United States privacy law is a complex patchwork of national, state and local privacy laws and regulations. There is no comprehensive national privacy law in the United States. However, the US does have a number of largely sector-specific privacy and data security laws at the federal level, as well as many more at the state (and local) level. In recent years, beginning with California in 2018, states have begun to introduce and enact their own comprehensive privacy laws. Although bipartisan draft bills (e.g., the American Privacy Rights Act of 2024) have been introduced since then, changes in the political climate, industry influence, and the increasing complexity of privacy concerns have stifled efforts of passing an omnibus law. Thus, a comprehensive privacy law on the federal level is not expected to pass any time soon.

Federal and State Privacy Laws and Regulations

Federal laws and regulations include those that apply to financial institutions, telecommunications companies, credit reporting agencies and healthcare providers, as well as driving records, children’s online privacy, telemarketing, email marketing, biometrics, and communications privacy laws. 

There are also a number of state privacy and data security laws that can overlap with federal law(s)—some of these state privacy laws are preempted in part by federal laws, while others are not. Some US states have also privacy and data security laws and regulations that apply across sectors and go beyond requirements imposed by federal laws—such as data security laws, secure destruction, Social Security number privacy, online privacy, biometric information privacy, and data breach notification laws. Generally, these state laws apply to personal information about residents of or activities that occur within each of these states, respectively. Thus, many businesses operating in the United States must comply not only with applicable federal law, but also with numerous state privacy and security laws and regulations.

For example, California alone has more than 25 state privacy and data security laws, including the comprehensive CCPA, which provides definitions and broad individual rights and imposes requirements and restrictions on the collection, use, disclosure, and processing of personal information of CA residents. The CCPA is unique among the existing state comprehensive privacy laws in that, it applies not only to personal information related to consumers but also in the HR and B2B context. Enforcement of the updated CCPA regulations, which were finalized March 29, 2023, commenced on March 29, 2024, by the newly established California Privacy Protection Agency, referred to as the ‘CPPA’ or ‘Agency.’ In September of 2025, the CPPA announced that the California Office of Administrative Law approved regulations covering (1) cybersecurity audits, (2) risk assessments, (3) automated decision-making technology (ADMT), (4) insurance companies, and (5) updates to the existing CCPA Regulations. These supplementing regulations went into effect January 1, 2026. However, businesses have a grace period to come into compliance with certain of the new requirements, including: cybersecurity audits, risk assessments, and new requirements for automated decision-making technologies.

Cybersecurity Audits: businesses required to complete cybersecurity audits must submit their certifications to the CPPA by:

• April 1, 2028, if the business makes over $100 million;
• April 1, 2029, if the business makes between $50 million and $100 million; or
• April 1, 2030, if the business makes less than $50 million.

Risk Assessments: businesses subject to risk assessment requirements must begin compliance by January 1, 2026 and submit to the Agency by April 1, 2028:

• An attestation that required risk assessments were completed, and
• A summary of the risk assessment information.

Automated Decision-Making Technology (ADMT): Businesses that use ADMT to make significant decisions must comply with the relevant requirements starting on January 1, 2027.

The CPPA also enforces the "Delete Act," effective January 1, 2024, which imposes deletion obligations on data brokers, including to:

• Register with CalPrivacy on an annual basis,
• Process deletion requests submitted through the DROP system
• Report the types of information they collect and share, and
• Undergo audits to make sure they’re following the Delete Act

Non-compliance of the above requirements may lead to penalties and administrative fines.

Consumers may submit a single verifiable request to have their personal information held by all registered data brokers in California deleted via the DROP platform, which is accessible on the CPPA's website and became operational January 1, 2026. The idea is to allow consumers to make a single verifiable deletion request (free of charge) to have their data deleted by data brokers and their associated service providers or contractors, thereby preventing certain 'sales' of their information.

In August 2022, the California legislature passed the California Age-Appropriate Design Code ('CAADC'), which was slated to take effect July 1, 2024, and would apply to companies that meet the definition of “business” under the CCPA and that provide online services that are likely to be accessed by individuals under 18 years of age. However, on September 18, 2023, a California District Court issued an injunction blocking the law from coming into effect on First Amendment grounds. Following an appeal to the Ninth Circuit by the California Attorney General's office, the court on March 12, 2026, issued its latest decision in NetChoice, LLC v. Bonta, partially affirming and partially vacating the district court’s preliminary injunction that had blocked the law’s enforcement. It vacated the preliminary injunction as to this provision and remanded for further consideration. Importantly, the court observed that the age estimation requirement does not, on its face, prevent access to content.  The court left open the question of whether the term “data management practices” in the age estimation provision incorporates the content-related factors from the DPIA requirement (which remains enjoined) or carries its ordinary meaning. This statutory interpretation question will be addressed on remand. Further, the Ninth Circuit affirmed the preliminary injunction as to four data use restrictions and the dark patterns prohibition, albeit on vagueness grounds rather than First Amendment grounds. More information on the California Age-Appropriate Design Code is available online.

Similarly, Maryland has enacted the “Kids Code” and Connecticut amended its Consumer Data Protection Act to include similar protections for children’s personal information. Moreover, in January 2025, the Federal Trade Commission (FTC) finalized significant changes to the federal Children’s Online Privacy Protection Act (COPPA). While the FTC periodically reviews the COPPA rule, these rule changes are the first amendment to COPPA since 2013. According to the FTC, the final amended rule reflects technological advancements since COPPA was last amended and is intended to enhance online safety for children. More information on the amended rule is available online. Additionally, the FTC published its “Enforcement Policy Statement Promoting the Adoption of Age-Verification Technology,” and stated its intent to initiate a review of the COPPA Rule to address age-verification mechanisms. The combined efforts of federal and state regulators are intended to pave the way for a safer digital landscape and ensure that children's privacy is prioritized in an increasingly connected world.

Beyond California’s CCPA, additional comprehensive state privacy laws have also taken effect, including the

• Colorado Privacy Act,
• Connecticut Data Privacy Act (including amendments regulating consumer health data, children’s data, and social media platforms),
• Delaware Personal Data Privacy Act,
• Florida Data Privacy and Security Act,
• Indiana Consumer Data Protection Act,
• Iowa Consumer Data Protection Act,
• Kentucky Consumer Data Protection Act,
• Maryland Online Data Privacy Act,
• Minnesota Consumer Data Privacy Act,
• Montana Consumer Data Privacy Act,
• Nebraska Data Privacy Act,
• New Hampshire Consumer Expectation of Privacy Act,
• New Jersey Personal Data Privacy Act,
• Oregon Consumer Privacy Act,
• Rhode Island Data Transparency and Privacy Protection Act,
• Tennessee Information Protection Act
• Texas Data Privacy and Security Act
• Utah Consumer Privacy Act
• Virginia Consumer Data Protection Act

While not identical, these comprehensive state privacy laws are, with the exception of the CCPA, substantially similar to each other in most respects, but may differ in certain regards, for example, scope, privacy notice disclosures, privacy rights, and certain key definitions. These state laws are also generally inapplicable to personal information collected about, and processed in the context of, employee and business relationships. While the CCPA has some practical similarities with these state laws, it adopts more granular definitions, requirements, and restrictions that vary considerably from these laws, and, notably, also applies to personal information collected from California residents in employment and B2B contexts.

There have also been significant developments in the health data space, beginning in 2023 with Washington passing the landmark My Health My Data Act (MHMD). The law ostensibly applies only to consumer health data, but its exceptionally broad definitions and scope combined with its private right of action may mean its enforcement touches on data many companies may not typically consider “health” data. More information on the MHMD Act is available online. Since MHMD, other states have followed suit—Nevada passed the Nevada Consumer Health Data Privacy Law through senate bill 370, effective March 31, 2024, and Connecticut amended the Consumer Data Privacy Act to include similar provisions for protecting consumer health data, effective October 1, 2023.

Finally, the pace of state privacy legislation has continued to accelerate overall, with the following states also  introducing similar legislation:

• Georgia
• Illinois 
• Maine
• Massachusetts
• Michigan
• New York
• North Carolina
• Pennsylvania
• South Carolina

Enforcement of Unfair and Deceptive Trade Practices

In the United States, consumer protection laws, which prohibit unfair and deceptive business practices, provide another avenue for enforcement against businesses for their privacy and security practices.

At the federal level, the US Federal Trade Commission (FTC) uses its authority to protect consumers against unfair or deceptive trade practices, to take enforcement actions against businesses for materially unfair privacy and data security practices. The FTC uses this authority to, among other things, take enforcement actions and investigate companies for:

• Failing to implement reasonable data security measures
• Making materially inaccurate or misleading privacy and security statements, including in privacy policies
• Failing to abide by applicable industry self-regulatory principles
• Transferring or attempting to transfer personal information to an acquiring entity in a bankruptcy or M&A transaction, in a manner not expressly disclosed on the applicable consumer privacy policy
• Violating consumer privacy rights by collecting, using, sharing or failing to adequately protect consumer information, in violation of standards established in their prior enforcement precedents  

Many state attorneys general have similar enforcement authority over unfair and deceptive business practices, including failure to implement reasonable security measures and violations of consumer privacy rights that harm consumers in their states. State attorneys general also sometimes work together on enforcement actions against companies for actions that broadly affect the consumers of multiple states (such as data breaches). 

Key Enforcement Trends and Areas of Privacy Class Action

Privacy class actions continue to be a significant risk area in the United States, including in the context of biometric privacy (under the Illinois Biometric Privacy Act), text messaging (under the federal Telephone Consumer Privacy Act) and call recording, wiretapping and related claims under the California Invasion of Privacy Act, the Video Privacy Protection Act (VPPA), and Shine The Light, as well as other state laws. For example, on January 26, 2026, the U.S. Supreme Court granted certiorari in Salazar v. Paramount Global to clarify the scope of the VPPA and resolve a circuit split on the question of how “consumer” is defined under the law.  The Court is likely to schedule oral argument in the upcoming 2026-2027 term. Further under the CCPA, data breaches due to inadequate security measures, allow for a private right of action.

Online monitoring and targeting activities—including via cookies, pixels, chat bots, and so-called “session replay” tools—continue to be an area of particular focus in the eyes of both regulators and plaintiff’s attorneys. Similarly, regulators put a heightened focus on compliance with honoring opt-out of 'selling/sharing for targeted advertising purposes, including via global opt-out signals and related to selling and sharing via non-automated means, ADMT transparency, as well as data-broker registration since the DROP platform became operational in January of 2026.

These enforcement and litigation trends highlight the evolving landscape of privacy enforcement and litigation, emphasizing the need for businesses to stay current in order to adapt and comply with stringent privacy and data protection regulations to avoid legal repercussions and reputational harm.