Federal Data Laws

Is there one federal privacy law?

No. U.S. federal data law is sector-specific: Congress passed separate statutes for health, finance, children, education, credit and communications rather than one comprehensive privacy code. Everything that falls outside those sectors is mostly governed by state law and by the FTC’s authority over unfair or deceptive practices.

A comprehensive bill, the SECURE Data Act, had a House subcommittee hearing on June 3, 2026. Reporting says members split along party lines over preemption of state laws and no committee vote was reported. It is not law. Check Congress.gov for its current status.

Which federal law covers my data?

It depends on who holds the data and what kind it is:

Does HIPAA apply to me?

HIPAA applies to “covered entities” (healthcare providers that conduct certain transactions electronically, health plans and healthcare clearinghouses) and to their “business associates,” the vendors that handle protected health information for them. It is about who holds the data, not just what the data is. Health information collected by a company that is neither a covered entity nor a business associate generally falls outside HIPAA, although state law and FTC rules can still apply.

HIPAA has a Privacy Rule (who may use or share the information, and patient rights), a Security Rule (administrative, physical and technical safeguards) and a Breach Notification Rule (a 60-day clock). HHS’s Office for Civil Rights enforces it, and state attorneys general can too. HHS proposed a major Security Rule update in January 2025; reporting in 2026 says the final rule is now listed for July 2027.

What does the Gramm-Leach-Bliley Act require?

GLBA covers “financial institutions,” a broad term that includes banks, lenders, insurers and investment advisers, and many non-bank businesses such as mortgage brokers, tax preparers and auto dealers that arrange financing. It has two main parts.

The Privacy Rule requires institutions to explain their information-sharing practices to customers and to give a chance to opt out of certain sharing with non-affiliated third parties. The Safeguards Rule requires a written information security program to protect customer information. Under the FTC’s version, covered firms must also notify the FTC within 30 days of discovering a breach involving 500 or more consumers (since May 13, 2024). Banks and similar institutions answer to their own federal and state supervisors.

What does COPPA require?

COPPA protects children under 13 online. It covers operators of websites, apps and other online services directed to children, and general-audience services that knowingly collect personal information from children. Operators must give notice, obtain verifiable parental consent, keep the data secure and retain it only as long as reasonably necessary.

The FTC’s amended rule was published on April 22, 2025 and took effect June 23, 2025, with most new requirements applying from April 22, 2026. Changes include biometric identifiers (such as fingerprints, voiceprints and faceprints) and government-issued ID numbers expressly counting as personal information, a definition of mixed-audience services, permission to use a mobile number to text a parent for consent, and updated notice, security, deletion and retention duties. The FTC and state attorneys general enforce COPPA.

What does FERPA protect?

FERPA applies to schools and education agencies that receive funding from the U.S. Department of Education. It gives parents rights over their children’s education records, and those rights pass to the student at age 18 or on attending a postsecondary school.

The core rights are to inspect and review records, to request correction of inaccurate records, and to consent before most disclosures. Exceptions exist, such as sharing with school officials who have a legitimate educational interest, and schools may release “directory information” unless a parent or eligible student opts out. Ed-tech vendors typically operate under FERPA through contracts with the school. The Department of Education enforces the law, and the ultimate sanction is loss of federal funding.

What does the Fair Credit Reporting Act cover?

FCRA regulates consumer reporting agencies (the credit bureaus and background-check companies), the businesses that furnish information to them, and anyone who uses reports for credit, employment, insurance or housing decisions.

Users need a permissible purpose. Employers must give notice and get consent before a background check. If a report contributes to a negative decision, the user must send an adverse-action notice. Consumers can get their file disclosures, dispute inaccurate items (agencies generally must investigate within 30 days) and sue in certain cases. The FTC and CFPB enforce. FCRA also matters for automated scoring and algorithmic decisions that rely on consumer reports.

What is the Electronic Communications Privacy Act?

ECPA, passed in 1986, has three parts: the Wiretap Act, which prohibits intercepting communications in transit; the Stored Communications Act, which covers email and other stored communications held by service providers and sets rules for government access; and the Pen Register Act. It limits private snooping as well as government surveillance, and in some situations it allows civil lawsuits.

It remains the backbone of debates over law-enforcement access to cloud data and encrypted messaging. Many states add stricter rules, for example requiring all parties to consent to recording a call.

What are the CAN-SPAM rules for marketing email?

CAN-SPAM covers commercial email, including business-to-business messages. It does not require opt-in consent before you email someone, but senders must not use false or misleading header information or subject lines, must identify the message as an ad, must include a valid physical postal address, and must offer a clear way to opt out and honor opt-outs within 10 business days.

Each separate non-compliant email can count as a violation. The FTC enforces the law, and CAN-SPAM overrides most state email laws other than those aimed at falsity or deception.

Which other federal laws might apply?

• FTC Act, Section 5: the FTC uses its power over unfair or deceptive practices against broken privacy promises and weak data security.
• Video Privacy Protection Act: video rental and streaming viewing records.
• Telephone Consumer Protection Act: consent for marketing calls and texts.
• Driver’s Privacy Protection Act: motor vehicle records.
• GINA: genetic information in health insurance and employment.
• Privacy Act of 1974: records held by federal agencies.

Who enforces these laws?

Different agencies enforce different statutes: the FTC, HHS, the SEC, the CFPB, the FCC and the Department of Education, with the Department of Justice and courts involved in communications privacy. State attorneys general can enforce some federal laws, including HIPAA and COPPA.

Guidance and enforcement actions often show how a statute will be applied in practice, so organizations follow them as closely as the legislation itself. Current priorities include artificial intelligence, biometrics, cloud services, cybersecurity governance and children’s data. See Enforcement & Compliance.

Do federal laws override state laws?

Usually not. Most federal privacy statutes set a floor, and states may add stricter rules. HIPAA, for example, generally leaves in place state laws that are more protective of health information. Some federal laws do override state law in part, such as CAN-SPAM for commercial email.

The question matters for the future too: the proposed SECURE Data Act would preempt almost all state privacy laws that overlap with it, which is the main point of disagreement in Congress. Until something passes, national organizations assess federal and state layers together. See State Privacy Laws.

What if none of these laws applies to me?

Then state law and the FTC Act are the main layers. If you handle personal information about residents of states with comprehensive privacy laws, those laws may apply once you meet their thresholds. Every state also has a breach notification law that applies to most organizations. Use Start here to find your path, or compare the 19 profiled states.