Data protection
The United States has no general privacy statute. Federal law is sectoral — HIPAA for health data, the Fair Credit Reporting Act for credit files, COPPA for children under 13 — while the Federal Trade Commission polices unfair and deceptive practices. Since California's CCPA, later strengthened as the CPRA, a large number of states have enacted comprehensive privacy laws with broadly similar rights.
Key points
| Federal | Sectoral: HIPAA, FCRA, GLBA, COPPA; FTC Act for unfair or deceptive practices |
|---|---|
| State laws | California, Virginia, Colorado, Connecticut, Utah and many others, with access, deletion and opt-out rights |
| Sale of data | Most state laws give a right to opt out of sale and of targeted advertising |
| Sensitive data | State laws generally require consent or an opt-out for health, precise location and sexual orientation data |
| Health apps | Often outside HIPAA; the FTC has used the Health Breach Notification Rule against them |
| Children | COPPA applies under 13; several states have added teen protections |
| Private right of action | Rare — California allows it for certain data breaches |
| No federal statute | Protection is sectoral and supplemented by state laws |
| State rights | Access, deletion, correction and opt-out of sale in a growing number of states |
| Global privacy control | Some states require businesses to honour browser opt-out signals |
In practice
- Check whether your state has a comprehensive privacy law before assuming you have rights.
- Use the opt-out links that state laws require businesses to publish.
Cost and coverage
Requests are free; state attorneys general and the FTC handle enforcement, though individuals rarely obtain personal remedies.
Recent changes
Data brokers and location data have become the main enforcement focus, particularly after concerns about reproductive health and location tracking.
Where to go
- State attorney general privacy units, which take complaints.
- Federal Trade Commission complaint assistant.
- Consumer Reports' Permission Slip and similar tools for sending deletion requests.
Worth knowing
A period-tracking or dating app is usually not covered by HIPAA. Assume health data in consumer apps is regulated only by state privacy law and the FTC — and read the sharing settings accordingly. Most state laws give enforcement to the attorney general, not to you. Illinois biometric law is the notable exception where individuals can sue.
The general article: Data protection · Compare with another country
Privacy
American privacy law is fragmented. The Fourth Amendment restrains the government, not private parties. Against private parties, most states recognise four privacy torts: intrusion upon seclusion, public disclosure of private facts, false light, and appropriation of name or likeness. Sectoral federal statutes cover health, finance and children, and states such as California, Colorado, Virginia and Texas have enacted comprehensive consumer privacy laws.
Key points
| Constitution | Binds government actors only; no horizontal effect between private parties |
|---|---|
| Common law | Four privacy torts, recognised with variations state by state |
| Sectoral statutes | HIPAA for health, GLBA for finance, COPPA for children, FERPA for education |
| State laws | California CCPA/CPRA and a growing number of comparable state statutes |
| Biometrics | Illinois BIPA allows private suits and has produced very large settlements |
| Regulator | Federal Trade Commission under its unfair-and-deceptive-practices power |
| Newsworthiness | A powerful defence: truthful information on matters of public concern is strongly protected |
| Public records | Information lawfully obtained from public records generally cannot found a claim |
| Wiretap laws | Recording rules differ: some states require all parties to consent |
In practice
- Check your state's recording law before taping a call: one-party and all-party rules both exist.
Where to go
- Federal Trade Commission, reportfraud.ftc.gov.
- State attorney general consumer protection division.
- Privacy plaintiffs' firms, usually on contingency.
Worth knowing
Your rights depend heavily on the state you live in, and sometimes on the state a company is based in. Check your own state's statute before assuming a right exists. Recording a conversation legally in one state can be a crime in another. Where the parties are in different states, the stricter rule usually applies.
Image rights
Image rights are a matter of state law — but a federal statute now requires platforms to take down non-consensual intimate imagery within 48 hours.
Two distinct doctrines apply. The right of publicity, a state-law right, protects the commercial value of your name and likeness. The privacy torts of intrusion and public disclosure cover unwanted exposure. For intimate images, nearly every state now has a criminal statute, and the federal TAKE IT DOWN Act of 2025 criminalised the publication of non-consensual intimate imagery, including AI-generated imagery, and imposed a 48-hour removal duty on covered platforms.
Key points
| Right of publicity | State law; strong in California, New York and Tennessee |
|---|---|
| Public photography | Generally protected by the First Amendment |
| State NCII laws | Criminal statutes in nearly every state |
| Federal law | TAKE IT DOWN Act 2025: criminal offence plus a 48-hour platform removal duty |
| Deepfakes | Expressly covered by the federal statute and by several state laws |
| Minors | Federal and state child protection statutes apply, with severe penalties |
| 48-hour removal | Covered platforms must remove reported non-consensual intimate imagery within 48 hours |
In practice
- Use the statutory notice route to platforms: the 48-hour deadline is enforceable.
Recent changes
The TAKE IT DOWN Act, enacted in 2025, is the first federal statute directly addressing non-consensual intimate imagery and AI-generated sexual deepfakes.
Where to go
- Cyber Civil Rights Initiative helpline.
- Take It Down, operated by NCMEC, for people under 18.
- Local police and the FBI's IC3 portal.
Worth knowing
The First Amendment protects a great deal of unwanted photography, especially of public figures and in public places. The strong remedies are concentrated on intimate imagery and commercial exploitation. The federal statute applies to AI-generated imagery of real people as well as authentic images. That closed the largest gap in state law.
The general article: Image rights · Compare with another country
Speech and online harassment
The strongest speech protections in the world, a high bar for defamation, and broad platform immunity under section 230.
The First Amendment sharply limits liability for speech. Defamation requires a false statement of fact; public figures must prove actual malice under New York Times v. Sullivan. Section 230 of the Communications Decency Act immunises platforms for content posted by users. Anti-SLAPP statutes in most states allow early dismissal of suits brought to silence criticism.
Key points
| Defamation | False statement of fact; opinion is protected |
|---|---|
| Public figures | Must prove actual malice — knowledge of falsity or reckless disregard |
| Section 230 | Platforms are generally not liable for user content |
| Anti-SLAPP | Most states allow early dismissal and fee-shifting for suits targeting protected speech |
| Intimate images | Criminalised in nearly all states; the federal TAKE IT DOWN Act of 2025 requires platforms to remove such images promptly |
| Harassment and stalking | State and federal criminal offences, including cyberstalking |
| Right of publicity | State-level protection against commercial use of name or likeness |
| Actual malice | Public figures must prove the statement was made knowing it was false or recklessly |
| Anti-SLAPP statutes | Many states allow early dismissal and fee-shifting for meritless claims |
| Truth is a defence | An absolute one, regardless of motive |
In practice
- Preserve the posting with a timestamp; platforms delete and edit histories quickly.
- Check whether your state has an anti-SLAPP statute before filing — it can shift costs against you.
Cost and coverage
Criminal reports are free; civil litigation is expensive, though anti-SLAPP statutes can shift costs.
Recent changes
The TAKE IT DOWN Act, enacted in 2025, created a federal notice-and-removal obligation for non-consensual intimate images, including synthetic ones.
Where to go
- Cyber Civil Rights Initiative helpline for image-based abuse.
- StopNCII.org for preventive hash-matching removal.
- Local police and the FBI's IC3 for threats and cyberstalking.
Worth knowing
Because platform immunity is broad, the effective route in the US is usually the platform's own policy plus criminal law — not a lawsuit against the site itself. Because platforms are protected by section 230, the claim lies against the person who posted, not the site. Removal is a matter of the platform's own policy.
The general article: Speech and online harassment · Compare with another country
Copyright
Fair use is a flexible four-factor test — but registration is what gives a claim teeth.
American copyright runs for the author's life plus seventy years, or ninety-five years from publication for works made for hire. Its distinctive feature is fair use: an open-ended balancing of four factors — purpose, nature of the work, amount used, and effect on the market. Registration with the Copyright Office is not required for protection, but it is required before suing and before statutory damages and attorney's fees become available.
Key points
| Term | Life plus 70 years; 95 years from publication for works made for hire |
|---|---|
| Fair use | Four-factor balancing test, decided case by case |
| Registration | Required before filing suit; timely registration unlocks statutory damages |
| Statutory damages | Available without proving actual loss, where registration was timely |
| DMCA | Notice and takedown, with a counter-notice procedure |
| Small claims | The Copyright Claims Board hears low-value disputes without a lawyer |
| Attorney's fees | Recoverable, which changes the economics of litigation |
| Transformative use | A central concept in fair use, narrowed by recent Supreme Court authority |
In practice
- Register works within three months of publication to preserve statutory damages.
Recent changes
The Copyright Claims Board gives individual creators a low-cost forum for claims below the statutory ceiling, without needing a lawyer.
Where to go
- United States Copyright Office.
- Copyright Claims Board for small claims.
- Volunteer Lawyers for the Arts chapters.
Worth knowing
Register before infringement happens, not after. Late registration usually limits you to actual damages, which are often too small to justify litigation. The three-month registration window is what makes litigation viable. Registering after an infringement usually limits you to actual damages.
The general article: Copyright · Compare with another country
Identity theft
The most developed recovery system in the world: a federal recovery plan, free credit freezes, and a statutory right to block fraudulent entries.
Federal law makes identity theft a crime in its own right, and aggravated identity theft carries a mandatory consecutive sentence. The Federal Trade Commission's IdentityTheft.gov generates a personal recovery plan and an Identity Theft Report, which unlocks statutory rights: blocking fraudulent information on your credit report, obtaining documents about accounts opened in your name, and stopping debt collection.
Key points
| Federal offences | 18 U.S.C. 1028 and 1028A, aggravated identity theft carrying a mandatory added sentence |
|---|---|
| Recovery plan | IdentityTheft.gov produces the plan and the Identity Theft Report |
| Credit freeze | Free at all three bureaus under federal law, and free to lift |
| Fraud alert | One year, extendable to seven with an Identity Theft Report |
| Blocking | Bureaus must block fraudulent entries within four business days of a valid report |
| Free reports | Weekly free credit reports through the official site |
| Identity Theft Report | Unlocks statutory blocking, document access and collection protections |
| Four business days | Bureaus must block fraudulent information after a valid report |
| IRS IP PIN | Prevents fraudulent tax filings in your name |
In practice
- Freeze your credit at Equifax, Experian and TransUnion — it is free and it stops most new-account fraud.
- File the report at IdentityTheft.gov and print the Identity Theft Report.
- Send the report to every bureau and creditor, by certified mail, and keep proof of posting.
- If a tax return was filed in your name, contact the IRS Identity Protection unit and request an IP PIN.
- Request an IRS Identity Protection PIN: it stops tax refund fraud outright.
Where to go
- IdentityTheft.gov, run by the Federal Trade Commission.
- AnnualCreditReport.com for free reports.
- IRS Identity Theft Protection Specialized Unit.
Worth knowing
The credit freeze is the single most effective step and it is free by law. Do it before anything else; you can lift it temporarily whenever you need credit. The Identity Theft Report is the key that unlocks every other federal right. Generate it before contacting creditors, not afterwards.
The general article: Identity theft · Compare with another country
Online shopping
No general right to cancel an online order: the real protections are chargebacks, state consumer laws and FTC rules.
There is no federal cooling-off period for online purchases. The FTC's three-day rule applies only to certain door-to-door sales. Protection instead comes from the Fair Credit Billing Act's dispute rights for credit cards, state consumer protection and lemon laws, and FTC action against deceptive practices.
Key points
| Cooling-off | No general right; retailer return policies are contractual |
|---|---|
| Credit card disputes | Fair Credit Billing Act rights for billing errors and undelivered goods |
| Debit cards | Weaker protection under the Electronic Fund Transfer Act |
| Unordered merchandise | Goods sent without order may be kept as a gift |
| State law | Deceptive trade practices statutes in every state, often with damages |
| Negative options | Rules on automatic renewal have been litigated; several states have their own laws |
| Small claims | Simple state court process for low-value disputes |
| No general cooling-off | Federal law gives three days only for certain door-to-door sales |
| State return laws | A few states require traders to post their return policy or accept returns |
| Chargeback rights | Credit card billing error rules give a statutory dispute procedure |
| Magnuson-Moss | Governs written warranties on consumer products |
In practice
- Dispute through the card issuer in writing within the statutory billing error period.
- Complain to the state attorney general; those offices mediate consumer disputes.
Cost and coverage
Filing a complaint with the FTC or a state attorney general is free; small claims fees are low.
Recent changes
Federal rules requiring simple cancellation of subscriptions have been the subject of court challenges, so the practical protection often comes from state automatic-renewal statutes.
Where to go
- Federal Trade Commission ReportFraud.ftc.gov.
- State attorney general consumer protection divisions.
- Small claims courts for direct recovery.
Worth knowing
Use a credit card rather than a debit card for online purchases. The dispute rights are substantially stronger, and the money stays in your account while the claim is investigated. There is no general right to return goods bought online in the United States. Returns depend on the trader's own policy, which is why it should be read before purchase.
The general article: Online shopping · Compare with another country
Romance scams
Two federal reporting routes, and recovery that depends almost entirely on which payment rail was used.
Reports go to the FBI's Internet Crime Complaint Center and to the Federal Trade Commission's fraud reporting site; both feed investigations without opening an individual case. Recovery depends on the payment method: credit cards offer the strongest protection, debit cards a weaker one with short deadlines, and wire transfers, gift cards and cryptocurrency almost none. The FBI operates a recovery asset team that can sometimes freeze a wire reported within seventy-two hours.
Key points
| Reporting | FBI Internet Crime Complaint Center and the FTC fraud site |
|---|---|
| Credit card | Strongest protection; dispute under the federal billing law |
| Debit card | Weaker protection, with deadlines counted in days |
| Wire transfer | A federal recovery team can sometimes freeze it if reported within 72 hours |
| Gift cards | Contact the issuer immediately; occasionally recoverable if unspent |
| Cryptocurrency | Effectively unrecoverable |
| Identity theft | A dedicated federal site generates a recovery plan and affidavit |
In practice
- Report a wire transfer within seventy-two hours and say so explicitly: that is the window in which a freeze is possible.
- Dispute a credit card charge in writing; the federal billing law gives you a formal right that a phone call does not.
- Place a free fraud alert or credit freeze with all three credit bureaus if any document or number was shared.
- Report to both federal channels: they do different things and neither replaces a local police report.
Cost and coverage
All federal reporting channels are free. Credit freezes are free by law.
Where to go
- FBI Internet Crime Complaint Center.
- Federal Trade Commission fraud reporting site.
- Your card issuer or bank fraud department, immediately.
- Federal identity theft recovery site, if documents were shared.
Worth knowing
Beware of "recovery" services that contact you after a scam offering to retrieve your money for a fee. They are, almost without exception, the same networks targeting the same victim a second time.
Sources
- FBI Internet Crime Complaint Center — federal reporting; wire freezes possible within 72 hours
- ReportFraud.ftc.gov — Federal Trade Commission fraud reporting
- IdentityTheft.gov — generates a personal recovery plan and affidavit
- Consumer Financial Protection Bureau — complaints about banks and payment providers
- Investor.gov (SEC) — check an investment professional's registration before sending money
The general article: Romance scams · Compare with another country
General sources
- USA.gov — official guide to government services
- Congress.gov — federal legislation