#
Sectoral overlays are well established but leave gaps (e.g., no general ePrivacy statute; insurance-specific federal privacy rules not identified) that create material scoping risk for cross-sector businesses.
Sub-modules (7)
Financial Sector OverlayAmber
GLBA's Safeguards Rule imposes data-security obligations on financial institutions, enforced by the FTC including against non-traditional financial institutions such as auto dealers extending credit.
Claims (1):
- The FTC enforces the GLBA Safeguards Rule against financial institutions, including automobile dealers extending credit, requiring implementation of data-security programs.
Health Sector OverlayAmber
The FTC enforces HIPAA-adjacent obligations through the Health Breach Notification Rule for health apps and other entities outside HIPAA's direct coverage.
Claims (1):
- The FTC's Health Breach Notification Rule requires entities not covered by HIPAA to notify consumers and the FTC of breaches of personal health record data.
Telecoms And EprivacyAmber
No dedicated federal ePrivacy/cookie-consent statute exists; cookie and tracker consent obligations arise instead from state comprehensive privacy laws such as the CCPA.
Absence provenance: unavailable. Searched: US federal ePrivacy cookie law 2026.
Employment DataAmber
Employment data is generally exempted or carved out from state comprehensive privacy laws, though several states preserve separate employee-specific privacy statutes.
Absence provenance: unavailable. Searched: US employment data privacy federal statute 2026.
Credit And ScoringAmber
The Fair Credit Reporting Act (FCRA) has generated a substantial and continuing body of enforcement and private litigation (e.g., Safeco v. Burr, GEICO v. Edo, Whitfield v. Radian) governing credit-report accuracy, permissible purpose, and furnisher obligations.
Claims (1):
- The Fair Credit Reporting Act has produced a sustained body of federal case law (e.g., Safeco Ins. Co. v. Burr; GEICO Gen. Ins. Co. v. Edo; Whitfield v. Radian Guaranty) governing permissible purpose and accuracy obligations for consumer-report data used in credit and insurance underwriting.
EducationAmber
The US Department of Education has affirmed its intention to propose amendments to FERPA, prompting the FTC to align COPPA guidance to avoid conflicts; the FTC's 2025 COPPA amendments explicitly declined to adopt new ed-tech-specific provisions pending that FERPA process.
Claims (2):
- The US Department of Education has affirmed its intention to propose amendments to FERPA, prompting the FTC to roll back related COPPA guidance to avoid conflicts.
- The FTC's 2025 COPPA Rule amendments declined to adopt proposed changes relating to requirements applicable to educational technology companies operating in a school environment.
InsuranceRed
No insurance-sector-specific federal data-protection overlay was identified in this research pass; historical FCRA-adjacent insurance cases (e.g., Ashby v. Farmers Group) suggest FCRA functions as a partial overlay for insurance underwriting data.
Absence provenance: unavailable. Searched: US federal insurance sector data privacy law 2026.
Claims (1):
- The Fair Credit Reporting Act has produced a sustained body of federal case law (e.g., Safeco Ins. Co. v. Burr; GEICO Gen. Ins. Co. v. Edo; Whitfield v. Radian Guaranty) governing permissible purpose and accuracy obligations for consumer-report data used in credit and insurance underwriting.
Sectoral Watch
The FTC required Amazon to pay $2.25 million to resolve charges that it knowingly violated the Fair Credit Reporting Act, announced June 30, 2026, continuing active sectoral enforcement in the credit-and-scoring space under FCRA rather than under any comprehensive privacy statute. Separately, and with lower sourcing confidence, the FTC is reported to have finalized a settlement with Illuminate Education requiring implementation of a data security program following a 2021 breach that reportedly impacted 10 million students; this development was sourced from a Tier 4 outlet and has not been independently corroborated against a primary FTC source this cycle.
In the financial sector, the CFPB's Section 1033 open-banking and financial-data-rights rule remains enjoined by a federal court and under full reconsideration, leaving financial-data-portability obligations for this sector unsettled; this is a financial-data-portability development rather than a data-protection-specific rule, but it overlaps with sectoral_watch's financial-sector overlay coverage.
Outlook
Sectoral enforcement in the credit-reporting and education-data spaces is likely to continue at the current cadence. The unresolved status of the CFPB's Section 1033 reconsideration is the key financial-sector item to watch, as its eventual resolution will determine the shape of financial-data-portability obligations that intersect with sectoral privacy expectations.
Sources and claims (3)
- ProbableFTC — The Fair Credit Reporting Act has produced a sustained body of federal case law (e.g., Safeco Ins. Co. v. Burr; GEICO Gen. Ins. Co. v. Edo; Whitfield v. Radian Guaranty) governing permissible purpose and accuracy obligations for consumer-report data used in credit and insurance underwriting.observed
- ProbableIAPP — The US Department of Education has affirmed its intention to propose amendments to FERPA, prompting the FTC to roll back related COPPA guidance to avoid conflicts.observed
- ProbableFTC — The FTC's 2025 COPPA Rule amendments declined to adopt proposed changes relating to requirements applicable to educational technology companies operating in a school environment.observed