#
Consent/lawful-basis obligations are sector- and state-specific rather than general, requiring careful cross-mapping; no single anonymisation/pseudonymisation safe harbour exists federally.
Sub-modules (4)
Lawful BasesAmber
No general enumerated lawful-basis regime exists federally; state comprehensive laws instead rely on notice/opt-out frameworks for sale, sharing, and targeted advertising.
Claims (1):
- US comprehensive state privacy laws rely on consumer rights and opt-out mechanisms (targeted advertising, sale, profiling) rather than an enumerated lawful-basis regime.
Consent ThresholdsAmber
COPPA requires verifiable parental consent before collecting, using, or disclosing personal information from children under 13; the 2025 amendments add a separate opt-in consent requirement for third-party/targeted-advertising disclosures.
Claims (2):
- The COPPA Rule requires operators of child-directed sites/services, and general-audience operators with actual knowledge, to obtain verifiable parental consent before collecting, using, or disclosing a child's personal information.
- 2025 COPPA Rule amendments require operators to obtain separate, verifiable parental consent before disclosing a child's personal information to third parties for targeted advertising or similar purposes.
Special CategoriesAmber
PADFAA defines 'personally identifiable sensitive data' to include health, financial, genetic, biometric, geolocation, and sexual-behavior information plus credentials and government IDs — one of the most granular federal special-category definitions.
Claims (1):
- PADFAA's definition of personally identifiable sensitive data includes health, financial, genetic, biometric, geolocation, and sexual-behavior information as well as account/device credentials and government-issued identifiers.
Pseudonymisation And AnonymisationRed
No federal statutory pseudonymisation/anonymisation safe harbour was identified in this research pass.
Absence provenance: unavailable. Searched: FTC anonymisation safe harbor, federal de-identification standard 2026.
no periodic updates on record for this sub-brief
Sources and claims (5)
- ProbableIAPP — US comprehensive state privacy laws rely on consumer rights and opt-out mechanisms (targeted advertising, sale, profiling) rather than an enumerated lawful-basis regime.observed
- ProbableFTC — The COPPA Rule requires operators of child-directed sites/services, and general-audience operators with actual knowledge, to obtain verifiable parental consent before collecting, using, or disclosing a child's personal information.observed
- ProbableFTC — 2025 COPPA Rule amendments require operators to obtain separate, verifiable parental consent before disclosing a child's personal information to third parties for targeted advertising or similar purposes.observed
- ProbableFTC — PADFAA's definition of personally identifiable sensitive data includes health, financial, genetic, biometric, geolocation, and sexual-behavior information as well as account/device credentials and government-issued identifiers.observed
- ProbableCPPA — CCPA regulations effective 2026 require 'symmetry in choice' such that the path to exercise a more privacy-protective option cannot be longer or more burdensome than the path to a less privacy-protective option, and prohibit dark-pattern consent design.observed