and some federal statutes, converge on a common set of consumer rights. The details differ by jurisdiction.

Know and Access

You can ask a business what personal data it has collected about you, where it came from, why it was collected, and which third parties received it. California businesses must accept these requests up to twice a year at no charge.¹¹ Virginia’s law grants similar access, including a portable copy of the data in a format you can move to another company.¹³

Delete and Correct

You can ask a business to delete personal data it collected from you or fix inaccuracies. The correction right matters more than people notice. Inaccurate data fed into automated systems can shape credit decisions, insurance pricing, and job screening without a human ever reviewing the error.

Opt Out of Sale and Targeted Advertising

Most comprehensive state laws let you tell a business to stop selling or sharing your personal data with third parties, including for targeted advertising. California requires businesses that sell personal information to post a conspicuous “Do Not Sell or Share My Personal Information” link.¹¹ Virginia allows opt-outs from targeted advertising, data sales, and profiling that produces legal or similarly significant effects.¹³

Global Privacy Control is a browser signal that automatically communicates your opt-out preference to every website you visit. California, Colorado, Connecticut, Texas, Oregon, Delaware, and several other states now legally require businesses to honor GPC as a valid opt-out request. Unlike the older Do Not Track signal, GPC has legal force.

Non-Discrimination

Businesses cannot punish you for exercising these rights by charging higher prices, providing worse service, or denying you access to their products.

Response Deadlines

When you submit a rights request in California, a business has 10 business days to acknowledge it and 45 calendar days to respond substantively. Complex requests can be extended once for another 45 days, up to 90 days total. Opt-out requests must be acted on within 15 business days.

Data Breach Notification

Every state, the District of Columbia, and U.S. territories require businesses to notify consumers when a security breach exposes their personal information. Definitions and deadlines vary, and the trend has been toward shorter windows. Several states, including Texas and California, require notice within 30 days of discovering a breach.

At the federal level, businesses under the GLBA Safeguards Rule must notify the FTC within 30 days of discovering a breach involving unencrypted information of 500 or more consumers.⁵ HIPAA-covered entities must notify the Department of Health and Human Services. The FTC’s breach response guidance also recommends contacting local law enforcement, and the U.S. Postal Inspection Service when mail theft is involved.¹⁴

In California, consumers whose unencrypted personal information is exposed in a breach caused by a business’s failure to maintain reasonable security can sue for statutory damages of $100 to $750 per consumer per incident, or actual damages if greater.¹⁵ For a breach affecting millions of records, those per-consumer amounts compound quickly.

Who Enforces These Laws

Enforcement runs on two tracks.

Federal

The Federal Trade Commission is the primary national privacy enforcer. It uses Section 5 of the FTC Act, which prohibits unfair or deceptive acts or practices, to bring cases against companies that break their privacy promises or maintain unreasonably lax security.¹⁶ The FTC doesn’t enforce a single privacy statute; it applies this broad consumer protection authority to privacy and security failures. Penalties for knowing violations of FTC rules or final orders reach $53,088 per violation.⁸

State

State Attorneys General are the front-line enforcers of comprehensive state privacy laws. Most frameworks let the AG investigate, subpoena, seek injunctions, and impose civil penalties. Virginia caps penalties at $7,500 per violation and requires the 30-day cure window before suit.¹³ California has the dedicated CPPA, which can audit and bring enforcement actions independently of the Attorney General.¹² California’s penalty amounts were adjusted in 2025 to $2,663 per unintentional violation and $7,988 per intentional violation or per violation involving data of consumers the business knows are under 16.¹⁷ Per-violation figures look small in isolation, but enforcement actions typically target patterns affecting thousands or millions of consumers.

Private Lawsuits

Most state privacy laws do not give individual consumers a right to sue. California is the main exception, and only for breaches, through the statutory damages provision noted above.¹⁵ Class action attorneys watch large California breaches closely for that reason.

Automated Decision-Making and AI

As algorithms and AI increasingly decide things about people, privacy law is beginning to reach them. Several state laws give consumers the right to opt out of automated profiling, particularly when it produces legal or similarly significant effects such as loan approvals, hiring decisions, or insurance pricing. Virginia’s law includes this right explicitly.¹³

California’s Privacy Protection Agency has proposed rules requiring businesses to provide opt-out mechanisms for automated decision-making in contexts like job applicant screening, student evaluation, and behavioral advertising. The proposal also covers facial recognition and Wi-Fi tracking in public spaces such as shopping malls and stadiums. Businesses would be exempt only when the technology is used for security, fraud detection, or consumer safety, and even then would have to explain to the consumer why the opt-out isn’t available. The area is moving quickly, and businesses running AI systems that touch consumer data should expect the rules to keep tightening.

1
U.S. Department of Health and Human Services. Covered Entities and Business Associates
2
U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule
3
Federal Register. Annual Civil Monetary Penalties Inflation Adjustment
4
Federal Trade Commission. Gramm-Leach-Bliley Act
5
Federal Trade Commission. Safeguards Rule Notification Requirement Now in Effect
6
Federal Trade Commission. Children’s Online Privacy Protection Rule (COPPA)
7
eCFR. 16 CFR Part 312 – Children’s Online Privacy Protection Rule
8
Federal Register. Adjustments to Civil Penalty Amounts
9
U.S. Department of Education. FERPA – Protecting Student Privacy
10
Bureau of Justice Assistance. Electronic Communications Privacy Act of 1986 (ECPA)
11
Office of the Attorney General – State of California. California Consumer Privacy Act (CCPA)
12
California.gov. California Privacy Protection Agency
13
Virginia Code Commission. Chapter 53 – Consumer Data Protection Act
14
Federal Trade Commission. Data Breach Response: A Guide for Business
15
California Legislative Information. Cal. Civ. Code 1798.150
16
Federal Trade Commission. Federal Trade Commission Act
17
California Privacy Protection Agency. California Privacy Protection Agency Announces 2025 Increases