U.S. Privacy Laws: Guide, Tracker & Resource Center 2024

Regulatory bodies across the globe are tightening privacy laws in the midst of consumers’ growing concerns related to the privacy and security of their personal information. Several states in the US already have consumer privacy laws, but with the emergence of a more stringent and extensive European Union’s General Data Protection Regulation (GDPR), authorities across the US have either amended existing consumer privacy laws or enacted new laws.

According to a report by KPMG, 40% of US citizens do not trust organizations using their data ethically, while 30% are not willing to share their personal data for any reason whatsoever because of this distrust. More worryingly, a 2023 Pew Research study found that 72% of Americans have “little to no understanding” of the data privacy regulations in place to protect their data.

These statistics reflected poorly on organizations’ practices related to collecting, processing, using, and storing users’ data as well as their abject failure to properly educate their users on their relevant data rights. Moreover, considering the sheer escalating volume of data breaches that have led to sensitive data being exposed, this distrust does not seem unwarranted.

That being said, the United States has adopted a unique approach to addressing data privacy challenges. Unlike the EU with its GDPR, Canada’s PIPEDA, or Australia’s Privacy Act, to name a few, there is no equivalent federal regulation being enforced across the US. Instead, there is a unique combination of several federal and state-level laws addressing various sectors and industries.

Read on to learn more about this intriguing patchwork of regulations in effect in the US, potential future developments within this area, and how organizations can navigate the complexities of such a regulatory landscape.

Federal Privacy Laws in the US

Here are some major privacy-oriented laws in effect within the US at the federal level.

US Privacy Act of 1974

The US Privacy Act of 1974 protects individuals from the misuse of their personal information by the federal government agencies. It establishes a code of "fair information practices" that requires agencies to comply with statutory norms for collecting, maintaining, accessing, using, and disseminating records. The law prohibits the disclosure of a record about an individual from a system of records without the written consent of the individual, except when the disclosure falls under one of twelve statutory exceptions. It further contains several provisions that have become a staple of modern data privacy regulations, such as the right of access and the right to modification for individuals. The regulation’s primary purpose is to make the process of data handling transparent and enhance individuals’ trust in the organizations collecting their data.

HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) is a well-known individual health information-related federal regulation within the US. It applies to health plans, healthcare clearinghouses, and healthcare providers who conduct certain healthcare transactions electronically. It comprises several key rules:

1. the Privacy Rule, which sets standards for the protection of individually identifiable health information;
2. the Security Rule, which outlines safeguards to ensure the confidentiality, integrity, and security of electronic protected health information (e-PHI); and the
3. Breach Notification Rule, which mandates that covered entities notify affected individuals, the Department of Health and Human Services (HHS), and sometimes the media, in the event of a data breach.

GLBA

The Gramm-Leach-Bliley Act (GLBA) is a federal regulation aimed at financial institutions that offer financial products and services such as loans, investment advisory services, and insurance. Under the GLBA, such organizations are required to explain their data-sharing practices as well as any relevant measures undertaken to protect the collected personal financial data of their customers. It includes three main components:

1. the Financial Privacy Rule, which requires institutions to provide privacy notices and allow consumers to opt out of some information sharing;
2. the Safeguards Rule, which obliges institutions to implement comprehensive security plans to protect customer information;
3. and the Pretexting Provisions, which guard against obtaining personal financial information under false pretenses.

COPPA

The Children’s Online Privacy Protection Act (COPPA) is a federal law that places several obligations and requirements on websites and online services that are directed at children under the age of 13 or that knowingly collect their personal information. The law requires subject organizations to collect verifiable consent from the child’s parent or guardian before collecting their data, give parents the right to review, delete, and control their child's information, and implement robust data security measures.

FCRA

The Fair Credit Reporting Act (FCRA) regulates how credit reporting agencies can collect, access, use, and share the data they gather in consumer credit reports. It grants consumers several rights, including the right to access their credit information, dispute inaccurate or incomplete information, and be informed when their credit information is used against them, such as in a denial of credit, insurance, or employment. The law also imposes obligations on entities that furnish information to credit reporting agencies to ensure the data's accuracy and on users of consumer reports to provide appropriate notices to consumers.

FERPA

The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects students’ educational records. The regulation applies to all educational institutions that receive funding under various programs by the US Department of Education. Per the regulation, subject organizations may only release any information about a student’s educational record if they have express consent from the student or their parents in written form with certain exceptions such as disclosures to school officials with legitimate educational interests or in response to a lawful subpoena.

ECPA

The Electronic Communications Privacy Act (ECPA),a federal regulation in effect in the US, extends legal protections against unauthorized wiretapping to include electronic communications.  It consists of three main parts: the Wiretap Act, which prohibits the intentional interception and disclosure of electronic communications without consent or a court order; the Stored Communications Act (SCA), which restricts the government's ability to access stored electronic communications and transactional records without a warrant; and the Pen Register Act, which requires law enforcement to obtain a court order to use devices that record dialing, routing, and signaling information.

VPPA

The Video Privacy Protection Act (VPPA) is a federal law that prevents the unauthorized and wrongful disclosure and use of video tape rental or sales records. The VPPA prohibits video rental services from disclosing personally identifiable information about a customer's rental or viewing history without the customer's consent. It requires that companies obtain written consent from customers before sharing such information, except in specific circumstances such as legal proceedings. Though passed to cover video rentals, the law has since become applicable to video games, digital media purchases, as well as physical media purchases while also enforcing online privacy for consumers.

TCPA

The Telephone Consumer Protection Act (TCPA) is a federal regulatory statute related to telephone solicitations. The law applies to any form of telephone communication, such as voice calls, faxes, VoIP calls, text messages, and other forms of electronic communication, where the purpose of the communication is to encourage the purchase, investment or rental of the product or service being offered by the person initiating the telephone communication.

CAN-SPAM Act

The Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM) is a federal law that regulates commercial bulk messaging, which several digital businesses deploy. The law also applies to any form of communication where the purpose is to advertise or promote a commercially available product or service.

State-level Data Privacy Laws in the US

Here are some major data privacy laws in effect within various US states.

California

California’s primary data privacy regulation is the California Privacy Rights Act (CPRA). The regulation came into effect on 1 January 2023 amending and expanding the California Consumer Privacy Act (CCPA). It applies to all businesses that buy, sell, or share the personal information (PI) of at least 100,000 consumers, make $25 million in gross revenue as ofJanuary 1 of the preceding calendar year, or receive 50% or more of their gross revenues from sharing or selling personal information collected on users.

Colorado

The Colorado Privacy Act (CPA) is the data privacy regulation in effect in Colorado. The CPRA went into effect on 1 July 2023 It applies to all organizations that conduct business in Colorado or produce or deliver commercial products or services that are intentionally targeted to residents of Colorado and that either control or process the personal data of at least 100,000 consumers during a calendar year or derive revenue, or receive a discount on the price of goods or services from the sale of personal data and process or control the personal data of at least 25,000 consumers.

Connecticut

The Connecticut Data Privacy Act (CTDPA) is the data privacy and protection regulation in effect in Connecticut. It was signed into law in May 2022 and went into effect on 1 July 2023. It applies to all organizations that conduct business in the state or provide products/services aimed at Connecticut residents and during the preceding year controlled  or processed the personal data of at least 100,000 consumers  excluding the personal data controlled or processed solely for the purpose of completing a payment transactions excluding the personal data controlled or processed solely for the purpose of completing a payment transaction or controller or processed the personal data of 25,000 or more consumers, deriving over 25% of their gross revenue from the sale of personal data.

Maryland

The Maryland Online Data Privacy Act (MODPA) was signed into law on 9 May 2024. It will take effect on 1 October 2025.  MODPA applies to all individuals and organizations that “conduct business” in the state of Maryland and target Maryland residents, and within a year control or process the personal data of at least 35,000 consumers or control or process personal data of 10,000 consumers and derive more than 20% of their gross revenue from the sale of personal data.

Oregon

The Oregon Data Privacy Act (OCPA) is the data privacy regulation of Oregon. The OCPA came into effect on 1 July 2024. It applies to a controller who either conducts business in Oregon or produces products or services that are targeted to the residents of Oregon and that during a calendar year, controls or processes personal data of not less than 100,000 residents excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or controls ot processes person personal data of not less than 25000 Oregon residents and derives more than 25% of its gross revenue from the sale of personal data.

Texas

The Texas Data Privacy and Security Act (TDPSA) is the data privacy regulation in effect in Texas. It was signed into law on 28 May 2023, officially making Texas the tenth state with a data privacy law. It came into effect on 1 July 2024. The TDPSA applies to all individuals or organizations that conduct businesses in Texas or provide a product/service to be consumed by Texas residents, process or engage in the sale of personal data, and do not qualify as small businesses as defined by the United States Small Business Administration (SBA).

Virginia

The Virginia Consumer Data Protection Act (VCDPA) is the data privacy regulation of Virginia. The VCDPA came into effect on 1 January 2023. It applies to all businesses in Virginia or those that produce products/services aimed at residents of Virginia while controlling and processing the personal data of at least 100,000 Virginia residents or derive over half (50%) of their gross revenue from the sale of personal data of at least 25,000 Virginia residents.

Utah

The Utah Consumer Privacy Act (UCPA) is the data privacy regulation of Utah. The UCPA came into effect on 31 December 2023. It applies to all business that have an annual revenue of $25 million or more, and control or process the personal data of at least 100,000 Utah consumers each year; or 50% of their gross profit is generated through the sale of personal  data, and they control or process data of 25000 or more residents in the state.

Future of US Data Privacy Laws & Regulations

Based on the current trends and conditions, more US states will likely continue drafting and implementing their versions of data privacy regulations. While there have been calls for a federal regulation akin to the GDPR, it may remain a pipedream for now owing to the difference in the requirements and needs of each US state.

Furthermore, technological innovations, particularly in AI, have meant that various regulations need to be amended to ensure that individuals’ data is continuously protected to the highest possible degree.

In that vein, a similar patchwork of AI-related regulations has also begun to be drafted and adopted. Owing to the close intersection of AI capabilities and data, these regulations will have a tremendous degree of influence on data privacy.

Consequently, future legislation might follow a “harmonization” pattern, with future AI and data-related regulations enacted while keeping the other in mind.

How Can Securiti Help

As elaborated above, present trends indicate that more states will follow in these footsteps with more state-level regulations of this nature likely to be drafted soon. Hence, organizations that operate in the US and will find themselves subject to most of these regulations will need a dynamic and proactive solution in place to ensure effective compliance with these laws.

Securiti is the pioneer of the Data Command Center, a centralized platform that enables the safe use of data and GenAI. It provides unified data intelligence, controls, and orchestration across hybrid multi-cloud environments. Large global enterprises rely on Securiti's Data Command Center for data security, privacy, governance, and compliance.

The Data Command Center has been designed to be easy-to-deploy and use while giving access to vital individual modules, including privacy policy management, vendor management, universal consent, data mapping, and DSR automation, to name a few. These modules, in addition to a plethora of other vital solutions, make the DCC an ideal option for organizations that want real-time granular insights into their operations to facilitate instantaneous and prompt remediation measures whenever necessary.

Request a demo today and learn more about how Securiti can help you comply with all major data privacy-related regulations in effect or expected to come into effect in the US soon.