United States (federal)
Full entry AI-checked Checked 5 November 2026
| Law | Citation | Status | In force from |
|---|---|---|---|
| Federal Trade Commission Act, section 5 | 15 U.S.C. 45 | In force | 26 September 1914 |
| Children’s Online Privacy Protection Act (COPPA) and COPPA Rule | 15 U.S.C. 6501–6506; 16 CFR Part 312, as amended at 90 FR 16918 (22 April 2025) | In force | 21 April 2000 |
| CAN-SPAM Act of 2003 | 15 U.S.C. 7701–7713; 16 CFR Part 316 | In force | 1 January 2004 |
| Telephone Consumer Protection Act (TCPA) | 47 U.S.C. 227; 47 CFR 64.1200 | In force | 20 December 1992 |
| HIPAA Privacy, Security and Breach Notification Rules | Pub. L. 104-191, as amended by the HITECH Act; 45 CFR Parts 160 and 164 | In force | 14 April 2003 |
| Gramm-Leach-Bliley Act (GLBA), Title V | 15 U.S.C. 6801–6809; Regulation P (12 CFR Part 1016); FTC Safeguards Rule (16 CFR Part 314) | In force | 13 November 2000 |
| Protecting Americans’ Data from Foreign Adversaries Act of 2024 | Pub. L. 118-50, div. I; 15 U.S.C. 9901 | In force | 23 June 2024 |
| DOJ Data Security Program (bulk sensitive data rule) | 28 CFR Part 202 (90 FR 1636, 8 January 2025), under Executive Order 14117 | In force | 8 April 2025 |
| TAKE IT DOWN Act | Pub. L. 119-12 | In force | 19 May 2025 |
| Children and Teens’ Online Privacy Protection Act (COPPA 2.0) | S. 836, 119th Congress | Draft, not law | — |
| Kids Internet and Digital Safety Act (KIDS Act) | H.R. 7757, 119th Congress | Draft, not law | — |
- Federal Trade Commission Act, section 5: Bans unfair or deceptive acts or practices, the FTC’s main power over privacy and data security. The wording on unfair or deceptive practices dates from a 1938 amendment.
- Children’s Online Privacy Protection Act (COPPA) and COPPA Rule: The amended Rule took effect on 23 June 2025, and most of its changes had to be complied with by 22 April 2026.
- CAN-SPAM Act of 2003: Rules for commercial email.
- Telephone Consumer Protection Act (TCPA): Rules for marketing calls and texts, enforced by the FCC, state attorneys general and private lawsuits.
- HIPAA Privacy, Security and Breach Notification Rules: Applies only to health plans, health care clearinghouses, providers that carry out standard electronic transactions, and their business associates. A proposal to tighten the Security Rule, issued in December 2024, is still pending.
- Gramm-Leach-Bliley Act (GLBA), Title V: Applies to financial institutions, defined by their activities, including many non-bank lenders, brokers and tax preparers. The privacy rules took effect on 13 November 2000, with full compliance required from 1 July 2001.
- DOJ Data Security Program (bulk sensitive data rule): Due diligence, audit and reporting duties apply from 6 October 2025.
- TAKE IT DOWN Act: Platforms hosting user content had until 19 May 2026 to set up a notice-and-removal process for non-consensual intimate images, including AI-generated ones.
- Children and Teens’ Online Privacy Protection Act (COPPA 2.0): Passed the Senate on 5 March 2026 and awaits House action. It would extend COPPA’s protections to teens aged 13 to 16. Not law.
- Kids Internet and Digital Safety Act (KIDS Act): Passed the House 267–117 on 29 June 2026 and was referred to the Senate Commerce Committee on 13 July 2026. It bundles House versions of the Kids Online Safety Act and COPPA 2.0 with AI chatbot disclosures for minors and age checks for sites where over a third of content is sexual material harmful to minors. Not law.
Regulators
Section titled “Regulators”- Federal Trade Commission (FTC)
- Federal Communications Commission (FCC), for the TCPA
- Department of Health and Human Services, Office for Civil Rights (HIPAA)
- Department of Justice, National Security Division (Data Security Program)
What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”No comprehensive federal privacy law exists; the SECURE Data Act (H.R. 8413) has been in committee since 21 April 2026. Rules are sectoral and sit alongside state laws. The FTC Act covers most businesses, but not banks, common carriers or most non-profits. COPPA covers services directed to under-13s or that know a user is under 13. HIPAA covers health plans, clearinghouses, providers doing standard electronic transactions, and their business associates. 42 CFR Part 2 covers federally assisted substance use programs (revised rules from 16 February 2026). GLBA covers financial institutions.
Sources: govinfo.gov/content/pkg/USCODE-2024-title15/html/USCODE-2024-title15-… · govinfo.gov/content/pkg/USCODE-2024-title15/html/USCODE-2024-title15-… · govinfo.gov/content/pkg/USCODE-2024-title15/html/USCODE-2024-title15-… · ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312 · hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html · govinfo.gov/content/pkg/FR-2024-02-16/html/2024-02544.htm · govinfo.gov/content/pkg/USCODE-2024-title15/html/USCODE-2024-title15-… · govinfo.gov/bulkdata/BILLSTATUS/119/hr/BILLSTATUS-119hr8413.xml · govinfo.gov/bulkdata/PLAW/119/public
Lawful bases
Section titled “Lawful bases”There are no GDPR-style lawful bases. Under the FTC Act, data practices must not be deceptive or unfair, so privacy notices must be accurate and promises kept. COPPA needs verifiable parental consent. HIPAA needs written authorisation for uses and disclosures the Privacy Rule doesn’t otherwise permit or require, such as most marketing and any sale of health data. GLBA financial institutions must give notice and a chance to opt out before sharing data with unaffiliated third parties. The TCPA needs prior express written consent for marketing robocalls and robotexts.
Sources: govinfo.gov/content/pkg/USCODE-2024-title15/html/USCODE-2024-title15-… · ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312 · govinfo.gov/content/pkg/CFR-2025-title45-vol2/pdf/CFR-2025-title45-vo… · hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html · govinfo.gov/content/pkg/USCODE-2024-title15/html/USCODE-2024-title15-… · govinfo.gov/content/pkg/CFR-2025-title47-vol3/pdf/CFR-2025-title47-vo…
Consent age for online services
Section titled “Consent age for online services”COPPA treats anyone under 13 as a child. Services directed to children, or that know a user is under 13, need verifiable parental consent before collecting the child’s personal information, apart from narrow exceptions. Since 22 April 2026, disclosing a child’s data to third parties, for example for targeted advertising, needs a separate parental consent unless the disclosure is integral to the service. There is no federal teen rule yet.
Sources: govinfo.gov/content/pkg/USCODE-2024-title15/html/USCODE-2024-title15-… · ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312 · federalregister.gov/documents/2025/04/22/2025-05904/childrens-online-…
Children
Section titled “Children”The amended COPPA Rule (in effect 23 June 2025, compliance by 22 April 2026) adds biometric and government-issued identifiers to personal information and requires a written children’s information security program with annual risk assessments and a published retention policy, with no indefinite retention. Mixed-audience services can age-screen before collecting data. Still pending are COPPA 2.0, passed by the Senate in March 2026; the KIDS Act, with House versions of COPPA 2.0 and KOSA, passed by the House in June 2026; and KOSA itself, ordered reported by Senate Commerce on 5 August 2026.
Sources: ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312 · federalregister.gov/documents/2025/04/22/2025-05904/childrens-online-… · govinfo.gov/bulkdata/BILLSTATUS/119/s/BILLSTATUS-119s836.xml · govinfo.gov/bulkdata/BILLSTATUS/119/hr/BILLSTATUS-119hr7757.xml · govinfo.gov/bulkdata/BILLSTATUS/119/s/BILLSTATUS-119s1748.xml
Cookies and similar technologies
Section titled “Cookies and similar technologies”No federal cookie-consent rule. On services directed to children, cookies and other persistent identifiers count as personal information under COPPA, so behavioural advertising or profiling needs verifiable parental consent; support for internal operations is exempt. HIPAA-covered entities may disclose health information to tracking vendors only with authorisation or under a Privacy Rule permission, such as a business associate agreement; a June 2024 ruling vacated part of HHS’s guidance. Video services generally need separate, informed consent to disclose what an identifiable person watched.
Sources: ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312 · ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-… · hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-trackin… · govinfo.gov/content/pkg/USCODE-2024-title18/html/USCODE-2024-title18-… · govinfo.gov/content/pkg/USCODE-2024-title15/html/USCODE-2024-title15-…
Electronic marketing
Section titled “Electronic marketing”CAN-SPAM makes commercial email opt-out. Avoid false headers and misleading subjects, label it as an ad, give a postal address and working opt-out, and honour opt-outs within 10 business days. TCPA marketing calls and texts by autodialer or artificial or prerecorded voice, AI voices included, need prior express written consent. Respect the Do Not Call Registry and 8 a.m. to 9 p.m. hours, and honour revocations within 10 business days. From 25 November 2026 callers may set one clearly disclosed way (key press, STOP-type reply, or a set website or number); otherwise any reasonable means counts.
Sources: govinfo.gov/content/pkg/USCODE-2024-title15/html/USCODE-2024-title15-… · ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-bus… · govinfo.gov/content/pkg/CFR-2025-title47-vol3/pdf/CFR-2025-title47-vo… · govinfo.gov/content/pkg/FR-2026-10-26/html/2026-21821.htm · docs.fcc.gov/public/attachments/FCC-24-17A1.pdf
Breach notification
Section titled “Breach notification”No general federal breach law; state laws apply. HIPAA covered entities must notify affected people without unreasonable delay and within 60 days of discovery, and HHS within 60 days (500 or more people) or within 60 days of year-end (fewer); media notice applies above 500 residents of a state. Business associates must tell the covered entity within 60 days. The FTC Health Breach Notification Rule sets matching deadlines for health apps outside HIPAA. Non-bank financial institutions must tell the FTC within 30 days of discovering a breach of unencrypted data on 500 or more consumers.
Sources: hhs.gov/hipaa/for-professionals/breach-notification/index.html · ftc.gov/business-guidance/resources/complying-ftcs-health-breach-noti… · ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-bus…
Registration and fees
Section titled “Registration and fees”There is no federal registration or fee for processing personal data; data broker registries, where they exist, are state rules. Telemarketers calling consumers must pay to access the National Do Not Call Registry. For the year from 1 October 2026 the first five area codes are free, then it costs $85 per area code, up to $23,425. The DOJ data rule adds reports in some cases, such as reporting a rejected offer of a prohibited transaction.
Sources: ecfr.gov/current/title-16/chapter-I/subchapter-C/part-310/section-310.8 · govinfo.gov/content/pkg/FR-2026-08-26/html/2026-17428.htm · justice.gov/nsd/data-security
Data protection officer
Section titled “Data protection officer”There is no federal data protection officer requirement. HIPAA covered entities must name a privacy official and a contact for complaints, and covered entities and business associates must name a security official. The FTC Safeguards Rule requires financial institutions to name a Qualified Individual to run their information security program. The COPPA Rule’s security program must name the employees who coordinate it.
Sources: hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html · govinfo.gov/content/pkg/CFR-2025-title45-vol2/pdf/CFR-2025-title45-vo… · ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-bus… · ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312
International transfers
Section titled “International transfers”There is no general limit on sending data abroad. Since 23 June 2024 data brokers may not sell or give access to Americans’ sensitive data to China, Russia, Iran or North Korea, or to entities they control (FTC-enforced). Since 8 April 2025 the DOJ rule bans data brokerage and bulk genomic data deals with China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia, Venezuela and covered persons, and allows vendor, employment and investment deals with them only under CISA security controls. Bulk thresholds start above 100 people for genomic data.
Sources: govinfo.gov/content/pkg/USCODE-2024-title15/html/USCODE-2024-title15-… · justice.gov/nsd/data-security · federalregister.gov/documents/2025/01/08/2024-31486/preventing-access… · govinfo.gov/content/pkg/CFR-2025-title28-vol2/pdf/CFR-2025-title28-vo… · govinfo.gov/content/pkg/CFR-2025-title28-vol2/pdf/CFR-2025-title28-vo… · govinfo.gov/content/pkg/CFR-2025-title28-vol2/pdf/CFR-2025-title28-vo…
Impact assessments
Section titled “Impact assessments”There is no general federal impact assessment duty. HIPAA requires an accurate and thorough security risk analysis, the FTC Safeguards Rule a written risk assessment, and the COPPA Rule annual risk assessments for children’s data. Since 6 October 2025, firms in restricted transactions under the DOJ rule need a written data compliance program and an independent audit every year. A proposal to tighten the HIPAA Security Rule, with asset inventories, encryption and multi-factor authentication, is still pending.
Sources: govinfo.gov/content/pkg/CFR-2025-title45-vol2/pdf/CFR-2025-title45-vo… · ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-bus… · ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312 · federalregister.gov/documents/2025/01/08/2024-31486/preventing-access… · hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/fac…
Automated decisions and AI
Section titled “Automated decisions and AI”No comprehensive federal AI law or general right to contest automated decisions. FCRA requires adverse action notices for decisions based on consumer reports, and ECOA reasons for refusing credit. The FTC Act covers deceptive AI claims; a proposed FTC statement (July 2026) says steering outputs to suit state laws like Colorado’s AI Act can deceive. The FCC treats AI voices as artificial under the TCPA, but courts aren’t bound by its view. Platforms must remove reported non-consensual intimate images, deepfakes included, within 48 hours. EO 14365 targets state AI laws without overriding them.
Sources: govinfo.gov/content/pkg/USCODE-2024-title15/html/USCODE-2024-title15-… · govinfo.gov/content/pkg/USCODE-2024-title15/html/USCODE-2024-title15-… · govinfo.gov/content/pkg/FR-2026-07-07/html/2026-13628.htm · docs.fcc.gov/public/attachments/FCC-24-17A1.pdf · supremecourt.gov/opinions/24pdf/606us1r55_3d9g.pdf · govinfo.gov/content/pkg/PLAW-119publ12/html/PLAW-119publ12.htm · govinfo.gov/content/pkg/FR-2025-12-16/pdf/2025-23092.pdf
Penalties
Section titled “Penalties”Knowing breaches of FTC rules such as COPPA, CAN-SPAM or the Health Breach Notification Rule, or of FTC orders, can cost up to $53,088 each; under CAN-SPAM each email counts. State attorneys general can sue under COPPA and the TCPA, and people can sue under the TCPA for $500 per call or text, or up to $1,500 if wilful. HIPAA penalties depend on culpability, up to $2,190,294 per violation, and per year for identical violations. DOJ-rule breaches carry civil penalties up to the greater of $368,136 (inflation-adjusted) or twice the transaction value, and up to $1 million and 20 years in prison.
Sources: ecfr.gov/current/title-16/chapter-I/subchapter-A/part-1/subpart-L/sec… · ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-bus… · govinfo.gov/content/pkg/USCODE-2024-title15/html/USCODE-2024-title15-… · govinfo.gov/content/pkg/USCODE-2024-title47/html/USCODE-2024-title47-… · ecfr.gov/current/title-45/subtitle-A/subchapter-A/part-102/section-102.3 · govinfo.gov/content/pkg/CFR-2025-title28-vol2/pdf/CFR-2025-title28-vo…
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/us-federal.yaml.