US state privacy lawsقوانين الخصوصية الأمريكية

The United States has no single federal privacy law. Each state writes its own, so the rights and duties change with where the customer lives rather than where the company sits.

A single company can cross several legal boundaries before a customer changes the address inside its app.

Why does America have state laws instead of one federal law?

This confuses anyone used to a single regime. Europe has one regulation, Saudi Arabia has one law, and the United States has dozens that change every year.

The reason is not chaos but constitutional structure. States hold the power to legislate on what is not federally regulated. Congress has repeatedly tried to pass a comprehensive privacy law and failed, so states filled the vacuum one after another.

The practical consequence lands directly on you: there is no "US compliance" you complete once. There is a question that recurs every time a new state arrives: have we crossed this law's threshold?

And there is the essential difference from Europe. The European regime applies the moment you serve someone there. State laws usually apply only after you pass a threshold: a number of consumers, a revenue figure, or a share of your income derived from selling data.

So the real risk is not breaking a rule. It is growing without noticing that you crossed a line. A company that was out of scope last year can be in scope this year with nothing about its product having changed.

California opened the path

California enacted the Consumer Privacy Act in 2018, and it took effect in 2020. Voters expanded it through the California Privacy Rights Act in 2020, with most amendments becoming operative in 2023. The amendment also created the California Privacy Protection Agency, which writes regulations and enforces the law alongside the attorney general.

California did not remain alone. Virginia, Colorado, Connecticut, and Utah followed, then more states added laws with different dates and scopes. Most provide rights to access, correct, delete, and obtain a copy, plus rights to opt out of sale, targeted advertising, or certain profiling.

Similarity does not make one interface automatically lawful everywhere. Definitions of sale, sensitive data, response periods, appeals, and risk assessments vary. One state may exempt an entire financial institution, while California exempts defined data processed under a federal financial law.

The threshold comes before the rights list

The analysis does not begin with whether one American has used the product. State laws set thresholds for covered businesses, commonly using revenue, the number of consumers, or the share of income earned from selling data. A large retailer can fall under a law that does not yet cover an app serving one thousand people.

California covers for-profit businesses doing business in the state and deciding how California residents' data is processed when one of several tests is met. One test is a gross annual revenue threshold originally set at USD 25 million and adjusted periodically. Others cover data concerning 100,000 consumers or households, or earning half of annual revenue from selling or sharing personal information.

Other states commonly use a threshold of 100,000 consumers in a year. It may fall to 25,000 where a substantial share of revenue comes from selling data. Never copy figures between states. Some remove a revenue test, change the percentage, or exclude data processed solely to complete a payment.

Counting is itself a technical task. The company needs to know the person's state and distinguish consumers from employees where scope differs. It must also avoid counting one person's device, browser, and account as three people. Discovering in December that the threshold was crossed is of little help if the product spent the year without a rights process.

Opt-out is the different default

The European model usually begins with a lawful basis and sometimes requires consent before use. Many US state laws permit broad commercial uses until the person exercises an opt-out. This is often described as American opt-out versus European opt-in, although both systems contain exceptions.

Opt-out does not mean every collection is allowed until a complaint appears. Notice, purpose, data minimisation, and security duties still apply. Some states require consent before processing sensitive data. Children's rules, health-data laws, and sector rules also protect cases that do not wait for a general opt-out.

Sale can mean more than handing over a list for cash. In California it can include transferring personal information to another party for money or another valuable benefit. Sharing covers making it available for cross-context behavioural advertising even when an advertising platform does not pay a direct price for each record.

The opt-out control is part of the product

The Do Not Sell or Share My Personal Information link is not merely legal text in a footer. It begins a product journey that identifies the person and scope and records the preference. It stops signals to advertising platforms and preserves the opt-out when the person returns through a recognised device.

Design must not make refusal harder than acceptance. Do not require five screens and a faded button after consent took one tap. Do not demand an account when the request can be completed without one. Do not label a close button as saving choices when it restores every tracker.

California recognises opt-out preference signals sent by a browser or other tool, including Global Privacy Control. The product must detect the signal and connect it to real vendor behaviour. A success message while advertising requests continue unchanged is not compliance.

The interface may need to distinguish California sale and sharing, targeted advertising in another state, and profiling with significant effects. A team can build a common preference layer and apply rules by location and law. Testing must run from the browser through to the vendor record, not stop at the appearance of the button.

Rights require proportionate identity checks

A covered consumer may request categories or copies of data, correction of inaccurate information, and deletion where the rule applies. Many laws also allow an authorised agent to make some requests, and some give the consumer a route to appeal the company's refusal.

Responses depend on a data map. A support team cannot execute a right when information is scattered across the account database, analytics platform, ticketing system, and three advertising networks. The process therefore begins with systems and suppliers and ends with a record of what was done and when.

Financial services do not all leave scope

The federal Gramm-Leach-Bliley Act, or GLBA, governs covered financial institutions' handling of nonpublic personal information. Covered institutions extend beyond traditional banks and can include lenders, money transmitters, and financial advisers depending on their activities. The law imposes a privacy layer and an information-security layer.

The Federal Trade Commission enforces parts of GLBA for institutions within its jurisdiction. Its Privacy Rule addresses notices and certain disclosure limits. Its Safeguards Rule requires a written information security programme, risk assessment, controls, and supplier oversight. Compliance does not prevent state law from applying to data or activities outside those rules.

The trap lies in the word exemption. Some state laws exempt a financial institution subject to GLBA at entity level. California instead exempts personal information collected, processed, sold, or disclosed under GLBA at data level. It does not give a bank a universal exemption for everything it does.

Loan-account data may be exempt while data about a non-customer visiting a marketing site remains subject to California law. Information from a product outside the covered financial activity may also remain in scope. The company must classify data by purpose and relationship rather than labelling the entire warehouse financial data.

The FTC publishes practical material on the GLBA Privacy Rule and Safeguards Rule. The California agency publishes state regulations, guidance, and implementation material. Start with the authority that owns the rule, then connect each duty to a specific flow inside the product.

Advertising, vendors, and contracts

Marketing teams need to know what each tool sends as a page loads. A network address, device identifier, page, and campaign can leave before the person sees a preference centre. Network traffic must be inspected, relevant tools must stop after an opt-out, and testing must be repeated after every tag-manager update.

A method that does not memorise fifty laws

Build a baseline that provides the common rights, minimises data, and controls suppliers. Maintain a small matrix for differences that change implementation. Record each state's threshold, financial exemption, sale definition, sensitive-data rule, universal opt-out signal, response period, and appeal.

Treat crossing a threshold or entering a new state as an event that opens a review before the campaign. Monitor consumer counts, revenue, and data sources every quarter. Do not wait for a letter from an attorney general to discover that growth changed the product's legal position.