US Federal Privacy Laws Overview: Sector Laws, State Overlap and Gaps

The United States has no single federal privacy law covering all personal data, so an organisation's federal obligations depend on what data it holds, about whom, and in which sector. Instead there is a set of sector statutes, each with its own regulator, definitions and penalties, sitting under a growing body of state law. This page is the map: which federal laws apply to which data, how they interact with state laws, what they leave uncovered, and where the federal comprehensive bills stand. It links to the detailed NHI Mgmt Group guide for each law rather than repeating them. It is for privacy, security and compliance leads who need to scope a US programme. Status checked against the regulators' and statute publishers' own pages on 14 November 2026.

Key takeaways

• Coverage follows the data and the sector. HIPAA covers health plans, clearinghouses and many providers; GLBA covers financial institutions; FERPA covers schools that receive US Department of Education funds; COPPA covers online services directed to children under 13. Data outside those boxes often has no specific federal statute.
• The FTC fills much of the gap. For most consumer businesses, the practical federal privacy rulebook is FTC Act Section 5 enforcement plus FTC rules such as the GLBA Safeguards Rule and the COPPA Rule.
• Most sector laws set a floor, not a ceiling. HIPAA keeps more protective state health privacy laws, and GLBA keeps state laws that give greater protection. Federal compliance rarely ends the analysis.
• State laws exempt some federal data, not whole companies. Many state comprehensive laws exempt data already governed by HIPAA or GLBA, so the same company can be under federal rules for one data set and state rules for the rest.
• A federal comprehensive law is still a bill. The SECURE Data Act (H.R. 8413) was introduced in the House in April 2026 with broad preemption of state law; as of November 2026 it is pending in committee.

Is there a federal privacy law in the US?

Not a comprehensive one. Federal privacy law is a patchwork of statutes passed one sector or one harm at a time, from the Fair Credit Reporting Act (credit files) and FERPA (education records) in the 1970s to the Video Privacy Protection Act (rental records) in 1988, COPPA in 1998, and GLBA and HIPAA rules around 2000. Each defines its own covered entities and protected information. A business that is not a covered entity under any of them still faces FTC enforcement for unfair or deceptive practices and, increasingly, a state comprehensive privacy law. For that state layer, see the US State Privacy Laws Guide.

The federal sector laws at a glance

Other federal rules touch specific channels and data: the CAN-SPAM and TCPA Guide covers marketing email, calls and texts; the FCC CPNI and Telecom Data Breach Rule Guide covers carriers; the FTC Health Breach Notification Rule Guide covers health apps outside HIPAA; and the PADFA Guide covers transfers of sensitive data to foreign adversary controlled entities.

What each law asks for, in brief

HIPAA

The Privacy Rule limits uses and disclosures of protected health information and gives individuals rights over it; the Security Rule and Breach Notification Rule sit alongside it. HHS lists civil money penalties of $127 to $63,973 per violation, with calendar-year caps for identical violations of $25,000 to $1,919,173 (the 2022 adjusted figures on its summary page), and criminal penalties up to $250,000 and 10 years for intent to sell or misuse information. Business associates are covered directly; see the HIPAA Business Associate Agreements Guide.

GLBA

The Privacy Rule requires notices about information sharing and the right to opt out of certain sharing with third parties; the Safeguards Rule requires a written information security programme. Since 13 May 2024 the FTC's Safeguards Rule has required covered companies to notify the FTC as soon as possible, and no later than 30 days after discovery, of a security event involving the information of at least 500 consumers.

COPPA

Operators need verifiable parental consent before collecting personal information from children under 13. The FTC finalised amendments in January 2025, requiring separate parental consent for disclosures to third parties such as for targeted advertising, limiting retention to what is reasonably necessary, and adding biometric and government-issued identifiers to personal information. The FTC stated that the rule takes effect 60 days after Federal Register publication, with one year from publication to comply; the text was published in April 2025, so most obligations applied from April 2026.

FERPA

Parents, and students once they turn 18 or enter postsecondary education, can inspect education records (generally within 45 days of a request), seek amendment, and consent to disclosures. Exceptions include school officials with a legitimate educational interest, health and safety emergencies, and directory information where the institution has given notice. Complaints go to the US Department of Education, generally within 180 days.

FCRA

Consumer reports may only be provided to someone with a purpose the Act permits. Users who take adverse action on credit, insurance or employment based on a report must notify the consumer, and furnishers must investigate disputes. The CFPB took over most FCRA rulemaking under Dodd-Frank; the FTC kept its enforcement authority.

VPPA

A video tape service provider that knowingly discloses personally identifiable information about a consumer is liable unless an exception applies, such as consent or ordinary course of business. Courts may award actual damages but not less than $2,500 in liquidated damages, plus punitive damages and attorneys' fees, and records must be destroyed no later than one year after they are no longer needed. Its reach into streaming and website video analytics has made it an active litigation risk.

How federal and state laws interact

Preemption differs by statute, which is why federal compliance rarely settles the question.

The data-level versus entity-level exemption question is the one most often got wrong; the US State Privacy Laws Guide covers how states differ, and the US State Privacy and Security Laws Quick Reference lists them.

What federal law leaves uncovered

• General consumer data: browsing, location, purchase and inferred data held by ordinary businesses has no general federal statute. FTC Section 5 enforcement against unfair or deceptive practices is the main federal lever; see the FTC Act Section 5 Data Security Guide.
• Health data outside HIPAA: fitness apps, wearables and consumer health services are often outside HIPAA. The FTC Health Breach Notification Rule and state laws such as Washington's My Health My Data Act cover parts; see the Health Data Privacy Beyond HIPAA Guide (My Health My Data).
• Teenagers: COPPA stops at 13. Protection for 13 to 17 year olds comes mainly from state law.
• Biometrics: no general federal biometric statute; see the Biometric Privacy Laws Map for state laws.
• Data brokers: federal law limits some transfers to foreign adversaries (PADFA) but has no general registry or deletion right; states fill this, see US State Data Broker Laws Compared.
• General breach notification: there is no single federal breach notification law for all personal data; notification comes from sector rules (HIPAA, GLBA Safeguards, FCC, SEC disclosure rules for public companies) and all 50 state laws.
• Employee data: workplace monitoring sits mostly under ECPA and state law; see the Employee Monitoring and Privacy Guide.

Federal comprehensive privacy bills: current status

Congress has debated a comprehensive privacy law for years without passing one. The 2024 American Privacy Rights Act discussion draft did not become law. In April 2026 House Energy and Commerce Vice Chair John Joyce introduced the Securing and Establishing Consumer Uniform Rights and Enforcement over Data Act (SECURE Data Act, H.R. 8413). IAPP's analysis describes broad preemption that would displace state laws that "relate to" its provisions, likely including state consumer privacy laws and data broker registries. LegiScan records it as referred to the Energy and Commerce and Judiciary Committees, with no markup or House vote recorded as of 14 November 2026.

Plan for the patchwork, not for the bill. Even if a preemptive law passes, its effective date and its treatment of existing sector laws will decide how much of today's programme changes. Keep the state law inventory current and watch the committee record.

Working out which federal laws apply

1. Inventory personal data by category: health, financial, children's, education, consumer report, video viewing, communications content, biometric and general consumer data. The Data Mapping and ROPA Guide covers the method.
2. Test entity status for each sector law: are you a covered entity or business associate (HIPAA), a financial institution (GLBA), an operator directed to children or with actual knowledge (COPPA), a funded educational institution or its contractor (FERPA), a consumer reporting agency, user or furnisher (FCRA), or a video tape service provider (VPPA)?
3. Record the regulator and penalty route for each law that applies, including private rights of action such as VPPA's.
4. Overlay state law: for each state where you have customers, check whether its comprehensive law exempts your entity, only the federally regulated data, or neither.
5. Map notification duties: list every federal and state breach clock that could start from one incident, with the shortest first.
6. Assign owners and review dates: COPPA, HIPAA security and federal bills are all moving; review the map at least twice a year.

Where identity fits

Most of these laws turn on who can reach regulated data. Service accounts, integration tokens and AI agents that read health, financial or student records are access paths regulators expect you to control and log as tightly as staff access. Include non-human identities in the data inventory step above, and scope their access to the regulated data set. See the HIPAA Security Rule Guide and the GLBA Safeguards Rule Guide for access control requirements.

Detection and measurement

• Applicability coverage: share of personal data categories in the inventory with a recorded federal and state legal basis and owner.
• Notification readiness: every applicable breach clock documented in the incident plan, tested in a tabletop at least yearly.
• Third-party coverage: share of vendors handling regulated data with the right contract (business associate agreement, GLBA service provider terms, FERPA school official terms).
• Regulatory change lag: days from a rule change (such as the COPPA amendments) to an updated control and notice.
• Rights request performance: HIPAA access, FERPA inspection and state rights requests completed within their statutory periods.

Framework mapping

Common failure patterns

• Assuming HIPAA covers all health data. Consumer health apps and wellness programmes are often outside it and inside FTC and state rules instead.
• Treating a state exemption as company-wide. A data-level exemption covers the regulated data only; the rest of the company's data is still in scope.
• Stopping at federal compliance. HIPAA and GLBA keep stricter state laws, so a federal-only programme can still breach state requirements.
• Ignoring VPPA in analytics. Embedding video with third-party tracking can create disclosure claims with liquidated damages per consumer.
• Waiting for a federal law. Programmes paused for a comprehensive bill end up behind on state laws already in force.
• Missing the COPPA 2025 changes. Separate consent for third-party disclosure and retention limits now apply; older consent flows may not meet them.

Practitioner checklist

• Classify personal data by federal sector category and record which statute, if any, governs each.
• Document entity status under HIPAA, GLBA, COPPA, FERPA, FCRA and VPPA, with the reasoning.
• Record each applicable regulator, penalty route and private right of action.
• Overlay state laws and record whether each exempts your entity or only regulated data.
• List every breach notification clock that one incident could start, shortest first.
• Check COPPA consent flows and retention against the 2025 amendments.
• Put the correct contract in place with every vendor handling regulated data.
• Include service accounts, tokens and AI agents in access reviews for regulated data.
• Track federal privacy bills and review this map at least twice a year.

Standards and references

• US Department of Health and Human Services: Summary of the HIPAA Privacy Rule
• Federal Trade Commission: Gramm-Leach-Bliley Act
• Federal Trade Commission: Children's Online Privacy Protection Rule
• US Department of Education: Family Educational Rights and Privacy Act regulations
• Federal Trade Commission: Fair Credit Reporting Act
• Cornell Legal Information Institute: 18 U.S.C. 2710, Video Privacy Protection Act
• Cornell Legal Information Institute: 15 U.S.C. 6807, Relation to State laws
• IAPP: SECURE Data Act analysis

Related NHI Mgmt Group resources: US State Privacy Laws Guide · HIPAA Privacy Rule Guide · GLBA Safeguards Rule Guide · COPPA and Children's Privacy Guide. This guide summarises US federal sector privacy laws and is not legal advice.