Navigating the Fragmented Landscape of US Data Privacy and Security Law for Global Businesses

For many international corporations, the European Union’s General Data Protection Regulation (GDPR) has long been considered the "gold standard" of data privacy. Consequently, many non-U.S. businesses operate under the assumption that achieving GDPR compliance—or adhering to similar robust home-country laws—will largely satisfy the regulatory requirements of the United States. However, legal experts Kevin Coy and Erin Doyle of Arnall Golden Gregory warn that this is a dangerous misconception. The U.S. regulatory environment is not a single, unified framework; rather, it is a fragmented, highly sector-specific, and state-driven mosaic that generates distinct regulatory and litigation risks often overlooked by foreign entities.

As global commerce becomes increasingly digitized, the stakes for data governance have never been higher. For compliance professionals, in-house counsel, and business leaders planning to enter or expand within the U.S. market, understanding the nuances of American privacy law is no longer optional. It requires a deep dive into 12 critical areas of data privacy, security diligence, and governance.

The Evolution of the U.S. Privacy Landscape: A Chronology

To understand the current complexity, one must look at the historical trajectory of U.S. privacy law. Unlike the EU, which adopted a comprehensive "rights-based" approach, the U.S. has historically favored a "harm-based" and sectoral approach.

• 1974: The Privacy Act regulates how federal agencies handle personal information.
• 1996: The Health Insurance Portability and Accountability Act (HIPAA) establishes the first major federal sectoral privacy standards for health data.
• 1998: The Children’s Online Privacy Protection Act (COPPA) addresses the digital safety of minors.
• 1999: The Gramm-Leach-Bliley Act (GLBA) introduces privacy and security mandates for the financial sector.
• 2018: California passes the California Consumer Privacy Act (CCPA), the first GDPR-style state law in the U.S.
• 2020-2024: A "state-level explosion" occurs, with over 20 states enacting comprehensive privacy statutes.
• 2025: New Department of Justice (DOJ) regulations take effect, restricting the transfer of bulk sensitive data to "countries of concern."

1. The Persistence of Sectoral Federal Privacy Laws

While the U.S. lacks an omnibus federal law equivalent to the GDPR, it maintains several powerful sectoral regimes. HIPAA remains the cornerstone of healthcare privacy, governing "covered entities" such as hospitals and health plans, as well as their "business associates"—a category that includes any service provider processing protected health information (PHI).

Similarly, the GLBA applies to a wide range of financial institutions beyond traditional banks, including mortgage brokers and certain fintech startups. These laws are not mere suggestions; they require specific privacy notices, regulate the sharing of "non-public personal information," and impose rigorous technical safeguards. For foreign businesses, these should be viewed as primary regulatory hurdles rather than secondary supplements to their existing global policies.

2. The Rise of the State-Level "Patchwork"

In the absence of federal action, individual states have stepped into the vacuum. The CCPA, later amended by the California Privacy Rights Act (CPRA), remains the most demanding. It created the California Privacy Protection Agency (CPPA), the first dedicated privacy regulator in the country. Following California’s lead, states like Virginia, Colorado, Connecticut, and Texas have enacted their own statutes.

Each state law is unique, creating a "patchwork" effect. While they generally share concepts like data minimization and consumer rights (the right to access, delete, or opt-out of data sales), their applicability triggers differ. Some laws apply based on annual revenue, while others trigger based on the volume of personal data processed. A threshold assessment of which state laws apply is a mandatory first step for any U.S. market entry strategy.

3. Marketing, Communications, and the Cost of Non-Compliance

The U.S. maintains strict rules regarding commercial outreach. The federal CAN-SPAM Act regulates commercial email, requiring accurate header information and functional opt-out mechanisms. More litigious, however, is the Telephone Consumer Protection Act (TCPA) and its state-level counterparts.

The TCPA regulates telemarketing, automated calling, and text messaging. Violations can be incredibly costly, with statutory damages ranging from $500 to $1,500 per individual violation (e.g., per text message). For a company launching a nationwide marketing campaign, these penalties can quickly escalate into multi-million-dollar class-action settlements.

4. Website Tracking and the New Frontier of Wiretapping Claims

A surging trend in U.S. litigation involves the use of website tracking technologies. Plaintiffs’ attorneys are increasingly using decades-old federal and state wiretapping and eavesdropping statutes to challenge the use of "session replay" software, cookies, and pixels. These laws often require one-party or all-party consent to record communications. If a business uses a third-party tool to track user interactions on its website without proper disclosure and consent, it may find itself accused of "intercepting" electronic communications.

5. Heightened Protections for Children and Teens

Children’s privacy is a top priority for U.S. regulators. COPPA applies to online services directed at children under 13 or those that knowingly collect data from them. It requires verifiable parental consent—a high bar for many digital platforms.

Furthermore, a new wave of state-level "Age-Appropriate Design Codes" (modeled after UK standards) is extending protections to teenagers up to age 18. These laws focus on "safety by design," requiring companies to default to the highest privacy settings for minors and limiting the use of profiling or targeted advertising.

6. AI Governance and Automated Decision-Making

As artificial intelligence (AI) integrates into business operations, U.S. states are moving to regulate it. New laws, such as Colorado’s AI Act, focus on transparency and the prevention of "algorithmic discrimination."

Businesses must conduct impact assessments when AI models affect "consequential decisions" regarding employment, housing, credit, or healthcare. Foreign companies with AI governance programs built around the EU AI Act will need to adapt to U.S.-specific expectations regarding training data scrutiny and the right of consumers to opt out of automated profiling.

7. The Complexity of Employee and Applicant Privacy

Non-U.S. employers are often surprised by the breadth of U.S. workplace privacy rules. The federal Fair Credit Reporting Act (FCRA) regulates background checks, requiring specific disclosures and authorizations. Additionally, many states have "Ban the Box" or "Fair Chance" laws that restrict when an employer can ask about criminal history.

Other emerging state laws protect employees’ lawful off-duty conduct (such as the use of legal products like cannabis in certain states) and prohibit employers from requesting social media credentials.

8. Biometrics and the "Illinois Effect"

Biometric privacy—covering fingerprints, facial recognition, and voiceprints—is a high-risk area. The Illinois Biometric Information Privacy Act (BIPA) is the most prominent example, allowing for a private right of action. This has led to massive settlements; for instance, Facebook famously settled a BIPA class action for $650 million. Companies using biometric time clocks or security systems must ensure they have informed written consent and clear data retention policies.

9. Statutory Cybersecurity Standards

The U.S. is moving away from vague "reasonable security" requirements toward detailed statutory standards. Many state laws now prescribe specific controls, such as multi-factor authentication (MFA) and encryption. In sectors like financial services and critical infrastructure, risk assessments and board-level reporting are becoming mandatory. California, for example, is introducing requirements for certain businesses to conduct annual cybersecurity audits and submit certifications to the state.

10. The 50-State Data Breach Notification Challenge

If a data breach occurs, a company must navigate the notification statutes of all 50 U.S. states and several territories. Each jurisdiction has its own definition of "personal information," its own timeline for notification (ranging from "as soon as possible" to a strict 30-day window), and its own requirements for notifying regulators or credit bureaus. A single breach involving customers in multiple states requires a highly coordinated, state-by-state legal analysis.

11. National Security and Data Export Restrictions

Historically, the U.S. did not restrict the export of personal data. This changed in January 2025, when the DOJ finalized regulations prohibiting or restricting "covered data transactions" involving bulk sensitive personal data (such as geolocation, health, or genomic data) with "countries of concern," including China, Russia, Iran, and North Korea.

A separate 2024 law also targets third-party data brokers, preventing the sale of American data to foreign adversaries. These regulations add a layer of geopolitical risk to data management that GDPR-centric programs may not have addressed.

12. The Power of the FTC and UDAP Laws

Finally, the Federal Trade Commission (FTC) serves as the nation’s primary privacy watchdog through its authority to prohibit "unfair or deceptive acts and practices" (UDAP). If a company’s privacy policy makes a promise it does not keep, the FTC can bring an enforcement action. Even without a broken promise, the FTC can sue if a company’s security practices are so inadequate that they cause "substantial injury" to consumers.

Analysis: The Litigation Risk and the Path Forward

The defining characteristic of the U.S. privacy landscape is the prevalence of the "Private Right of Action." Unlike the EU, where enforcement is primarily handled by Data Protection Authorities (DPAs), many U.S. laws allow individual citizens to sue companies directly. This creates a fertile environment for class-action litigation.

According to data from various legal tracking services, data privacy-related class actions in the U.S. have increased by over 50% in the last three years. The average cost of a data breach in the U.S. reached $9.48 million in 2023, significantly higher than the global average, according to IBM’s annual report.

For global businesses, the takeaway is clear: compliance is not a "one-and-done" checkbox. It requires a targeted U.S. privacy and data use assessment. Companies must calibrate their governance, contracting, and insurance strategies to account for consumer, employee, and business-to-business data flows. While GDPR provides a strong foundation, the U.S. market demands a tailored, localized approach to survive its unique regulatory and litigation gauntlet.