--- title: "United States — Lawful Processing & Special Data | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/united-states/lawful-processing-and-special-data/ source_html: /jurisdictions/united-states/lawful-processing-and-special-data/index.html description: "United States — Lawful Processing & Special Data: lawful_processing_and_special_data Lawful Processing & Special Data 4 sub-modules 5 claims Amber ▾ # Consent/lawful-basis obligations are sector- and state-specific rather than gen" generated_at: 2026-10-25T04:46:50Z content_sha256: c35391198b38fcf8034ae8c02fa4a89330942c2fc33e2b62ca147ceffd5c9f33 generator: "fe-fleet/md-twin@1.0" --- # United States — Lawful Processing & Special Data | Data Protection Monitor ### D2Lawful Processing & Special Data4 sub-modules5 claimsAmber▾# Consent/lawful-basis obligations are sector- and state-specific rather than general, requiring careful cross-mapping; no single anonymisation/pseudonymisation safe harbour exists federally. Primary framework COPPA Rule (16 C.F.R. Part 312, as amended 2025); CCPA regulations (Cal. Code Regs. tit. 11, eff. 2026-01-01); PADFAA Supervisory authority [Federal Trade Commission (FTC)](https://www.ftc.gov) Traffic-light rationale — Amber Consent/lawful-basis obligations are sector- and state-specific rather than general, requiring careful cross-mapping; no single anonymisation/pseudonymisation safe harbour exists federally. #### Sub-modules (4) #### Lawful BasesAmber No general enumerated lawful-basis regime exists federally; state comprehensive laws instead rely on notice/opt-out frameworks for sale, sharing, and targeted advertising. Claims (1): - US comprehensive state privacy laws rely on consumer rights and opt-out mechanisms (targeted advertising, sale, profiling) rather than an enumerated lawful-basis regime. #### Consent ThresholdsAmber COPPA requires verifiable parental consent before collecting, using, or disclosing personal information from children under 13; the 2025 amendments add a separate opt-in consent requirement for third-party/targeted-advertising disclosures. Claims (2): - The COPPA Rule requires operators of child-directed sites/services, and general-audience operators with actual knowledge, to obtain verifiable parental consent before collecting, using, or disclosing a child's personal information. - 2025 COPPA Rule amendments require operators to obtain separate, verifiable parental consent before disclosing a child's personal information to third parties for targeted advertising or similar purposes. #### Special CategoriesAmber PADFAA defines 'personally identifiable sensitive data' to include health, financial, genetic, biometric, geolocation, and sexual-behavior information plus credentials and government IDs — one of the most granular federal special-category definitions. Claims (1): - PADFAA's definition of personally identifiable sensitive data includes health, financial, genetic, biometric, geolocation, and sexual-behavior information as well as account/device credentials and government-issued identifiers. #### Pseudonymisation And AnonymisationRed No federal statutory pseudonymisation/anonymisation safe harbour was identified in this research pass. Absence provenance: unavailable . Searched: FTC anonymisation safe harbor, federal de-identification standard 2026. Category narrative 59 words US federal law has no GDPR-style enumerated 'lawful basis' regime; the operative model is notice-plus-choice/opt-out at the state level and sector-specific opt-in consent requirements (chiefly COPPA verifiable parental consent). CCPA regulations effective 2026 impose detailed consent-quality rules (symmetry in choice, anti-dark-pattern requirements) for opt-outs of sale/share. PADFAA supplies one of the most detailed federal definitions of 'sensitive' personal data. no periodic updates on record for this sub-brief Evidence 5 Sources and claims (5) - Probable[IAPP](https://iapp.org/resources/article/us-state-privacy-laws-overview) — US comprehensive state privacy laws rely on consumer rights and opt-out mechanisms (targeted advertising, sale, profiling) rather than an enumerated lawful-basis regime.observed 2026-07-29 - Probable[FTC](https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-changes-childrens-privacy-rule-limiting-companies-ability-monetize-kids-data) — The COPPA Rule requires operators of child-directed sites/services, and general-audience operators with actual knowledge, to obtain verifiable parental consent before collecting, using, or disclosing a child's personal information.observed 2026-07-29 - Probable[FTC](https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-changes-childrens-privacy-rule-limiting-companies-ability-monetize-kids-data) — 2025 COPPA Rule amendments require operators to obtain separate, verifiable parental consent before disclosing a child's personal information to third parties for targeted advertising or similar purposes.observed 2026-07-29 - Probable[FTC](https://www.ftc.gov/news-events/news/press-releases/2026/02/ftc-reminds-data-brokers-their-obligations-comply-padfaa) — PADFAA's definition of personally identifiable sensitive data includes health, financial, genetic, biometric, geolocation, and sexual-behavior information as well as account/device credentials and government-issued identifiers.observed 2026-07-29 - Probable[CPPA](https://cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf) — CCPA regulations effective 2026 require 'symmetry in choice' such that the path to exercise a more privacy-protective option cannot be longer or more burdensome than the path to a less privacy-protective option, and prohibit dark-pattern consent design.observed 2026-07-29