Fifty states, 24 privacy laws, only 20 of which are currently in force, with the others set for 2027 and 2028. This means that about half of the United States does not have comprehensive privacy laws on the books.

Add to this fragmented picture several failed attempts at federal legislation.

There are laws dealing with privacy or consumer rights in different sectors such as health or children’s privacy, and well-known laws such as the Federal Trade Commission Act, which covers unfair or deceptive practices against consumers. For companies with interests in the US, therefore, compliance requirements are layered— changing with the industry, information involved, or individuals whose information is being processed.

There are several state and federal laws covering different aspects of privacy. For example, student, employee, or home buyers’ privacy, are all covered under different federal laws.

Rundown of state privacy laws

Since January 2026, three laws giving consumers rights over their personal information have been in effect in Kentucky, Indiana and Rhode Island. These are the latest in a wave of laws that closely follow the Virginia Consumer Data Protection Act, that was only the second state privacy law to be enacted after California’s. The core rights the Virginia-model laws afford individuals are similar, covering areas including access, correction, deletion, opt-in consent for sensitive data and opt-out rights for purposes such as the sale of personal data.

Laws in Utah, Florida, Maryland and Minesota are either structurally different from the others, only cover companies with large revenues, or impose stricter documentation or sensitive data requirements.  The California Consumer Privacy Act (CCPA) is the only state law that offers a private right of action, meaning individuals can sue for perceived violations. In the other states, only the attorney general can carry out an enforcement action. California is also the only state with its own privacy protection agency.

Federal and state laws work together

Practically speaking, in the absence of comprehensive federal legislation and the with only some states having laws, there are several state and federal laws covering different aspects of privacy. There are for example, federal laws dealing with student, employee or home buyers’ privacy.

The US Constitution provides a starting point by limiting certain government actions that interfere with privacy. These protections generally concern government conduct rather than the information practices of an organisation. Federal and state legislation provide further protections. 

Privacy laws like the Health Insurance Portability and Accountability Act (HIPAA), Gramm-Leach-Bliley Act (GLBA) and Children’s Online Privacy Protection Act (COPPA) play a prominent role in protecting health information, financial information, and children’s personal information online.

Other state laws address specific issues, such as biometric information under Illinois’ Biometric Information Privacy Act and consumer health data under Washington’s My Health My Data Act. State laws also impose requirements concerning data security and notification following certain data breaches. For businesses operating across states, these differences add another layer of compliance.

Which laws apply to your company? It depends

A business’s location does not always determine which state privacy laws apply. For example, a business based outside of California may still have to comply with the CCPA if it does business in California, handles California residents’ personal information and meets the law’s other requirements. A business serving customers across several states may therefore need to comply with more than one state’s privacy law. 

Coverage depends on the law’s requirements, including the type of entity the information it handles and how that information is used. HIPAA, for example, applies to certain healthcare providers, health plans, healthcare clearinghouses and their business associates.

Financial institutions may fall under the GLBA, that requires covered institutions to explain their information-sharing practices and implement strict safeguards to protect customers’ personal information that is not public.

Even if a company operates outside the US, it may still come under some US laws if it has US-based vendors. For example, the Clarifying Lawful Overseas Use of Data Act (CLOUD) mandates US-based technology and cloud service providers to comply with government data requests, regardless of where their servers or customers are located.

What enforcement looks like

A practical starting point is to identify what personal information the organisation collects, why it needs it, where it is stored and who receives it. This will help to determine which laws apply and what changes may be required. This also aids in revealing gaps between written policies and everyday practice.

Enforcement in the United States typically involves federal regulators, state authorities and the courts. The US Department of Health and Human Services enforces HIPAA through its Office for Civil Rights, while the FTC enforces COPPA and can act against unfair or deceptive privacy practices. Other federal regulators oversee privacy requirements within their areas of responsibility, including financial services and consumer reporting.

State attorneys general and agencies like the California Privacy Protection Agency enforce relevant state laws. In California, individuals can bring a lawsuit, but this is not available for every privacy violation. Private lawsuits are generally limited to specified security breaches rather than failure to comply with the law.

An alleged violation may lead to an investigation or court proceedings, with potential consequences including financial penalties and requirements to change business practices. 

Some laws provide a cure period, or an opportunity to correct certain violations before enforcement proceeds, but the availability and conditions of these periods vary. Organisations should check the applicable law rather than assume they will receive a warning before action is taken.

What’s on the horizon

There are currently three proposed federal laws: the Online Privacy Act, the Consumer Data Privacy and Security Act and the SECURE Data Act.

Previously in 2022 and 2024, two bills— the American Data Protection Privacy Act (ADPPA) and the American Privacy Rights Act (APRA)— failed to become law.

Two arguments continue unresolved at the federal level, hindering passage of a comprehensive law. The first has to do with whether a federal law would replace existing state laws. The second: whether individuals should be given the right to bring lawsuits as opposed to enforcement being the responsibility of attorneys general or similar office.

Of the three current bills, the Online Privacy Act is the only one that allows individuals to bring lawsuits in some cases. It also proposes that state privacy laws remain in place if they are not inconsistent with federal law. However, these are still just proposals.

In the meantime, businesses looking to remain compliant must sort through a patchwork of state, federal, industry or group specific legislation to determine what applies.

Bloomfield provides privacy compliance support for entities doing business in the US.