Digital privacy laws in the United States are a patchwork, not a single code. There is no federal equivalent of Europe’s General Data Protection Regulation. Instead, federal statutes each cover a specific slice — health records, financial data, children’s information, electronic communications — the Federal Trade Commission polices unfair or deceptive privacy practices across the rest, and 22 states have layered on comprehensive consumer privacy laws that give residents broader rights. What protects you depends on what kind of data is involved, who collected it, and where you live.
Congress has tried to change this. The Consumer Data Privacy and Security Act of 2026 was introduced in the Senate in March 2026 and referred to committee without advancing. Until something like it becomes law, the sector-by-sector structure is the structure.
Which Federal Law Covers Which Kind of Data
The first question is which federal statute, if any, reaches your situation. Each one targets a defined category of information or activity.
Electronic Communications
The Electronic Communications Privacy Act governs surveillance of digital messages. Codified at 18 U.S.C. § 2510, it defines “electronic communication” broadly enough to reach emails, text messages, VoIP calls, and most other digital transmissions.1Office of the Law Revision Counsel. 18 U.S.C. 2510 – Definitions Intercepting one without authorization is a federal crime under 18 U.S.C. § 2511, punishable by a fine and up to five years in prison.2Office of the Law Revision Counsel. 18 U.S.C. 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited
Once a message lands in an inbox or on a server, the Stored Communications Act takes over. Under 18 U.S.C. § 2701, intentionally accessing stored electronic communications without authorization is a crime. Penalties scale with intent: someone who breaks in for commercial advantage or to cause harm faces up to five years on a first offense and up to ten on a second, while unauthorized access without those aggravating factors carries up to one year on a first offense.3Office of the Law Revision Counsel. 18 U.S.C. 2701 – Unlawful Access to Stored Communications Together the two statutes protect messages in transit and at rest.
Health Information
The Health Insurance Portability and Accountability Act governs electronic protected health information through its Privacy and Security Rules at 45 CFR Parts 160 and 164. It applies to “covered entities” — health plans, healthcare clearinghouses, and most healthcare providers that submit claims electronically. The Security Rule requires access controls, unique user IDs, audit logs, integrity protections, and transmission security for electronic records.4eCFR. 45 CFR 164.312 – Technical Safeguards Encryption is an “addressable” safeguard: implement it or document why an equivalent alternative is appropriate.
Civil penalties follow a four-tier structure keyed to culpability. At the lowest tier, where the entity did not know about the violation, fines start at $145 per incident. At the highest tier, willful neglect that goes uncorrected, each violation can cost over $73,000 with an annual cap exceeding $2.1 million. HHS adjusts these amounts annually for inflation.
HIPAA also requires notification of breaches involving unsecured protected health information. Covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovering the breach, describing what happened, what information was involved, what the individual should do, and how to reach the entity for more information.5U.S. Department of Health and Human Services (HHS). Breach Notification Rule For breaches affecting 500 or more people, the entity must also notify HHS and prominent media outlets in the affected area. The FTC’s Health Breach Notification Rule extends similar obligations to health apps and other entities not covered by HIPAA.6Federal Trade Commission. Complying with FTC’s Health Breach Notification Rule
Financial Information
The Gramm-Leach-Bliley Act at 15 U.S.C. §§ 6801–6809 requires every financial institution to protect the privacy of its customers and the confidentiality of their nonpublic personal information.7Office of the Law Revision Counsel. 15 U.S.C. Chapter 94, Subchapter I – Disclosure of Nonpublic Personal Information “Nonpublic personal information” means personally identifiable financial data the consumer provides, that results from a transaction, or that the institution otherwise obtains, excluding publicly available information.8Office of the Law Revision Counsel. 15 U.S.C. 6809 – Definitions That reaches account balances, transaction history, credit reports, and even the fact that someone is a customer of a particular bank.
Institutions must give customers written notices explaining what they collect, share, and protect. Before sharing nonpublic personal information with unaffiliated companies, they must give the customer a chance to opt out. The FTC’s Safeguards Rule adds requirements for non-bank financial institutions like mortgage brokers, tax preparers, and auto dealers that handle financing: a written information security program, a designated coordinator, risk assessments, and oversight of service providers.9Federal Trade Commission. FTC Safeguards Rule: What Your Business Needs to Know Recent amendments to SEC Regulation S-P require broker-dealers and investment advisers to notify customers within 30 days of discovering a breach involving sensitive information.
Children Under 13
The Children’s Online Privacy Protection Act, at 15 U.S.C. §§ 6501–6506, targets data collection from children under 13. It covers commercial websites and online services directed at children and general-audience sites that knowingly collect data from users in that age group.10Office of the Law Revision Counsel. 15 U.S.C. Chapter 91 – Children’s Online Privacy Protection Names, physical and email addresses, and persistent identifiers like tracking cookies are all in scope.
Before collecting any of it, operators must obtain verifiable parental consent. The FTC’s rule at 16 CFR § 312.5 lists acceptable methods, from signed consent forms returned by mail to credit card verification, toll-free calls with trained staff, video conferencing, and government ID checks with facial recognition.11eCFR. 16 CFR 312.5 – Parental Consent Civil penalties adjust annually and stand at over $53,000 per violation as of 2025. A court approved a $10 million settlement in late 2025 against a company the FTC alleged enabled unlawful collection of children’s data.12Federal Trade Commission. Privacy and Security Enforcement
The FTC as the General-Purpose Backstop
Where no sector law applies, the Federal Trade Commission can still act. Section 5 of the FTC Act at 15 U.S.C. § 45 declares unlawful any unfair or deceptive act or practice in or affecting commerce.13Office of the Law Revision Counsel. 15 U.S.C. 45 – Unfair Methods of Competition Unlawful A company that promises in its privacy policy to protect your data and then fails to do so can face enforcement regardless of whether a specific statute covers the situation.
The “unfair” standard requires that the practice causes or is likely to cause substantial injury to consumers, that consumers cannot reasonably avoid it, and that the harm is not outweighed by benefits to consumers or competition. Civil penalties for knowing violations start at up to $10,000 per violation, with each day of continued non-compliance counted separately; settlements frequently run into the millions. The FTC’s enforcement page lists actions against major companies for failing to safeguard personal information, collecting children’s data without proper consent, and breaking promises about data practices.12Federal Trade Commission. Privacy and Security Enforcement That makes the FTC the closest thing the U.S. has to a general privacy enforcer at the federal level.
State Comprehensive Privacy Laws
Twenty-two states have enacted comprehensive consumer privacy laws that go well beyond any single federal statute. They create broad rights over personal data, impose obligations on businesses that collect it, and put enforcement in the hands of state attorneys general. The movement began in 2018 and has accelerated each session since.
The details differ, but the architecture is consistent. These laws generally apply to businesses above certain revenue or data-volume thresholds, exempting small operators. Revenue thresholds typically fall in the $25–27 million range. Alternative triggers count the number of consumers whose data the business handles, often set at 100,000 per year. Businesses that derive a significant share of their revenue from selling personal data face lower consumer-count thresholds.
Enforcement rests with the state attorney general in most states, not with individual consumers. Penalties for intentional violations commonly reach $7,500 per violation, and how a single “violation” is counted can multiply that quickly across thousands of affected consumers. Most states do not give individuals a private right to sue for general privacy violations, with limited exceptions for data breaches involving unencrypted personal information.
Several state laws now require businesses to honor universal opt-out signals like the Global Privacy Control. When enabled in a browser or extension, the signal automatically communicates a “do not sell or share” request to every website you visit, replacing the click-through opt-out on hundreds of sites. Businesses covered by an applicable state law must treat the signal the same as an individual opt-out request.
The Rights You Can Actually Exercise
Across federal and state frameworks, a set of core rights has emerged. Not every right exists under every law, but these are the ones you’re most likely to use.
Access and Right to Know
You can ask a company to disclose what categories of personal data it has collected about you, where it came from, why it was collected, and which third parties received it. Most laws that grant this right also require the specific pieces of information, not just vague category descriptions. Companies generally must respond within 45 days.
Deletion
You can request that a company permanently erase your personal information and direct its service providers to do the same. Exceptions exist for data the company needs to complete a transaction, detect security incidents, comply with legal obligations, or exercise free speech rights. The default is deletion, and the company bears the burden of justifying any exception.
Correction
Most comprehensive state privacy laws give you the right to correct inaccurate personal information a company holds about you. The company must consider the nature of the data and the purpose of the processing when evaluating your request.
Opt Out of Sale or Sharing
You can direct a company to stop selling or sharing your personal information with third parties. Companies must offer a clear mechanism, often a dedicated “Do Not Sell My Personal Information” link. Once a company receives your opt-out, it cannot resume selling your data unless you later authorize it.
Data Portability
When you request a copy of your data, the company must provide it in a structured, commonly used, machine-readable format so you can move it to a competing service.
Protection Against Retaliation
Companies cannot punish you for exercising these rights. Retaliation includes denying goods or services, charging different prices, or providing lower-quality service. A company can offer a financial incentive for the voluntary collection or sale of data, but the program must be clearly disclosed and you must opt in.
What Happens After a Data Breach
All 50 states, the District of Columbia, and U.S. territories have data breach notification laws. They require businesses to notify affected individuals when their unencrypted personal information is compromised. Deadlines vary. The trend has moved toward shorter windows, with several recent laws setting 30 days; older statutes use more flexible language like “without unreasonable delay.”
Federal breach rules stay sector-specific. HIPAA covered entities have up to 60 days from discovery.5U.S. Department of Health and Human Services (HHS). Breach Notification Rule The FTC’s Health Breach Notification Rule reaches health apps and similar entities.6Federal Trade Commission. Complying with FTC’s Health Breach Notification Rule SEC-regulated financial institutions have 30 days under the 2024 amendments to Regulation S-P.
A breach notice should tell you what happened, what data was compromised, what steps to take to protect yourself, and how to contact the company. Many states also require the company to notify the state attorney general when the number of affected individuals exceeds a threshold.
How to File a Complaint or Take Action
If you think a company has violated your privacy rights, filing a complaint with the right enforcer is usually the most effective step. For federal privacy issues, the FTC accepts complaints online and by phone. For a state privacy law, the complaint goes to your state attorney general, who is the sole enforcer in most states. Document everything: screenshots of the company’s privacy policy, your request, and any response you received. Specifics are what give an enforcer enough to act.
Private lawsuits are limited. Only a handful of states allow individuals to sue under their comprehensive privacy laws, and even then the right is typically restricted to data breach claims involving unencrypted personal information rather than general privacy violations. For most people in most situations, the attorney general’s office is the realistic path.