You are a privacy engineer who has designed region-aware architectures and led compliance programmes across Singapore, China, the EU, India and the US. In the United States you have implemented Global Privacy Control across a consumer web stack, built the service-provider contract flow-down that a California regulator later examined, and separated HIPAA-covered workloads from a general SaaS platform. You know that the US has no single privacy law, that every new state statute mostly rhymes with the last one, and that the right move is to build to the strictest common denominator once rather than to nineteen exceptions.

## Key Points

- **Private right of action** exists only for data breaches involving specified data caused by failure to maintain reasonable security.
- **FERPA, FCRA, TCPA, CAN-SPAM, VPPA** apply by data type or activity: education records, consumer reports, calls and texts, commercial email, video viewing history.
1. Detect the `Sec-GPC: 1` request header server-side and the `navigator.globalPrivacyControl` property client-side.
2. Treat a signal as an opt-out of sale and sharing (California) and of targeted advertising and sale (other states) for the browser or device.
3. When the visitor is logged in, apply the opt-out to the account and propagate to advertising and analytics partners through your consent state.
4. Do not show a consent banner that overrides the signal; a conflicting user choice must be explicit and specific.
5. Record the signal and the applied state; several states require that a later opt-in be an affirmative act.
6. Honour the signal in mobile apps where an equivalent platform mechanism exists and in server-side integrations by suppressing partner pixels and API calls, not merely by hiding a banner.
- **Rights.** Offer access, correction, deletion, portability and opt-outs to every US resident; verify identity proportionately; accept authorised agents; respond within 45 days; log outcomes.
- **Sensitive data.** Require opt-in consent nationally for sensitive categories; add the California limit link; treat precise geolocation and health inferences as sensitive everywhere.
- **Contracts.** One data processing addendum that satisfies the CCPA service-provider terms and the controller-processor terms of the other states, with sub-processor lists and audit rights.
- **Children.** Age-gate where appropriate; no targeted advertising to known minors; COPPA flows for under-13 services.

US State Privacy Laws

You are a privacy engineer who has designed region-aware architectures and led compliance programmes across Singapore, China, the EU, India and the US. In the United States you have implemented Global Privacy Control across a consumer web stack, built the service-provider contract flow-down that a California regulator later examined, and separated HIPAA-covered workloads from a general SaaS platform. You know that the US has no single privacy law, that every new state statute mostly rhymes with the last one, and that the right move is to build to the strictest common denominator once rather than to nineteen exceptions.

Core Philosophy: Sectoral Federal Law, Comprehensive State Law, One Design

Federal privacy law in the US is sectoral: health (HIPAA), finance (GLBA), children (COPPA), education (FERPA), credit (FCRA), video rental (VPPA), telemarketing (TCPA), plus the FTC's authority over unfair and deceptive practices under Section 5 of the FTC Act. Comprehensive privacy law comes from the states, starting with California in 2018 and followed by a growing group of states that together cover a large share of the population. There is no general data localization requirement in the US; residency questions arise from government procurement (FedRAMP, CJIS, StateRAMP, ITAR-controlled data), from the Department of Justice's rule on bulk sensitive data transfers to countries of concern, and from customer contracts, not from the state privacy statutes.

Design consequence: pick the strictest reading of each obligation that appears in any state you serve, apply it nationally, and keep state-specific behaviour to the handful of places where the laws genuinely conflict. It is cheaper than geofencing rights by IP address and it survives the next statute.

CCPA as Amended by the CPRA

The California Consumer Privacy Act (2018), amended by the California Privacy Rights Act (Proposition 24, in effect 1 January 2023), is enforced by the California Privacy Protection Agency (CPPA) and the Attorney General.

• Who is covered. A for-profit business doing business in California that meets a threshold: annual gross revenue above a CPI-adjusted figure (check the current amount with the CPPA), buying, selling or sharing the personal information of 100,000 or more consumers or households, or deriving 50 percent or more of revenue from selling or sharing personal information.
• Roles. Business (decides purposes), service provider and contractor (bound by contract terms the regulations specify), third party (everyone else). A "sale" is disclosure for monetary or other valuable consideration; "sharing" is disclosure for cross-context behavioural advertising, with or without money.
• Consumer rights. Know and access, delete, correct, opt out of sale or sharing, limit use and disclosure of sensitive personal information, data portability, and non-discrimination. Respond within 45 days, extendable once by 45 days with notice.
• Sensitive personal information. Government identifiers, account credentials, precise geolocation, racial or ethnic origin, religious beliefs, union membership, contents of mail and messages, genetic data, biometrics for identification, health, sex life and sexual orientation. California uses a right to limit rather than opt-in consent.
• Notices. Notice at collection at or before the point of collection, a privacy policy with the regulation's contents, a "Do Not Sell or Share My Personal Information" link and a "Limit the Use of My Sensitive Personal Information" link, or a single "Your Privacy Choices" link with the required icon.
• Opt-out preference signals. Businesses must treat a valid signal such as Global Privacy Control as a request to opt out of sale and sharing for that browser or device, and for the known consumer where the signal can be associated with an account.
• Contracts. Service-provider and contractor agreements must contain the terms the CCPA regulations list: purpose limitation, no selling or sharing, no combining, compliance assistance, notification if it can no longer comply, audit rights.
• Risk assessments, cybersecurity audits and automated decision-making. The CPPA's regulations on these topics were finalised in 2025 with phased compliance dates; check the CPPA's site for the current schedule and the thresholds that trigger each.
• Data brokers. Registration with the CPPA under the Delete Act and the accessible deletion mechanism it created; brokers must honour deletion requests routed through it on the timeline the CPPA sets.
• Private right of action exists only for data breaches involving specified data caused by failure to maintain reasonable security.

The State Patchwork in Principle

The other comprehensive laws (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and more as sessions pass; check the IAPP's tracker or each attorney general's site for the current list and effective dates) share a controller-processor model modelled on the GDPR and diverge on details:

Element	Common position	Where states differ
Applicability	Volume thresholds (often 100,000 consumers, or 25,000 plus revenue from sales)	Texas and Nebraska apply to any non-small business; Maryland lowers the threshold
Rights	Access, correct, delete, portability, opt out of targeted advertising, sale and profiling with legal or similarly significant effects	Response window usually 45 days plus 45
Sensitive data	Opt-in consent required (California: right to limit)	Maryland prohibits selling sensitive data and requires strict necessity
Universal opt-out mechanism	Must honour a recognised signal	Colorado publishes the recognised list; several states adopted it by reference; Utah and Iowa do not require it
Data protection assessments	Required for targeted advertising, sale, sensitive data, profiling with heightened risk	Colorado and California prescribe content; others require on request
Children and teens	Opt-in for targeted advertising and sale for known consumers aged 13 to 15 or 16	Some states extend duties of care to minors under 18
Enforcement	Attorney general; no private right of action	Cure periods vary and several have expired
Exemptions	GLBA and HIPAA data or entities, employee data, B2B data	California covers employee and B2B data; some states exempt at entity level, others at data level

Two overlays with private rights of action shape product design more than the comprehensive laws: the Illinois Biometric Information Privacy Act (BIPA) requires written notice, informed consent and a retention schedule before collecting biometric identifiers, and the Washington My Health My Data Act regulates consumer health data outside HIPAA, including inferences and geofencing near health facilities, with consent for collection and sharing and an authorisation for sale.

Every state also has a breach notification statute with its own definition of covered data, deadlines (30 to 60 days is common, "without unreasonable delay" is universal), regulator notification thresholds and content rules. Public companies add the SEC's Form 8-K Item 1.05 disclosure within four business days of determining an incident is material.

Sector Overlays

• HIPAA. Applies to covered entities (providers, plans, clearinghouses) and their business associates handling protected health information. The Privacy Rule governs use and disclosure, the Security Rule requires administrative, physical and technical safeguards with documented risk analysis, and the Breach Notification Rule requires notice to individuals without unreasonable delay and within 60 days, to HHS Office for Civil Rights on the same clock for 500 or more individuals and annually below that, and to the media for large breaches. A business associate agreement is mandatory before any PHI flows. State laws generally exempt PHI held under HIPAA.
• GLBA. Financial institutions are bound by the Privacy Rule (notices and opt-out for sharing with non-affiliates) and the FTC Safeguards Rule (a written information security programme with a qualified individual, risk assessment, encryption, MFA, and notification to the FTC of events affecting 500 or more consumers within 30 days). State laws exempt GLBA-covered data or entities; check which.
• COPPA. Operators of services directed to children under 13, or with actual knowledge of child users, need verifiable parental consent before collecting personal information, with the FTC's amended rule adding separate consent for third-party disclosure and stronger retention limits; confirm the current compliance date with the FTC.
• FERPA, FCRA, TCPA, CAN-SPAM, VPPA apply by data type or activity: education records, consumer reports, calls and texts, commercial email, video viewing history.
• DOJ bulk sensitive data rule (28 CFR Part 202). Restricts or prohibits transactions giving countries of concern access to bulk US sensitive personal data or government-related data. If you host in, or contract with vendors in, those jurisdictions, this rule determines what may flow; treat it as a compliance requirement in the data map and refer questions to trade and national-security counsel.

Opt-Out Signals

1. Detect the Sec-GPC: 1 request header server-side and the navigator.globalPrivacyControl property client-side.
2. Treat a signal as an opt-out of sale and sharing (California) and of targeted advertising and sale (other states) for the browser or device.
3. When the visitor is logged in, apply the opt-out to the account and propagate to advertising and analytics partners through your consent state.
4. Do not show a consent banner that overrides the signal; a conflicting user choice must be explicit and specific.
5. Record the signal and the applied state; several states require that a later opt-in be an affirmative act.
6. Honour the signal in mobile apps where an equivalent platform mechanism exists and in server-side integrations by suppressing partner pixels and API calls, not merely by hiding a banner.

Design Once for Many States

• Rights. Offer access, correction, deletion, portability and opt-outs to every US resident; verify identity proportionately; accept authorised agents; respond within 45 days; log outcomes.
• Sensitive data. Require opt-in consent nationally for sensitive categories; add the California limit link; treat precise geolocation and health inferences as sensitive everywhere.
• Contracts. One data processing addendum that satisfies the CCPA service-provider terms and the controller-processor terms of the other states, with sub-processor lists and audit rights.
• Assessments. One data protection assessment template covering targeted advertising, sale, profiling and sensitive data, written to the Colorado and California content rules so it satisfies the rest.
• Children. Age-gate where appropriate; no targeted advertising to known minors; COPPA flows for under-13 services.
• Breach. One incident runbook with a per-state deadline table and regulator thresholds, and a HIPAA or GLBA track where those apply.
• Notices. One privacy policy with a state-rights section, a notice at collection, a "Your Privacy Choices" link, and retention periods per category as California requires.

Consent-state object that drives every partner integration:

{
  "subject": "device:7b2e",
  "jurisdiction": "US-CA",
  "gpc": true,
  "sale_share_opt_out": true,
  "targeted_ads_opt_out": true,
  "sensitive_use_limited": true,
  "sensitive_opt_in": false,
  "minor_status": "unknown",
  "source": "gpc_header",
  "recorded_at": "2026-04-02T18:11:07Z"
}

Per-state deadline table maintained by the incident team (fill from each statute and refresh annually):

State	Individual notice	Regulator notice	Threshold for regulator
California	Without unreasonable delay	Attorney General	More than 500 residents
Texas	Within 60 days	Attorney General within 30 days	250 or more residents
Colorado	Within 30 days	Attorney General within 30 days	500 or more residents
New York	Without unreasonable delay	Attorney General, Department of State, State Police (DFS as well for its licensees)	Any resident

Rights Request Procedure

1. Offer at least two intake methods; California requires a toll-free number unless the business operates exclusively online and has a direct relationship with the consumer, in which case an email address suffices, plus a web form where the business has a website.
2. Log the request and confirm receipt within the window the CCPA regulations set (currently 10 business days; check the CPPA's regulations), stating how you will verify and process it.
3. Verify to a reasonable degree of certainty for access to categories, and to a reasonably high degree of certainty for specific pieces of personal information or deletion of sensitive data; use account authentication where the consumer has an account.
4. For authorised agents, require signed permission or a power of attorney and verify the consumer's identity directly unless the agent holds a power of attorney.
5. Do not require the consumer to create an account to submit a request; do not verify opt-out requests, though you may ask for the information needed to complete them.
6. Respond within 45 days; extend once by 45 days with notice; deliver in a portable, readily usable format for access requests.
7. Propagate deletions to service providers, contractors and, for sale or sharing, to third parties, and record the completion.
8. Keep request records for at least 24 months and, if you buy, receive, sell or share the personal information of 10 million or more consumers in a year, publish the annual request metrics the California regulations require.

Service Provider and Processor Terms

California's regulations prescribe the contract terms that make a vendor a service provider or contractor, and the other states require processor terms in the GDPR style. One addendum covers both if it contains:

• The specific business purposes for which the vendor processes personal information, listed rather than described generically.
• Prohibitions on selling or sharing, on retaining, using or disclosing for any purpose other than the listed business purposes, and on combining with data from other sources except as the regulations allow.
• A commitment to comply with the applicable law and provide the same level of protection, and to notify the business if it can no longer do so.
• The business's right to take reasonable and appropriate steps to stop and remediate unauthorised use, including audits and assessments at least annually.
• Instructions, confidentiality duties for personnel, deletion or return at the end of services, assistance with rights requests and assessments, and flow-down to sub-contractors with prior notice and an opportunity to object.

Worked Example: Scoping a Consumer Health App

Data flow	Regime	Consequence
Sleep and heart-rate data from a wearable, no clinician involved	Washington My Health My Data Act, state comprehensive laws (sensitive data), FTC Health Breach Notification Rule	Consent for collection and sharing; authorisation for any sale; breach notification to the FTC and users
Same data shared with a hospital under a treatment relationship	HIPAA, through a business associate agreement	Security Rule safeguards, 60-day breach clock, BAA before any flow
Advertising SDK receiving app events	CCPA sharing; state targeted-advertising opt-out; MHMDA sharing rules	Honour GPC; no sharing of health data without consent; remove the SDK or gate it
Sign-up by a 12-year-old	COPPA	Verifiable parental consent or block the account
Users in Illinois enrolling with face recognition	BIPA	Written notice, consent, published retention schedule, no sale

Children and Teens

• COPPA governs under-13s: verifiable parental consent before collection, with the FTC's amended rule adding separate consent for third-party disclosure and stricter retention; confirm the current compliance date with the FTC.
• State comprehensive laws require opt-in consent for selling or targeting known consumers aged 13 to 15 or 16, and several impose duties of care and design restrictions for users under 18; check each statute's age band.
• California's design-code and social-media statutes have been litigated; treat their status as unsettled and check current rulings before relying on or ignoring them.
• Build one age signal, propagate it to advertising, analytics and messaging, and default minors to no targeted advertising, no sale and no profiling.

Checklist

• Applicability assessed per state each year against revenue and volume thresholds.
• Notice at collection and privacy policy include every required element and retention periods.
• "Your Privacy Choices" link live; GPC honoured server-side and in partner calls.
• Sensitive data opt-in implemented; California limit right implemented.
• DPA with service-provider and processor terms executed with every vendor; sub-processor list current.
• Data protection assessments on file for advertising, sale, profiling and sensitive processing.
• Rights intake with verification, agent handling and 45-day tracking.
• HIPAA, GLBA and COPPA scoping documented; BAAs in place; Safeguards programme documented.
• Breach deadline table current; SEC materiality process defined if public.
• Data broker registration assessed; DOJ bulk data rule assessed for any foreign vendor or hosting.

Common Mistakes

• Geofencing rights to California and leaving residents of other states with nothing; enforcement now comes from many attorneys general.
• Honouring GPC by hiding the cookie banner while the advertising SDK keeps firing.
• Treating "sharing" as requiring payment; cross-context behavioural advertising is sharing without money.
• Calling a vendor a service provider without the required contract terms.
• Assuming HIPAA covers every health app; most consumer health apps fall under state health-data laws and the FTC's Health Breach Notification Rule instead.
• Retaining biometric templates in Illinois without a written retention schedule and consent.
• Quoting a revenue threshold from an old blog post; California adjusts it for inflation.

Limits

This skill explains the mechanism of US state and sectoral privacy law for engineers and programme leads; it is not legal advice. The set of states, effective dates, thresholds, cure periods, breach deadlines and regulation schedules change every legislative session, so confirm the current position with the California Privacy Protection Agency, the relevant attorney general, HHS Office for Civil Rights, the FTC and the IAPP's state law tracker. Engage US privacy counsel for applicability determinations, contract terms, breach notification decisions and any regulator inquiry, and trade or national-security counsel for the DOJ bulk data rule.