Data protection & privacy law in United States (2026)
Data protection in United States: sectoral rules.
The United States has no single comprehensive federal data-protection statute equivalent to the EU GDPR. At the federal level, protection derives from sector-specific statutes and FTC Section 5 unfair-practices authority. In the absence of federal action, at least 20 states have enacted comprehensive consumer privacy laws, with new ones (Indiana, Kentucky, Rhode Island) taking effect January 1, 2026. A new federal bill, the SECURE Data Act, was introduced in the House in April 2026 but remains in early legislative stages.
Legal framework
Patchwork of federal sector-specific laws (HIPAA, GLBA, COPPA, FERPA, FCRA) enforced by the FTC and sector regulators, plus 20+ state comprehensive privacy laws led by California's CCPA/CPRA. No omnibus federal law is in force as of May 2026.
Key points: data & privacy in United States
No federal omnibus law
Congress has not enacted a comprehensive national data privacy statute. The American Privacy Rights Act (APRA) expired at the end of the 118th Congress in January 2025 without passing. The US relies on a patchwork of sector-specific federal statutes rather than a unified GDPR-style regime.
SECURE Data Act (proposed, 2026)
On April 22, 2026, House Republicans introduced the SECURE Data Act (H.R. 8413) in the 119th Congress, the first major federal omnibus privacy attempt since APRA. It would create a uniform national standard preempting state laws and be enforced by the FTC and state AGs, but does not include a private right of action. The bill is in early committee stages and is not yet law.
Key federal sector-specific laws
Major sectoral statutes include: HIPAA (health data, enforced by HHS); GLBA (financial data, enforced by FTC/banking regulators); COPPA (children under 13, enforced by FTC, rules significantly updated effective June 23, 2025); FERPA (student records); and FCRA (consumer credit data). The FTC enforces against unfair or deceptive privacy practices under Section 5 of the FTC Act across all sectors.
20+ state comprehensive privacy laws
At least 20 states have enacted comprehensive consumer privacy laws as of 2026. Indiana, Kentucky, and Rhode Island joined on January 1, 2026. California's CCPA/CPRA remains the most expansive, with 2025 amendments adding rules on automated decision-making, high-risk data processing, cybersecurity audits, and data-broker obligations.
FTC as de facto lead regulator
The Federal Trade Commission is the primary federal privacy enforcement authority, acting under Section 5 of the FTC Act and sector statutes. As of 2025-2026, the Republican-majority FTC (Chairman Andrew Ferguson) has focused enforcement on children's privacy, sensitive data sales, data broker practices, and cybersecurity deficiencies. The Take It Down Act (effective May 19, 2026) also grants the FTC new authority over non-consensual intimate image sharing on platforms.
State enforcement center stage in 2026
With no new state comprehensive laws enacted in 2025, state attorneys general and dedicated privacy agencies (notably the California Privacy Protection Agency) shifted focus to enforcement and refinement of existing laws. Nine states amended their existing privacy laws in 2025. State-level class actions and AG enforcement actions are expected to increase significantly through 2026.
Timeline of decisions
- Decision · officialTrump Executive Order Directs Federal Preemption of State AI and Data Laws
President Trump signed an executive order directing federal agencies to identify and challenge state AI laws deemed inconsistent with national policy, launching a push to centralize data-governance and AI regulation at the federal level. A March 2026 White House blueprint followed, urging Congress to adopt a unified framework covering children's online safety and AI-driven data harms.
White House
- Law · officialRevised COPPA Rule Takes Effect, Bans Monetizing Children's Data Without Opt-In
The FTC's first major COPPA Rule overhaul since 2013, finalized January 16, 2025 by a 5-0 vote, became enforceable, prohibiting platforms from sharing or monetizing data on children under 13 without active parental opt-in and imposing strict data-retention limits. It is the most consequential update to children's online privacy law in over a decade.
Federal Trade Commission
- Law · officialDOJ Data Security Program Takes Effect, Export Controls on Bulk Sensitive Personal Data
Acting under Executive Order 14117 (February 2024), the Justice Department's Data Security Program imposed restrictions on bulk transfers of Americans' genomic, biometric, health, financial, and geolocation data to China, Russia, and other 'countries of concern,' creating a national-security-driven export-control regime for personal data. Full audit and due-diligence obligations became enforceable October 6, 2025.
U.S. Department of Justice
- Law · officialAmerican Privacy Rights Act (H.R. 8818) Introduced, Fails to Pass
Bipartisan sponsors introduced H.R. 8818, the most advanced attempt at comprehensive federal privacy legislation, which would have established nationwide data-minimization rules, rights to access and delete personal data, opt-out of targeted advertising, and a private right of action. The bill expired in January 2025 at the end of the 118th Congress without a floor vote, leaving the U.S. without a federal omnibus privacy law.
Congress.gov
- Enforcement · officialCalifornia CPRA Enforcement Begins After Court Challenge Clears
Following a successful industry legal challenge that delayed enforcement of the California Privacy Rights Act regulations, the California Privacy Protection Agency (CPPA) began full enforcement in February 2024. California's rules on sensitive-data handling, data minimization, and opt-out rights effectively function as a national baseline for companies operating across the U.S.
California Privacy Protection Agency
- Enforcement · officialFTC Bars Data Broker X-Mode from Selling Sensitive Location Data
The FTC settled with data broker X-Mode Social (rebranded Outlogic), permanently barring it from selling precise location data and requiring deletion of previously collected datasets. The action launched a sustained FTC campaign against the data-broker industry, followed in 2024-2025 by similar orders against InMarket Media, Mobilewalla, and Gravy Analytics.
Federal Trade Commission
- Law · officialCPRA Takes Effect; State-Level Privacy Law Wave Accelerates
California's CPRA amendments to the CCPA took effect alongside Virginia's Consumer Data Protection Act, formally inaugurating the era of multi-state comprehensive privacy regulation. By end of 2023 a total of 13 states, including Colorado, Connecticut, Texas, Montana, and Oregon, had enacted their own comprehensive privacy statutes, creating a nationwide patchwork binding tens of thousands of businesses.
California Privacy Protection Agency
- Law · officialCalifornia Consumer Privacy Act (CCPA) Takes Effect
The CCPA became enforceable as the first comprehensive consumer data privacy law in U.S. history, granting Californians rights to know what personal information businesses collect, to request deletion, and to opt out of the sale of their data. Its scope, covering any business meeting size thresholds that handle Californians' data, made it an effective national standard and accelerated state-by-state legislative activity.
California Attorney General
- Law · officialCalifornia Consumer Privacy Act (CCPA) Signed Into Law
Governor Jerry Brown signed AB 375, enacting the CCPA, the broadest consumer data privacy statute in U.S. history at the time. Passed to forestall a more stringent ballot initiative, it was modeled partly on GDPR principles and set off a wave of state legislative activity across the country.
California Legislative Information
- Law · officialGramm-Leach-Bliley Act (GLBA) Enacted, Financial Privacy Framework
President Clinton signed the GLBA into law, establishing the foundational federal privacy and data-security framework for financial institutions. It requires disclosure of customer data-sharing practices, mandates consumer opt-out rights for third-party sharing, and requires a written information security program, still the primary federal data-protection law for the financial sector.
Federal Trade Commission
- Law · officialChildren's Online Privacy Protection Act (COPPA) Enacted
Congress enacted COPPA (Pub. L. 105-277), the first federal law specifically regulating online collection of personal data from children under 13, requiring verifiable parental consent before data collection. It gave the FTC rulemaking and enforcement authority and remains the cornerstone of children's online privacy law, substantially strengthened by the 2025 rule amendments.
Federal Trade Commission
- Law · officialHealth Insurance Portability and Accountability Act (HIPAA) Enacted
Congress enacted HIPAA (Pub. L. 104-191), directing HHS to establish standards for the privacy and security of individually identifiable health information. The resulting Privacy Rule (effective 2003) and Security Rule (effective 2005) created the principal federal data-protection regime for healthcare, binding covered entities and their business associates to strict use-and-disclosure limits and breach-notification obligations.
U.S. Department of Health and Human Services
- Law · officialElectronic Communications Privacy Act (ECPA) Enacted
Congress enacted ECPA (Pub. L. 99-508), extending federal wiretapping prohibitions to electronic communications and creating the Stored Communications Act (SCA), which governs government access to emails and cloud data. ECPA established the original digital-era privacy framework for government surveillance of electronic communications and remains in force, though widely criticized as outdated for modern cloud and mobile data.
Congress.gov
Sources
- ftc.gov/business-guidance/privacy-security/consumer-privacy
- ftc.gov/news-events/topics/protecting-consumer-privacy-security/privacy-secur
- congress.gov/bill/119th-congress/house-bill/8413/text
- energycommerce.house.gov/posts/committees-on-energy-and-commerce-and-financial-services-introd
- iapp.org/resources/article/us-state-privacy-legislation-tracker
- multistate.us/insider/2026/2/4/all-of-the-comprehensive-privacy-laws-that-take-effe
- epic.org/issues/privacy-laws/united-states/
- iclg.com/practice-areas/data-protection-laws/usa/
- hoganlovells.com/en/publications/the-data-chronicles-a-new-ftc-era-evolving-data-enfor
- smithlaw.com/newsroom/publications/data-privacy-in-2026-state-enforcement-takes-ce
- en.wikipedia.org/wiki/American_Privacy_Rights_Act
- iapp.org/news/a/new-year-new-rules-us-state-privacy-requirements-coming-online
Next for United States: Digital Payments & FintechLicensing regime
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026