A Practical Map of US Data Privacy Law

US privacy law has no single compliance switch. What binds a business depends on the data it holds, the states where its customers live, and the sector it operates in, and any of those three can change inside a quarter. My view is that small and mid-size organizations should stop waiting for Congress and build two artifacts instead: a data inventory and a breach-notification matrix. Both survive election cycles. A program assembled from vendor checklists does not.

Congress has come close twice. The American Data Privacy and Protection Act stalled in 2022 over preemption. The American Privacy Rights Act died in 2024 for the same reason. Both bills failed on the same fault line: states with working regimes would not hand enforcement to a federal agency, and the members who wanted one national standard would not accept fifty. Nothing on the current calendar changes that arithmetic, so a statute this session would be a surprise rather than a plan.

What exists instead is a two-layer system. Sectoral federal rules follow certain kinds of data. State laws follow residency. Operators who can answer both questions for a given dataset know what it obligates them to do, which is the only version of this problem that fits in a budget.

The federal layer follows the data

There is no general federal privacy statute. The Federal Trade Commission polices privacy through Section 5 of the FTC Act, which forbids unfair or deceptive acts or practices (15 U.S.C. §45). That authority is real and reactive. The agency penalizes a company for breaking its own published promise or for careless security. It does not set rules for what you may collect, how long you keep it, or how a customer gets it deleted.

Where Congress has legislated, it has done so by sector, and each statute carries its own definition of protected data, its own security standard, and its own clock.

Data and role	Federal regime	What it requires	Breach clock
Health information held by providers, plans, and clearinghouses	HIPAA Privacy, Security, and Breach Notification Rules	Administrative, technical, and physical safeguards; business associate agreements; risk analysis	60 days to affected individuals (45 CFR §164.404)
Health data in consumer apps and wearables outside HIPAA	FTC Health Breach Notification Rule	Notice to consumers, the FTC, and in some cases media; applies to vendors of personal health records and related entities	60 days (16 CFR Part 318)
Financial products and services for consumers	Gramm-Leach-Bliley Act and the FTC Safeguards Rule	Written information security program, risk assessment, vendor oversight, access controls	FTC within 30 days when 500 or more consumers are affected (16 CFR §314.4(j))
Education records	FERPA	Written consent before disclosure, annual notice, limits on who inside the institution may see records	No federal breach deadline; enforcement through the Department of Education (34 CFR Part 99)
Personal information from children under 13	COPPA	Verifiable parental consent before collection, with separate consent before disclosing to third parties	No separate breach rule; FTC enforcement (16 CFR Part 312)
Everything else a business collects	FTC Act §5	Do what your notice says; use reasonable security; do not make deceptive claims about sharing	None federally; state law sets the clock

The regime attaches to the data and to the role you play in handling it, not to your industry label. A software vendor storing records for a hospital is a business associate, with a contract obligation that flows from HIPAA. The same vendor storing the same records for a wellness app is outside HIPAA and inside the FTC’s health rule, which the Commission amended in 2024 to reach health apps and similar consumer technologies (16 CFR Part 318). Two clients, one codebase, two regulators.

For most small businesses the practical federal exposure is Section 5 plus whichever sectoral rule their largest customer forces on them by contract. That contract is often stricter than the statute, and it is enforceable whether or not a regulator ever calls.

The state layer counts residents, not revenue

Roughly twenty states have enacted a comprehensive consumer privacy law, and three more take effect in January: Indiana, Kentucky, and Rhode Island. Florida’s statute is narrower than the rest but usually counted in the tally. Any of them can reach a company with no office in the state, because coverage turns on residents rather than on where you bank.

The thresholds decide whether you are in scope, and they are falling. Rhode Island covers a business that processes the data of 35,000 consumers, or 10,000 when more than 20 percent of revenue comes from selling data. Montana cut its threshold to 25,000 consumers in October, with no revenue test attached at all. New Hampshire covers a business at 35,000 consumers, or 10,000 once a quarter of revenue comes from selling data. Each of those numbers puts a mid-size company with a popular consumer product inside a statute it never read.

Once a law covers you, the template repeats across states:

• a privacy notice describing what you collect and why;
• rights to access, correct, delete, and port data;
• opt-outs for sale, targeted advertising, and profiling;
• consent before processing sensitive data;
• processor contracts and data protection assessments for high-risk processing.

What differs between the statutes is where the cost sits: whether a cure period still exists, whether the attorney general must be notified separately from consumers, whether a private right of action exists at all, and how each text defines sensitive data. A program built to the union of those requirements is more work than any single statute implies, and less work than discovering the differences one complaint at a time.

Enforcement is the part operators underestimate. Most states enforce through the attorney general alone, and the first wave of actions arrived years after the laws took effect, which taught a lot of operators to treat the statutes as theoretical. California is the exception that changes the math, because its breach provision carries a private right of action with statutory damages of $100 to $750 per consumer per incident (Cal. Civ. Code §1798.150). A 40,000-record breach in that state is a number a plaintiff’s lawyer can compute before lunch.

Breach clocks are where the money is

Every state has a breach-notification statute and no two of them agree (NCSL tracks the set). The differences that cost money are the deadline, the harm threshold that lets you skip notice, and whether the attorney general has to be told separately. Three examples show how far apart the clocks run:

State	Notice to individuals	Regulator and other notice	Citation
California	30 calendar days from discovery once the 2025 amendment takes effect	Attorney general notice within 15 days of consumer notice if more than 500 residents	Cal. Civ. Code §1798.82
Oregon	45 days after discovery or notice	Attorney general if more than 250 residents; consumer reporting agencies if more than 1,000	ORS 646A.604
Texas	60 days after determination	Attorney general within 30 days if 250 or more residents; credit bureaus if more than 10,000	Tex. Bus. & Com. Code §521.053

California is the live change. Section 1798.82 long required notice in “the most expedient time possible and without unreasonable delay,” which every company interpreted in its own favor. An amendment signed this year replaces that with 30 calendar days from discovery, with narrow carve-outs for law enforcement requests and for the work of determining scope and restoring integrity, and it takes effect at the start of next year. Because California residents appear in almost every customer file, the deadline to plan around is now measured in weeks rather than the 60 days many companies had treated as the national norm.

The exemptions matter more than the clocks. Oregon’s statute does not apply to data already covered by HIPAA or the GLBA rules when you comply with those rules (ORS 646A.604(9)). The exemption is the reason the inventory has to record which regime covers each dataset. If your patient portal is HIPAA-covered and your marketing database is not, one incident can run on two clocks with two audiences and two different definitions of what counts as a breach.

Where the two layers collide

Vendors inherit your clock. Oregon gives a vendor 10 days to notify the covered entity after discovering a breach, and that notice starts the entity’s 45-day window (ORS 646A.604(2)). If your contract does not require a faster heads-up than the statute, your deadline begins on someone else’s schedule.

“We don’t sell data” is a weak defense. Sensitive categories carry tighter limits than the general sale rules, and the definitions of sale keep widening to reach sharing that nobody in the deal called a sale. Delaware requires documented due diligence on the third parties that receive personal data. The direction across states is toward prohibiting certain transfers rather than asking for consent to them.

What this means for operators

The obligation set for any dataset is a function of three variables: data type, residency of the people in it, and your role. That is why generic privacy advice fails. A twelve-person medical billing firm and a twelve-person e-commerce brand have almost nothing in common legally, even though both hold “personal information.”

The work is smaller than the vendor market implies. A spreadsheet with one row per system, and columns for data type, residency, governing regime, retention period, owner, and notification duty, answers most of what a regulator or a customer’s security questionnaire will ask. The hard part is political: the same customer record lives in the CRM, the help desk, the billing platform, and a marketing tool, and each owner believes their copy is the authoritative one.

Programs fail in three recognizable ways. The team maps systems instead of data. The published privacy notice becomes the compliance artifact, when the notice is only a promise the rest of the program has to keep. And nobody is authorized to decide, at 2 a.m., that notice is required.

Retention gets less attention than collection and decides more. Every dataset you delete stops generating obligations: no notice duty, no access request to answer, no vendor to assess, no line in the insurance application. Companies spend real money protecting categories of data they stopped using years ago.

Budget follows the same logic as the rest of cybersecurity work. The controls that reduce the chance of a reportable event are unglamorous: inventory, access control, patching, retention limits, vendor terms. I made that argument in detail in The Threat Floor, and the notification side of it in The First 72 Hours After a Breach. The fine is rarely the largest cost. Notification, credit monitoring, legal review, and months of staff time usually exceed it. That arithmetic is why average breach cost figures mislead small companies: the average is dominated by firms with far more data and far more customers than you have.

What to do

1. Write the inventory before you write another policy. One row per system, with data type, residency, regime, retention, owner, and notification duty. Six columns, filled in department by department, and it will expose more risk than a quarter of awareness training.
2. Map each dataset to a statute, not to a category. “Customer data” is not a regime. Health data held for a covered entity, health data in a consumer app, and payment data each point at a different rule with a different clock.
3. Build the notification matrix with the shortest clock first. Put the 30-day states at the top, name the person who decides, and write the 24-hour escalation path. Include the regulator notices, since several states require them separately from consumer notice.
4. Fix vendor terms so your clock does not start late. Require breach notice within 72 hours or five business days, whichever your counsel prefers, and make it shorter than the shortest statutory vendor deadline that applies to you.
5. Cut collection you cannot defend. Delete the fields nobody uses and the retention nobody justified. Fewer fields mean fewer datasets in scope, fewer notices, and less to produce during an investigation.
6. Rehearse once a year against the matrix, not the plan. A tabletop that ends with “legal will handle notification” has found your gap. Run it until someone can state, out loud, who calls the attorney general in each state where you have customers.
7. Review thresholds and effective dates quarterly. Legislatures amend these statutes almost every session and new effective dates land every January. A coverage memo written eighteen months ago is already wrong.

This quarter’s decision is whether to fund the inventory and the matrix, or to reduce what you collect until the question gets simpler. Either answer is defensible. Choosing both is usually the right one, in that order. Doing neither is how a company discovers its obligations during the week it can least afford to learn them.

Sources

1. 15 U.S.C. §45 — Federal Trade Commission Act, unfair or deceptive acts or practices — Cornell Legal Information Institute, 2025-12-02.
2. 16 CFR Part 314 — Standards for Safeguarding Customer Information — eCFR, 2025-12-02.
3. 45 CFR §164.404 — Notification to individuals — eCFR, 2025-12-02.
4. 16 CFR Part 318 — Health Breach Notification Rule — eCFR, 2025-12-02.
5. 16 CFR Part 312 — Children’s Online Privacy Protection Rule — eCFR, 2025-12-02.
6. 34 CFR Part 99 — Family Educational Rights and Privacy — eCFR, 2025-12-02.
7. Cal. Civ. Code §1798.82 — breach notification — California Legislative Information via Public.Law, accessed 2025-12-02.
8. Cal. Civ. Code §1798.150 — private right of action for breaches — California Legislative Information via Public.Law, updated 2025-01-01.
9. ORS 646A.604 — Notice of breach of security — Oregon Revised Statutes via Public.Law, accessed 2025-12-02.
10. Tex. Bus. & Com. Code §521.053 — Notification required following breach — Texas Statutes via Public.Law, accessed 2025-12-02.
11. Security Breach Notification Laws — NCSL, 2025-12-02.