Skip to main content
United States of America · Reviewed September 2026

What Is United States Privacy Framework: Sectoral Federal Laws and State Privacy Regimes?

No comprehensive federal private-sector privacy statute was located in the supplied source review. The federal baseline is sectoral, with the profile recording FTC privacy oversight alongside FCRA and CFPB, GLBA, the DOJ Privacy Act, CAN-SPAM, Do Not Call, and PADFAA materials. These routes have different scopes, rights, exemptions, and enforcement mechanisms. State and District of Columbia regimes add varying rights and exemptions, so no single state-law route should be described as nationwide. The California Privacy Protection Agency’s current data-broker materials identify a California-specific DROP route. This is a bounded evidence profile of the supplied federal and state-level materials, not a single comprehensive United States privacy statute or a complete fifty-state legal review.

Rahul Kandoriya
Written byRahul Kandoriya·Founder, OfflistMe·Last updated September 6, 2026

At a glance

Full name
United States Privacy Framework: Sectoral Federal Laws and State Privacy Regimes
Short code
U.S. Privacy Law
Jurisdiction
United States of America
Enacted
2013
Last major update
California’s current data-broker materials identify a state-specific DROP route; state and District of Columbia regimes continue to vary by rights and exemptions
Regulator
Federal Trade Commission (FTC), with sectoral federal regulators and state authorities depending on the applicable regime
Private right of action
Limited

Scope, who U.S. Privacy Law covers

Sectoral federal privacy laws and state and District of Columbia privacy regimes within their respective scopes. The supplied summary did not establish one uniform territorial, sectoral, or exemption description for the United States.

Protected data

Data covered by the applicable sectoral federal law or state or District of Columbia regime. The supplied summary did not provide a single nationwide protected-data category list.

Data subject rights

Rights vary by the applicable federal sectoral, state, or District of Columbia regime; no uniform nationwide rights list was located

California-specific data-broker route through the DROP materials identified by the California Privacy Protection Agency

Any access, correction, deletion, objection, marketing, or related right must be checked against the applicable regime and its exemptions

Notable features

Because no single comprehensive federal private-sector statute was located, 2013 is used as the year of the supplied GAO federal-privacy baseline source rather than as the enactment year of a comprehensive law. The California DROP route is state-specific and is not treated as a nationwide route.

Enforcement & penalties

Regulator: Federal Trade Commission (FTC), with sectoral federal regulators and state authorities depending on the applicable regime

Penalties: The supplied summary and sources did not provide a consolidated nationwide penalty schedule; no single penalty amount or timeline is stated here.

Private right of action: The supplied evidence profile records sectoral federal and state or District of Columbia routes but does not establish a uniform nationwide private right of action. Available remedies depend on the applicable regime and its exemptions.

Relevance to data brokers

California’s current DROP materials identify a California-specific data-broker route. No nationwide United States data-broker or people-search route is asserted here; state, federal sectoral, and exemption analysis remains regime-specific.

Generate requests in under 60 seconds

Generate removal requests for 1,034 US/global profiles, $9

OfflistMe helps draft opt-out requests using the details you choose. Review the provider route and legal basis, then send from your own inbox. The tool is not legal advice and does not guarantee a broker's response.

FAQ

Does the United States have one comprehensive federal private-sector privacy law?+

No comprehensive federal private-sector privacy statute was located in the supplied evidence profile. The federal baseline is sectoral, while state and District of Columbia regimes add varying rights and exemptions.

Is California’s DROP route a nationwide data-broker opt-out?+

No. The supplied California Privacy Protection Agency materials identify DROP as a California-specific route; this profile does not treat it as a nationwide United States route.

What privacy rights apply in the United States?+

The applicable rights depend on the federal sectoral, state, or District of Columbia regime and its exemptions. The supplied research did not establish one uniform nationwide rights list.

Official sources & citations

Other international privacy regimes

U.S. Privacy Law sits in a global ecosystem of data-protection laws. Compare with other jurisdictions that shape cross-border data flows:

United Kingdom · enacted 2018What is UK GDPR?Canada · enacted 2000What is PIPEDA?Brazil · enacted 2018What is LGPD?India · enacted 2023What is DPDP Act?Australia · enacted 1988What is Privacy Act 1988?Japan · enacted 2003What is APPI?China · enacted 2021What is PIPL?France · enacted 1978What is Loi Informatique et Libertés?Germany · enacted 2018What is BDSG?Argentina · enacted 2000What is Law 25.326?Philippines · enacted 2012What is RA 10173?South Africa · enacted 2013What is POPIA?Malaysia · enacted 2010What is Malaysia PDPA?United Arab Emirates · enacted 2021What is UAE PDPL?Republic of Korea · enacted 2011What is Korea PIPA?Netherlands · enacted 2018What is UAVG?Nigeria · enacted 2023What is NDPA?Pakistan · enacted 2016What is PECA + Art. 14?Peru · enacted 2011What is Law 29733?Saudi Arabia · enacted 2021What is PDPL?Thailand · enacted 2019What is Thai PDPA?Türkiye · enacted 2016What is KVKK?Viet Nam · enacted 2025What is Law No. 91/2025?Poland · enacted 2018What is Poland GDPR + UODO Act?Portugal · enacted 2019What is Portugal GDPR + Lei 58/2019?Romania · enacted 2018What is Romania GDPR + Law 190/2018?Bangladesh · enacted 2026What is Act No. 63 of 2026?Chile · enacted 2024What is Law 21.719?Colombia · enacted 2012What is Law 1581?Egypt · enacted 2020What is Law No. 151 of 2020?Indonesia · enacted 2022What is UU PDP?Israel · enacted 1981What is Privacy Law 5741-1981?Kazakhstan · enacted 2013What is Law No. 94-V?Mexico · enacted 2025What is LFPDPPP (2025)?Albania · enacted 2024What is Law 124/2024?Armenia · enacted 2015What is HO-49-N?Azerbaijan · enacted 2010What is Law 998-IIIQ?Bosnia and Herzegovina · enacted 2025What is Law 12/25?Hungary · enacted 2011What is Info tv. + GDPR?Iceland · enacted 2018What is Act No. 90/2018 + GDPR?Jamaica · enacted 2020What is Data Protection Act 2020?Kenya · enacted 2019What is Data Protection Act 2019?Kyrgyzstan · enacted 2025What is Digital Code?Latvia · enacted 2018What is PDL?Luxembourg · enacted 2018What is Law of 1 August 2018?Malta · enacted 2018What is Chapter 586?Republic of Moldova · enacted 2024What is Law no. 195/2024?Mongolia · enacted 2021What is Law on Personal Data Protection?Montenegro · enacted 2008What is Law on Personal Data Protection?Morocco · enacted 2009What is Law 09-08?Estonia · enacted 2018What is IKS?Georgia · enacted 2023What is Law No. 3144?Ghana · enacted 2012What is Act 843?Greece · enacted 2019What is Law 4624/2019?North Macedonia · enacted 2020What is Law 42/2020?Russian Federation · enacted 2006What is 152-FZ?Senegal · enacted 2008What is Law No. 2008-12?Serbia · enacted 2018What is Law 87/2018?Slovakia · enacted 2018What is Act No. 18/2018 Coll.?Slovenia · enacted 2022What is ZVOP-2?Sri Lanka · enacted 2022What is PDPA?Tunisia · enacted 2004What is Organic Law No. 2004-63?Ukraine · enacted 2010What is Law No. 2297-VI?Bulgaria · enacted 2001What is PDPA?Croatia · enacted 2018What is Act on the Implementation of the GDPR?Cyprus · enacted 2018What is Law 125(I)/2018?Czechia · enacted 2019What is Act No. 110/2019 Coll.?Austria · enacted 1999What is DSG?Belgium · enacted 2018What is Belgian Data Protection Act?Denmark · enacted 2018What is Databeskyttelsesloven?Finland · enacted 2018What is Data Protection Act 1050/2018?Norway · enacted 2018What is Personal Data Act?Afghanistan · enacted 2010What is Sectoral Privacy Protections?Algeria · enacted 2018What is Law No. 18-07 + Law No. 25-11?Andorra · enacted 2021What is LQPD?Angola · enacted 2011What is Law No. 22/11?Antigua and Barbuda · enacted 2013What is Data Protection Act 2013?Bahamas · enacted 2003What is DPA 2003?Bahrain · enacted 2018What is Law No. 30 of 2018?Barbados · enacted 2019What is Data Protection Act 2019-29?Belarus · enacted 2021What is Law No. 99-Z?Belize · enacted 2021What is Data Protection Act 2021?Benin · enacted 2018What is Code du numérique, Book V?Bhutan · enacted 2018What is ICM Act 2018 + NDGF 2025?Bolivia (Plurinational State of) · enacted 2009What is Art. 21(2), 25, 130–131 + Law 254?Botswana · enacted 2024What is Data Protection Act 2024?Brunei Darussalam · enacted 2025What is PDPO 2025?Burkina Faso · enacted 2021What is Loi n°001-2021/AN?Burundi · enacted 2026What is Law No. 1/03 of 2026?Cabo Verde · enacted 2001What is Lei n.º 133/V/2001?Cambodia · enacted 2019What is Fragmented privacy framework?Cameroon · enacted 2024What is Law No. 2024/017?Central African Republic · enacted 2024What is Law No. 24.001?Costa Rica · enacted 2011What is Ley 8968?Ecuador · enacted 2021What is LOPDP?El Salvador · enacted 2024What is LPDP?Dominican Republic · enacted 2013What is Ley 172-13?Sweden · enacted 2018What is GDPR + Data Protection Act?Malawi · enacted 2024What is Malawi DPA 2024?Mali · enacted 2013What is Mali Law 2013-015?Mauritania · enacted 2017What is Mauritania Law 2017-020?Mauritius · enacted 2017What is Mauritius DPA 2017?Monaco · enacted 2024What is Monaco Law 1.565?Nepal · enacted 2018What is Nepal Privacy Act 2075?Oman · enacted 2022What is Oman PDPL?Panama · enacted 2019What is Panama Ley 81/2019?Paraguay · enacted 2025What is Paraguay Law 7593/2025?Qatar · enacted 2016What is Qatar Law No. 13 of 2016?Rwanda · enacted 2021What is Rwanda Law 058/2021?Saint Lucia · enacted 2011What is Saint Lucia DPA 2011?Togo · enacted 2019What is Togo Law 2019-014?Turkmenistan · enacted 2017What is Turkmenistan Law 519-V?United Republic of Tanzania · enacted 2022What is Tanzania PDPA 2022?Uruguay · enacted 2008What is Uruguay Ley 18.331?Vanuatu · enacted 2024What is Vanuatu DPPA 2024?Zimbabwe · enacted 2021What is Zimbabwe Cyber and Data Protection Act?Chad · enacted 2015What is Chad Law 007/PR/2015?Comoros · not enacted in this profileWhat is Comoros Personal Data Law 2014?Congo · enacted 2019What is Congo Law 29-2019?Côte d'Ivoire · enacted 2013What is Côte d'Ivoire Law 2013-450?Cuba · enacted 2022What is Cuba Law 149/2022?Democratic People's Republic of Korea · enacted 2022What is DPRK Information Law materials?Democratic Republic of the Congo · enacted 2023What is DRC Digital Code 2023?Djibouti · enacted 2025What is Djibouti Digital Code 2025?Equatorial Guinea · enacted 2016What is Equatorial Guinea Law 1/2016?Eswatini · enacted 2022What is Eswatini Data Protection Act 2022?Ethiopia · enacted 2024What is Ethiopia Proclamation No. 1321/2024?Fiji · enacted 2018What is Fiji Privacy Framework?Gabon · enacted 2023What is Gabon Law 025/2023?Grenada · enacted 2023What is Grenada Data Protection Act 2023?Guinea · enacted 2016What is Guinea Law L/2016/037/AN?Guyana · enacted 2023What is Guyana Data Protection Act 2023?Haiti · enacted 2018What is Haiti 2018 Data Privacy Order?Iran (Islamic Republic of) · enacted 2003What is Iran Electronic Commerce Act 2003?Jordan · enacted 2023What is Jordan Personal Data Protection Law No. 24 of 2023?Kiribati · enacted 2025What is Kiribati Data Protection Act 2025?Kuwait · enacted 2024What is Kuwait CITRA Decision 2024/26?Lao People's Democratic Republic · enacted 2017What is Lao Law 25/NA?Lebanon · enacted 2018What is Lebanon Law 81/2018?Lesotho · enacted 2011What is Lesotho Data Protection Act 2011?Liberia · not enacted in this profileWhat is Liberia Data Protection Act 2024?Libya · enacted 2022What is Libya Law No. 6 of 2022?Liechtenstein · enacted 2026What is Liechtenstein DSG 2026?Madagascar · enacted 2015What is Madagascar Law 2014-038?Marshall Islands · enacted 2025What is Marshall Islands PDPA 2025?Mozambique · not enacted in this profileWhat is Mozambique Privacy Framework?Myanmar · enacted 2017What is Myanmar Privacy and Security Law?Nicaragua · enacted 2012What is Nicaragua Law No. 787?Niger · enacted 2022What is Niger Law No. 2022-59?Saint Kitts and Nevis · enacted 2018What is Saint Kitts and Nevis DPA No. 5 of 2018?Saint Vincent and the Grenadines · enacted 2003What is Saint Vincent and the Grenadines Privacy Act No. 18 of 2003?San Marino · enacted 2018What is San Marino Law No. 171/2018?Sao Tome and Principe · enacted 2016What is Lei n.º 03/2016?Seychelles · enacted 2023What is Seychelles Data Protection Act 2023?Somalia · enacted 2023What is Somalia Data Protection Act 2023?Syrian Arab Republic · enacted 2024What is Law No. 12 of 2024?Tajikistan · enacted 2018What is Law No. 1537?Tonga · enacted 2025What is Privacy Act 2025?Trinidad and Tobago · enacted 2011What is Trinidad and Tobago DPA 2011?Uganda · enacted 2019What is Uganda DPA 2019?Uzbekistan · enacted 2019What is Law No. O‘RQ-547?Venezuela (Bolivarian Republic of) · enacted 1999What is Constitution Article 28?Yemen · enacted 2012What is Law No. 13 of 2012?Zambia · enacted 2021What is Zambia Data Protection Act 2021?Holy See · enacted 2024What is Decree DCLVII?State of Palestine · not enacted in this profileWhat is Palestinian Data Protection Law (draft)?

Related concepts & guides