Many non‑US companies assume that compliance with the European Union’s GDPR or the same house‑nation legislation will largely deal with US necessities, Kevin Coy and Erin Doyle of Arnall Golden Gregory write. However the US regulatory image is fragmented, extremely sector- and state-specific and generates distinct regulatory and litigation dangers that always will not be addressed by compliance with home-country legal guidelines.
Compliance professionals, in‑home counsel and enterprise leaders ought to think about 12 areas of information privateness and safety diligence, contract phrases and governance when planning US operations.
These areas will not be mutually unique, and so they usually overlap. This record can also be not exhaustive. Discrete federal and state privateness legal guidelines regulate a bunch of different areas not addressed right here, starting from motorcar data and academic data to video rental data, library data and loyalty program data, amongst others.
1. Sectoral federal privateness legal guidelines
Whereas the US doesn’t have an omnibus privateness legislation, it does have a lot of sectoral and issue-specific privateness legal guidelines. HIPAA laws, overlaying sure well being‑associated entities, and the Gramm-Leach-Bliley Act, which regulates monetary establishments, are outstanding examples.
HIPAA governs protected well being data held by “coated entities,” together with many healthcare suppliers and well being plans and their “enterprise associates,” a broad array of firms offering providers that contain processing protected well being data on behalf of coated entities. Coated entities and their enterprise associates should deal with HIPAA’s privateness, safety and information breach notification laws, together with particular contracting and compliance necessities.
Some states, equivalent to Washington and Nevada, have adopted sturdy well being data privateness legal guidelines meant to fill gaps relating to the privateness of client well being information the place the HIPAA privateness guidelines don’t apply, and the Washington legislation features a personal proper of motion.
The Gramm-Leach-Bliley Act applies to a wide selection of monetary establishments, not simply banks, and requires particular privateness notices, regulates the sharing of “non‑public private data” and imposes data safety necessities.
Overseas companies getting into the well being or monetary providers sectors ought to deal with HIPAA and the Gramm-Leach-Bliley Act as major regulatory regimes, not as mere dietary supplements to home-country necessities.
2. State privateness legal guidelines
The US nonetheless lacks a single federal GDPR‑fashion legislation, however greater than 20 states have now enacted complete client privateness statutes, beginning with the California Client Privateness Act and adopted by states like Virginia, Colorado, Connecticut, Texas and others. California is without doubt one of the most operationally demanding states: It created a devoted privateness regulator, the California Privateness Safety Company and is relatively aggressive with enforcement.
Every state’s legislation is distinct, however all of them usually embody privateness discover necessities, client rights obligations (for instance, entry, deletion, correction and choose‑out choices), function limitation ideas, information minimization ideas and vendor contracting obligations. Whereas these legal guidelines apply throughout sectors, they don’t apply to all companies as a result of a spread of various applicability triggers and exceptions. Because of this, the influence of this class of state legal guidelines is dependent upon the dimensions and scope of enterprise operations and the states the place enterprise will likely be performed. A threshold evaluation of which state legal guidelines truly apply to an entity ought to due to this fact be thought-about a needed first step in any US privateness technique.
3. Advertising and marketing and communications privateness
Within the advertising and communications area, the US federal CAN‑SPAM Act and related state legal guidelines set guidelines for business electronic mail, together with identification necessities, choose‑out mechanisms and header‑data accuracy. The Phone Client Safety Act and parallel state mini‑TCPA statutes closely regulate telemarketing, textual content messaging and sure automated calling. Do-not-call record guidelines additionally apply notably however not solely to telemarketing communications. A few of these legal guidelines have pushed substantial class motion litigation.
4. Web site monitoring and video or name recording
Extra US legal guidelines regulate the recording of movies or calls and utilizing web site monitoring applied sciences. Federal and state wiretapping and eavesdropping statutes, in addition to name‑recording legal guidelines, require one‑occasion or all‑occasion consent to report relying on the jurisdiction. Moreover, plaintiffs are more and more difficult “session replay” and different on-line monitoring applied sciences like cookies and pixels underneath these authorized frameworks.
For companies contemplating US bodily retail shops or different places within the US, notices relating to video surveillance additionally could also be required. Companies getting into the US market which are planning to interact in most of these actions ought to rigorously assessment their practices in these areas to handle compliance issues and mitigate potential danger.
5. Youngsters’s privateness
Companies processing private information about youngsters should think about federal and state privateness legal guidelines. US federal legislation is anchored by the Youngsters’s On-line Privateness Safety Act, which applies to on-line providers directed to youngsters underneath 13 or that knowingly acquire private data from such youngsters. COPPA requires clear notices, verifiable parental consent earlier than gathering most information, limits on use and disclosure and cheap safety. COPPA is enforced primarily by the US Federal Commerce Fee and state attorneys common.
In parallel, an increasing set of state little one‑centered privateness and on-line security legal guidelines (for instance, age‑acceptable design‑fashion codes and teenage‑particular protections) for individuals as much as age 18 are imposing extra obligations round profiling, focused promoting and default settings for minors, making a multilayered regulatory framework.
6. AI and automatic decision-making expertise legal guidelines
New and proposed state legal guidelines governing AI and automatic determination‑making expertise are proliferating, specializing in AI transparency, information minimization, bias and discrimination dangers and the necessity for influence assessments the place fashions depend on delicate private data or materially have an effect on people (for instance, employment, housing, credit score or entry to important providers).
Non‑US companies could have to adapt AI governance applications constructed round GDPR, the EU AI Act or different legal guidelines to handle particular US disclosure, consent, discover and choose‑out expectations, in addition to heightened scrutiny of coaching information, profiling and the reuse of client and worker information for AI functions.
7. Worker and applicant privateness
Companies getting into the US market could also be stunned by the patchwork of US worker‑centered guidelines. The federal Truthful Credit score Reporting Act and related legal guidelines in lots of states regulate the usage of third‑occasion background screening stories relating to candidates and workers, in addition to use of such stories for different functions. State and native “ban the field,” “honest probability” and antidiscrimination legal guidelines prohibit when and the way legal historical past data might be requested and used throughout hiring, usually requiring delayed inquiries and individualized assessments. Different state legal guidelines prohibit the usage of credit score stories and wage historical past data as a part of the hiring course of.
Employers additionally face state legal guidelines relating to lawful off‑obligation conduct (for instance, defending sure lawful merchandise or actions), drug‑testing constraints and restrictions on requesting social media credentials or disciplining workers for lawful on-line exercise. These legal guidelines collectively require cautious coordination of worldwide human sources and compliance insurance policies. Worker well being plans additionally could also be topic to HIPAA necessities for coated entities.
8. Biometrics privateness legal guidelines
A number of states have enacted biometric privateness statutes, the Illinois Biometric Data Privateness Act being probably the most outstanding instance that’s often cited in personal class actions. These legal guidelines can apply to applied sciences like fingerprint time clocks, facial recognition for bodily or logical entry and voiceprints. These usually require knowledgeable consent, information retention limits and safe disposal.
9. Cybersecurity legal guidelines
Knowledge safety obligations are more and more being codified not simply as common “cheap safety” necessities however as extra detailed statutory requirements and regulatory steering. Many state privateness legal guidelines expressly require acceptable technical, administrative and bodily safeguards related to the sensitivity and quantity of private information, and a few state legal guidelines prescribe particular controls, danger assessments, audits and governance buildings notably in monetary providers and significant infrastructure contexts. As well as, California will quickly require sure companies coated by COPPA to conduct cybersecurity audits and submit certifications. These state guidelines sit alongside — and typically transcend — federal sectoral necessities, equivalent to these underneath HIPAA or the Gramm-Leach-Bliley Act.
Companies which have designed their safety applications round GDPR or a single world normal ought to assess whether or not US state- or sector-specific mandates relating to encryption, entry administration, multifactor authentication, vendor oversight, incident response, board‑degree reporting and regulatory reporting require tailor-made enhancements for US operations.
10. Knowledge breach notification legal guidelines
All US states and territories have information breach notification statutes that impose obligations to inform people (and typically regulators or credit score bureaus) when outlined private data is accessed or acquired with out authorization, usually topic to particular notification timelines and see content material necessities. These legal guidelines differ on the scope of coated entities and coated information, whether or not they carry danger‑of‑hurt exceptions and whether or not delays are permitted for legislation enforcement wants, so multistate incidents require coordinated, state‑particular evaluation.
As well as, some companies are topic to federal breach notification guidelines underneath regimes, equivalent to Securities and Alternate Fee necessities for reporting by publicly traded firms, HIPAA or the Gramm-Leach-Bliley Act. As such, companies getting into the US market ought to think about creating US-focused breach notification protocols to anticipate their response to a breach of US private information.
11. Authorities and bulk US delicate information switch laws
In contrast to GDPR and plenty of nationwide information safety legal guidelines, the US has not historically regulated the export of private information to different jurisdictions. In January 2025, nonetheless, the US Division of Justice finalized laws that prohibit or prohibit sure “coated information transactions” involving bulk US delicate private information or US authorities‑associated information with specified “international locations of concern” and “coated individuals.” The rule defines “bulk US delicate private information” broadly to incorporate classes like sure private identifiers, exact geolocation, biometric identifiers, well being and monetary information and human genetic and molecular organic information when sure thresholds are met inside a 12‑month interval.
A separate legislation enacted in 2024 additionally restricts the sale or switch of private information by third-party information brokers to “adversary international locations” or entities underneath their management, which might apply as an alternative of or along with the DOJ laws. Compliance with these necessities necessitates an understanding of knowledge flows on condition that contractual safeguards differ relying on whether or not the events concerned are US, overseas or coated individuals underneath these laws. These measures would apply along with any information switch necessities required by home-country information safety legal guidelines, equivalent to GDPR.
12. Federal and state unfair or misleading acts and practices legal guidelines
The FTC and state regulators have lengthy used federal and state prohibitions on unfair or misleading acts and practices (UDAP) to convey actions towards companies which have didn’t hold their privateness and information safety guarantees, in addition to to behave towards companies that have interaction in unfair privateness and information safety practices. Whereas companies could overlook UDAP legal guidelines as a result of they’re broad prohibitions slightly than detailed operational compliance regimes, federal and state regulators have introduced a whole lot of UDAP circumstances through the years. To keep away from partaking in misleading practices, you will need to be certain that a enterprise’s public privateness and safety guarantees are saved in follow. Moreover, unfairness claims don’t require an unkept promise. For instance, they are often introduced if insufficient information safety practices end in substantial damage to a client that the patron couldn’t have moderately averted. Because of this, companies contemplating US market entry ought to think about reviewing their privateness insurance policies, notices and different guarantees and information safety practices from this broader perspective along with extra particular necessities relevant to their US operations.
Regulatory and litigation dangers
Most of the privateness and safety legal guidelines and laws mentioned above present personal rights of motion that make the US litigation setting notably enticing for class-action plaintiffs. In the meantime, federal and state regulators — together with the FTC, sectoral regulators, state attorneys common and specialised our bodies just like the California Privateness Safety Company — actively convey regulatory enforcement actions for privateness and safety violations.
Compliance with the GDPR or different non‑US information safety frameworks seemingly will assist US compliance efforts, however it’s not determinative. Even in cases the place US federal and state legal guidelines share the identical privateness safety objectives as non-US privateness laws, US legal guidelines can differ considerably relating to points like scope, authorized bases, consent requirements, discover design and content material, automated‑determination guidelines and, crucially, personal litigation publicity. Non‑US companies planning to enter or develop within the US market ought to due to this fact think about endeavor a focused US privateness and information use evaluation overlaying client, worker and business-to-business information flows to calibrate governance, contracting, expertise and insurance coverage methods to this distinct regulatory and litigation panorama.
Many non‑US companies assume that compliance with the European Union’s GDPR or the same house‑nation legislation will largely deal with US necessities, Kevin Coy and Erin Doyle of Arnall Golden Gregory write. However the US regulatory image is fragmented, extremely sector- and state-specific and generates distinct regulatory and litigation dangers that always will not be addressed by compliance with home-country legal guidelines.
Compliance professionals, in‑home counsel and enterprise leaders ought to think about 12 areas of information privateness and safety diligence, contract phrases and governance when planning US operations.
These areas will not be mutually unique, and so they usually overlap. This record can also be not exhaustive. Discrete federal and state privateness legal guidelines regulate a bunch of different areas not addressed right here, starting from motorcar data and academic data to video rental data, library data and loyalty program data, amongst others.
1. Sectoral federal privateness legal guidelines
Whereas the US doesn’t have an omnibus privateness legislation, it does have a lot of sectoral and issue-specific privateness legal guidelines. HIPAA laws, overlaying sure well being‑associated entities, and the Gramm-Leach-Bliley Act, which regulates monetary establishments, are outstanding examples.
HIPAA governs protected well being data held by “coated entities,” together with many healthcare suppliers and well being plans and their “enterprise associates,” a broad array of firms offering providers that contain processing protected well being data on behalf of coated entities. Coated entities and their enterprise associates should deal with HIPAA’s privateness, safety and information breach notification laws, together with particular contracting and compliance necessities.
Some states, equivalent to Washington and Nevada, have adopted sturdy well being data privateness legal guidelines meant to fill gaps relating to the privateness of client well being information the place the HIPAA privateness guidelines don’t apply, and the Washington legislation features a personal proper of motion.
The Gramm-Leach-Bliley Act applies to a wide selection of monetary establishments, not simply banks, and requires particular privateness notices, regulates the sharing of “non‑public private data” and imposes data safety necessities.
Overseas companies getting into the well being or monetary providers sectors ought to deal with HIPAA and the Gramm-Leach-Bliley Act as major regulatory regimes, not as mere dietary supplements to home-country necessities.
2. State privateness legal guidelines
The US nonetheless lacks a single federal GDPR‑fashion legislation, however greater than 20 states have now enacted complete client privateness statutes, beginning with the California Client Privateness Act and adopted by states like Virginia, Colorado, Connecticut, Texas and others. California is without doubt one of the most operationally demanding states: It created a devoted privateness regulator, the California Privateness Safety Company and is relatively aggressive with enforcement.
Every state’s legislation is distinct, however all of them usually embody privateness discover necessities, client rights obligations (for instance, entry, deletion, correction and choose‑out choices), function limitation ideas, information minimization ideas and vendor contracting obligations. Whereas these legal guidelines apply throughout sectors, they don’t apply to all companies as a result of a spread of various applicability triggers and exceptions. Because of this, the influence of this class of state legal guidelines is dependent upon the dimensions and scope of enterprise operations and the states the place enterprise will likely be performed. A threshold evaluation of which state legal guidelines truly apply to an entity ought to due to this fact be thought-about a needed first step in any US privateness technique.
3. Advertising and marketing and communications privateness
Within the advertising and communications area, the US federal CAN‑SPAM Act and related state legal guidelines set guidelines for business electronic mail, together with identification necessities, choose‑out mechanisms and header‑data accuracy. The Phone Client Safety Act and parallel state mini‑TCPA statutes closely regulate telemarketing, textual content messaging and sure automated calling. Do-not-call record guidelines additionally apply notably however not solely to telemarketing communications. A few of these legal guidelines have pushed substantial class motion litigation.
4. Web site monitoring and video or name recording
Extra US legal guidelines regulate the recording of movies or calls and utilizing web site monitoring applied sciences. Federal and state wiretapping and eavesdropping statutes, in addition to name‑recording legal guidelines, require one‑occasion or all‑occasion consent to report relying on the jurisdiction. Moreover, plaintiffs are more and more difficult “session replay” and different on-line monitoring applied sciences like cookies and pixels underneath these authorized frameworks.
For companies contemplating US bodily retail shops or different places within the US, notices relating to video surveillance additionally could also be required. Companies getting into the US market which are planning to interact in most of these actions ought to rigorously assessment their practices in these areas to handle compliance issues and mitigate potential danger.
5. Youngsters’s privateness
Companies processing private information about youngsters should think about federal and state privateness legal guidelines. US federal legislation is anchored by the Youngsters’s On-line Privateness Safety Act, which applies to on-line providers directed to youngsters underneath 13 or that knowingly acquire private data from such youngsters. COPPA requires clear notices, verifiable parental consent earlier than gathering most information, limits on use and disclosure and cheap safety. COPPA is enforced primarily by the US Federal Commerce Fee and state attorneys common.
In parallel, an increasing set of state little one‑centered privateness and on-line security legal guidelines (for instance, age‑acceptable design‑fashion codes and teenage‑particular protections) for individuals as much as age 18 are imposing extra obligations round profiling, focused promoting and default settings for minors, making a multilayered regulatory framework.
6. AI and automatic decision-making expertise legal guidelines
New and proposed state legal guidelines governing AI and automatic determination‑making expertise are proliferating, specializing in AI transparency, information minimization, bias and discrimination dangers and the necessity for influence assessments the place fashions depend on delicate private data or materially have an effect on people (for instance, employment, housing, credit score or entry to important providers).
Non‑US companies could have to adapt AI governance applications constructed round GDPR, the EU AI Act or different legal guidelines to handle particular US disclosure, consent, discover and choose‑out expectations, in addition to heightened scrutiny of coaching information, profiling and the reuse of client and worker information for AI functions.
7. Worker and applicant privateness
Companies getting into the US market could also be stunned by the patchwork of US worker‑centered guidelines. The federal Truthful Credit score Reporting Act and related legal guidelines in lots of states regulate the usage of third‑occasion background screening stories relating to candidates and workers, in addition to use of such stories for different functions. State and native “ban the field,” “honest probability” and antidiscrimination legal guidelines prohibit when and the way legal historical past data might be requested and used throughout hiring, usually requiring delayed inquiries and individualized assessments. Different state legal guidelines prohibit the usage of credit score stories and wage historical past data as a part of the hiring course of.
Employers additionally face state legal guidelines relating to lawful off‑obligation conduct (for instance, defending sure lawful merchandise or actions), drug‑testing constraints and restrictions on requesting social media credentials or disciplining workers for lawful on-line exercise. These legal guidelines collectively require cautious coordination of worldwide human sources and compliance insurance policies. Worker well being plans additionally could also be topic to HIPAA necessities for coated entities.
8. Biometrics privateness legal guidelines
A number of states have enacted biometric privateness statutes, the Illinois Biometric Data Privateness Act being probably the most outstanding instance that’s often cited in personal class actions. These legal guidelines can apply to applied sciences like fingerprint time clocks, facial recognition for bodily or logical entry and voiceprints. These usually require knowledgeable consent, information retention limits and safe disposal.
9. Cybersecurity legal guidelines
Knowledge safety obligations are more and more being codified not simply as common “cheap safety” necessities however as extra detailed statutory requirements and regulatory steering. Many state privateness legal guidelines expressly require acceptable technical, administrative and bodily safeguards related to the sensitivity and quantity of private information, and a few state legal guidelines prescribe particular controls, danger assessments, audits and governance buildings notably in monetary providers and significant infrastructure contexts. As well as, California will quickly require sure companies coated by COPPA to conduct cybersecurity audits and submit certifications. These state guidelines sit alongside — and typically transcend — federal sectoral necessities, equivalent to these underneath HIPAA or the Gramm-Leach-Bliley Act.
Companies which have designed their safety applications round GDPR or a single world normal ought to assess whether or not US state- or sector-specific mandates relating to encryption, entry administration, multifactor authentication, vendor oversight, incident response, board‑degree reporting and regulatory reporting require tailor-made enhancements for US operations.
10. Knowledge breach notification legal guidelines
All US states and territories have information breach notification statutes that impose obligations to inform people (and typically regulators or credit score bureaus) when outlined private data is accessed or acquired with out authorization, usually topic to particular notification timelines and see content material necessities. These legal guidelines differ on the scope of coated entities and coated information, whether or not they carry danger‑of‑hurt exceptions and whether or not delays are permitted for legislation enforcement wants, so multistate incidents require coordinated, state‑particular evaluation.
As well as, some companies are topic to federal breach notification guidelines underneath regimes, equivalent to Securities and Alternate Fee necessities for reporting by publicly traded firms, HIPAA or the Gramm-Leach-Bliley Act. As such, companies getting into the US market ought to think about creating US-focused breach notification protocols to anticipate their response to a breach of US private information.
11. Authorities and bulk US delicate information switch laws
In contrast to GDPR and plenty of nationwide information safety legal guidelines, the US has not historically regulated the export of private information to different jurisdictions. In January 2025, nonetheless, the US Division of Justice finalized laws that prohibit or prohibit sure “coated information transactions” involving bulk US delicate private information or US authorities‑associated information with specified “international locations of concern” and “coated individuals.” The rule defines “bulk US delicate private information” broadly to incorporate classes like sure private identifiers, exact geolocation, biometric identifiers, well being and monetary information and human genetic and molecular organic information when sure thresholds are met inside a 12‑month interval.
A separate legislation enacted in 2024 additionally restricts the sale or switch of private information by third-party information brokers to “adversary international locations” or entities underneath their management, which might apply as an alternative of or along with the DOJ laws. Compliance with these necessities necessitates an understanding of knowledge flows on condition that contractual safeguards differ relying on whether or not the events concerned are US, overseas or coated individuals underneath these laws. These measures would apply along with any information switch necessities required by home-country information safety legal guidelines, equivalent to GDPR.
12. Federal and state unfair or misleading acts and practices legal guidelines
The FTC and state regulators have lengthy used federal and state prohibitions on unfair or misleading acts and practices (UDAP) to convey actions towards companies which have didn’t hold their privateness and information safety guarantees, in addition to to behave towards companies that have interaction in unfair privateness and information safety practices. Whereas companies could overlook UDAP legal guidelines as a result of they’re broad prohibitions slightly than detailed operational compliance regimes, federal and state regulators have introduced a whole lot of UDAP circumstances through the years. To keep away from partaking in misleading practices, you will need to be certain that a enterprise’s public privateness and safety guarantees are saved in follow. Moreover, unfairness claims don’t require an unkept promise. For instance, they are often introduced if insufficient information safety practices end in substantial damage to a client that the patron couldn’t have moderately averted. Because of this, companies contemplating US market entry ought to think about reviewing their privateness insurance policies, notices and different guarantees and information safety practices from this broader perspective along with extra particular necessities relevant to their US operations.
Regulatory and litigation dangers
Most of the privateness and safety legal guidelines and laws mentioned above present personal rights of motion that make the US litigation setting notably enticing for class-action plaintiffs. In the meantime, federal and state regulators — together with the FTC, sectoral regulators, state attorneys common and specialised our bodies just like the California Privateness Safety Company — actively convey regulatory enforcement actions for privateness and safety violations.
Compliance with the GDPR or different non‑US information safety frameworks seemingly will assist US compliance efforts, however it’s not determinative. Even in cases the place US federal and state legal guidelines share the identical privateness safety objectives as non-US privateness laws, US legal guidelines can differ considerably relating to points like scope, authorized bases, consent requirements, discover design and content material, automated‑determination guidelines and, crucially, personal litigation publicity. Non‑US companies planning to enter or develop within the US market ought to due to this fact think about endeavor a focused US privateness and information use evaluation overlaying client, worker and business-to-business information flows to calibrate governance, contracting, expertise and insurance coverage methods to this distinct regulatory and litigation panorama.
