Major Compliance Requirements Under Federal and State Data Protection Laws

There's a quiet assumption many businesses carry into the digital economy: that "data privacy compliance" means satisfying one federal law and moving on. It doesn't. In the United States, privacy and data protection obligations are built from a patchwork of federal sector-specific statutes, a general federal deceptive-practices standard, and a growing, uneven map of state legislation. Understanding how these layers interact — not just knowing that they exist — is what separates real compliance from a privacy policy that merely looks the part.

There Is No Single Federal Privacy Law

Unlike the EU's GDPR, the US has no single, comprehensive federal privacy statute governing all personal data. Instead, federal law regulates privacy sector by sector:

The Gramm-Leach-Bliley Act (GLBA) governs nonpublic personal information held by financial institutions — banks, lenders, and similar entities significantly engaged in financial activities. It requires privacy notices, opt-out rights before sharing data with nonaffiliated third parties, and a written information security program under its Safeguards Rule.

HIPAA governs protected health information (PHI) held by covered entities — healthcare providers, health plans, and their business associates. It imposes privacy, security, and breach-notification obligations, anchored by the "minimum necessary" standard and mandatory notification when unsecured PHI is breached.

COPPA governs data collected from children under 13, requiring verifiable parental consent before collection in most cases.

Section 5 of the FTC Act operates as a general backstop. Where no sector-specific statute applies, the FTC can still act against "unfair or deceptive" data practices — most commonly, a company's actual data practices contradicting what its own privacy policy promises.

The practical implication: a single business can be subject to several of these at once. A healthtech company processing payments, for instance, may need to satisfy both HIPAA and GLBA simultaneously, not choose between them.

The State Layer Adds a Second, Shifting Map

On top of federal sector-specific law sits an expanding set of state privacy statutes — California's CCPA/CPRA being the most prominent, followed by a growing list of states with their own comprehensive privacy laws, each with its own consumer rights, notice obligations, and enforcement mechanisms. These laws are not uniform: what counts as "personal information," what rights consumers have (access, deletion, opt-out of sale), and how violations are enforced all vary by state.

Separately, nearly every state has its own data breach notification law, each with different triggers, timelines, and notification requirements. A breach affecting customers across multiple states can mean navigating several different notification clocks at once, rather than one uniform federal standard.

Why "We Have a Privacy Policy" Is Not the Same as "We Comply"

A privacy policy is not a static, one-time compliance checkbox — it is, in effect, a legal representation of how a business actually handles data. Three recurring compliance failures illustrate why:

Policy-practice mismatch. A company states it "never sells or shares" customer data, then later shares browsing or purchase data with advertisers without updating the policy or notifying customers. This is not merely a privacy lapse — it can constitute a deceptive practice under the FTC Act.

Treating notice as a one-time event. Some businesses issue a privacy notice once, at sign-up, and never revisit it — even as data practices change. Both GLBA and general privacy principles require notice (and often an opt-out opportunity) when practices materially change, not just at onboarding.

Security treated as optional or informal. Absence of encryption, no designated security lead, and no written security program are not just operational gaps — under GLBA's Safeguards Rule and HIPAA's Security Rule alike, reasonable data security is a legal obligation, not a best-practice suggestion.

What This Means in Practice

For businesses operating across sectors and state lines, a workable compliance approach means:

Mapping which federal sector-specific laws apply based on the type of data collected (financial, health, children's), not just the industry label.

Tracking which state laws apply based on where customers are located, not just where the business is incorporated.

Reviewing privacy notices whenever data collection or sharing practices change — not on a fixed annual cycle alone.

Building breach-response protocols that account for the differing notification timelines across federal and state law.

Treating cybersecurity as a legal compliance function, not solely a technical one.

Closing Thought

The businesses that get into trouble are rarely the ones that ignored privacy law entirely — they're the ones that assumed one policy, written once, was enough to cover every law that applied to them. As state legislatures continue adding new privacy statutes and federal agencies continue enforcing existing ones, the compliance map will keep shifting. Building a practice of regularly reviewing where federal and state obligations overlap — rather than treating compliance as a one-time setup — is what actually protects a business, and its customers, over time.

Have questions about how federal and state privacy obligations apply to your business? Feel free to reach out — I work with businesses navigating exactly this kind of cross-jurisdictional compliance.