Key points
- There is no direct U.S. equivalent of the GDPR.
- Federal and state rules can apply to the same organization at the same time.
- Regulators and courts shape how statutory requirements work in practice.
- Applicability depends on sector, location, data type and activity.
Federal and state authority
Congress creates nationwide rules in defined areas, while states retain broad authority over privacy, consumer protection, cybersecurity and commercial practices. A single organization may therefore face both federal and state obligations.
Where U.S. data law comes from
The framework is built from federal statutes, state legislation, administrative regulations, judicial decisions and regulatory enforcement. Understanding the source of a rule helps identify who interprets and enforces it.
Key regulators
Important federal authorities include the Federal Trade Commission, Department of Health and Human Services, Securities and Exchange Commission, Federal Communications Commission and Consumer Financial Protection Bureau. Each acts within a different statutory mandate.
A practical applicability check
Start with five questions: What sector are you in? Which states are relevant? What categories of information are processed? Which federal laws may apply? Which regulators or contractual obligations add requirements?
Structured from The Complete Guide to U.S. Data Laws v0.1 (source content last updated July 10, 2026). This web edition removes repetition and reorganizes the original material for direct topic-based use.