🇺🇸
United States
State-Level Privacy Laws (CCPA, CPRA, etc.)
Americas🔵 Substantial
Compliance Score
57%
8 Addressed
6 Partial
0 None
Authority
Various State Attorneys General
Overview
The US has a patchwork of state-level data protection laws, led by California's CCPA/CPRA. Other states have followed with their own frameworks. Federal sector-specific laws apply to healthcare (HIPAA), finance (GLBA), and children (COPPA).
14-Topic Coverage Analysis
Data Protection Authority
PartialConsent Requirements
AddressedData Subject Rights
AddressedCross-Border Transfer
PartialBreach Notification
AddressedDPO Requirements
PartialChildren's Data
AddressedPenalties & Enforcement
AddressedSector-Specific Rules
AddressedCookie/Tracking
AddressedAI & Automated Decisions
PartialData Localisation
PartialSignificant Data Fiduciary
PartialGovernment Data
Addressed? Frequently Asked Questions
What is the penalty for a data breach under US privacy laws like CCPA?+
Under the CCPA/CPRA in California, businesses can be fined up to $2,500 per violation, or $7,500 per intentional violation or violation involving minors. This can be significantly higher in a data breach affecting many consumers.
Does the US require data localisation?+
There is no general data localisation mandate in the US. However, specific sectors like healthcare (HIPAA) and finance (GLBA) have strict data security and residency requirements.
Who regulates data protection in the US?+
The US has a patchwork of state laws (like CCPA in California) enforced by State Attorneys General. At the federal level, the FTC and specific agencies (like HHS for HIPAA) enforce sectoral privacy rules.