--- title: "United States — Regulator & Framework | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/united-states/regulator-and-framework/ source_html: /jurisdictions/united-states/regulator-and-framework/index.html description: "United States — Regulator & Framework: regulator_and_framework Regulator & Framework 5 sub-modules 5 claims Amber ▾ # No federal omnibus statute exists; coverage is fragmented across sectoral statutes and enforcement au" generated_at: 2026-10-25T04:46:50Z content_sha256: c7f33c8e55ab6b8f9ad80f9920df06c5968cad75cabcd2632dc94926a0b1c3cf generator: "fe-fleet/md-twin@1.0" --- # United States — Regulator & Framework | Data Protection Monitor ### D1Regulator & Framework5 sub-modules5 claimsAmber▾# No federal omnibus statute exists; coverage is fragmented across sectoral statutes and enforcement authorities, creating material compliance and mapping complexity even though enforcement activity is high. Primary framework FTC Act Section 5 (15 U.S.C. §45) plus sectoral statutes: COPPA, GLBA, FCRA, PADFAA Supervisory authority [Federal Trade Commission (FTC)](https://www.ftc.gov) Traffic-light rationale — Amber No federal omnibus statute exists; coverage is fragmented across sectoral statutes and enforcement authorities, creating material compliance and mapping complexity even though enforcement activity is high. #### Sub-modules (5) #### Regulator And AuthorityAmber The FTC's Bureau of Consumer Protection is the principal federal enforcer of privacy/data-security norms via Section 5 of the FTC Act; state Attorneys General and, for California, CalPrivacy, exercise parallel authority under state comprehensive statutes. Claims (2): - The FTC continues to bring privacy and data-security claims under Section 5 of the FTC Act as its primary enforcement lever in the absence of a comprehensive federal privacy statute. - CalPrivacy (the California Privacy Protection Agency) is responsible for implementing and enforcing the CCPA as well as the Delete Act, which creates additional data-broker requirements. #### Act And InstrumentsAmber Key federal instruments: FTC Act §5, COPPA (as amended 2025), GLBA Safeguards Rule, FCRA, the Health Breach Notification Rule, and PADFAA (2024). State instruments include the CCPA/CPRA, Delete Act, and 19+ state comprehensive privacy statutes. Claims (1): - No comprehensive federal privacy lawmaking initiative has been enacted as of the current legislative session; recent federal activity is limited to sectoral statutes and draft bills such as the SECURE Data Act. #### Material ScopeAmber Federal sectoral statutes apply to defined categories of data/processing (children's data, financial data, credit data, health-adjacent data, foreign-adversary transfers of sensitive PII); no general federal 'personal data' scope exists analogous to GDPR Art.4. Claims (1): - No comprehensive federal privacy lawmaking initiative has been enacted as of the current legislative session; recent federal activity is limited to sectoral statutes and draft bills such as the SECURE Data Act. #### Territorial ScopeAmber FTC jurisdiction attaches to entities in or affecting US commerce; PADFAA specifically reaches data brokers dealing in Americans' sensitive data regardless of the broker's location when the counterparty is a foreign adversary. Claims (1): - PADFAA prohibits data brokers from selling, releasing, disclosing, or providing access to personally identifiable sensitive data about Americans to foreign adversaries including North Korea, China, Russia, and Iran. #### Regulator Registration And FilingAmber No federal controller-registration regime exists. California's Delete Act requires data brokers to register annually with CalPrivacy and fund the DROP deletion platform; failure to register has been actively fined. Claims (1): - California's Delete Act requires data brokers to register annually with CalPrivacy and pay a fee funding the Data Broker Registry and DROP platform; failure to register has resulted in fines (e.g., Datamasters, $45,000; S&P Global, $62,600). Category narrative 105 words At the US federal level there is no single omnibus data-protection statute or single supervisory authority. The Federal Trade Commission (FTC) acts as the de facto general privacy regulator, using its Section 5 unfairness/deception authority plus a stack of sectoral statutes (COPPA, GLBA Safeguards Rule, FCRA, the Health Breach Notification Rule, and the newly effective Protecting Americans' Data from Foreign Adversaries Act (PADFAA)). Below the federal level, a growing patchwork of state comprehensive laws (led by California's CCPA/CPRA as administered by the California Privacy Protection Agency, CalPrivacy) supplies omnibus-style obligations, but this is sub-national and does not convert the federal JID into an omnibus regime. Periodic update · new data 2026-09-28 #### Regulator & Framework The United States continues to lack comprehensive federal privacy legislation, and the Federal Trade Commission enforces privacy matters primarily through Section 5 of the FTC Act's general unfair-or-deceptive-practices authority, supplemented by sectoral statutes. This standing enforcement architecture remained unchanged this cycle, but the state-level regulatory landscape it sits alongside continued to expand: comprehensive consumer data privacy laws in Kentucky, Indiana, and Rhode Island took effect January 1, 2026, bringing the total number of states with comprehensive privacy laws to twenty. This continues a multi-year pattern of incremental state-by-state comprehensive privacy legislation in the absence of a federal framework, reinforcing the United States' fragmented, jurisdiction-by-jurisdiction approach to data protection. Each new state framework operates independently, layering additional compliance obligations onto entities operating across state lines, without any federal harmonizing statute in place. #### Outlook The trajectory of incremental state-level comprehensive privacy legislation is likely to continue, and prospective entrants to the US compliance landscape should expect further state additions to the twenty-state baseline established this cycle. No federal comprehensive privacy legislation was indicated as imminent within this cycle's evidence. Evidence 5 Sources and claims (5) - Probable[IAPP](https://iapp.org/news/a/what-increasing-privacy-enforcement-activity-means-for-us-privacy-legislation) — The FTC continues to bring privacy and data-security claims under Section 5 of the FTC Act as its primary enforcement lever in the absence of a comprehensive federal privacy statute.observed 2026-07-29 - Probable[CPPA](https://cppa.ca.gov/regulations/) — CalPrivacy (the California Privacy Protection Agency) is responsible for implementing and enforcing the CCPA as well as the Delete Act, which creates additional data-broker requirements.observed 2026-07-29 - Probable[IAPP](https://iapp.org/resources/article/us-state-privacy-laws-overview) — No comprehensive federal privacy lawmaking initiative has been enacted as of the current legislative session; recent federal activity is limited to sectoral statutes and draft bills such as the SECURE Data Act.observed 2026-07-29 - Probable[FTC](https://www.ftc.gov/news-events/news/press-releases/2026/02/ftc-reminds-data-brokers-their-obligations-comply-padfaa) — PADFAA prohibits data brokers from selling, releasing, disclosing, or providing access to personally identifiable sensitive data about Americans to foreign adversaries including North Korea, China, Russia, and Iran.observed 2026-07-29 - Probable[CPPA](https://cppa.ca.gov/announcements/2026/20260108.html) — California's Delete Act requires data brokers to register annually with CalPrivacy and pay a fee funding the Data Broker Registry and DROP platform; failure to register has resulted in fines (e.g., Datamasters, $45,000; S&P Global, $62,600).observed 2026-07-29