Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →The United States has no single federal statute that comprehensively governs how businesses collect and use personal data. Instead, federal laws cover particular sectors or types of information, while some state laws give consumers broader rights. The result is an overlapping framework—not one uniform set of protections—and the rules that apply can depend on the business, the data, and the state.
How federal and state privacy laws fit together
Federal law covers defined sectors and information
Federal privacy protections are spread across laws aimed at specific contexts rather than a general consumer data code. The Federal Trade Commission can also address some data practices under its authority over unfair or deceptive acts, but that authority does not establish one universal list of consumer rights or detailed data-handling duties.
![Consumer Privacy and Data Protection [Connected eBook]](https://m.media-amazon.com/images/I/41oUvie-O3L._SL160_.jpg)
Enforcement depends on the law and sector involved. The FTC, Consumer Financial Protection Bureau, Federal Communications Commission, and Department of Health and Human Services are among the federal agencies whose roles vary by statute and subject matter, as outlined in a Congressional Research Service overview.
State laws add rights, with important limits
Some state comprehensive privacy statutes give consumers rights such as access, correction, deletion, data portability, or the ability to opt out of certain processing. The exact rights, covered businesses, and conditions differ by state. A state law may also exempt a business or data already regulated under federal law, so having a state privacy statute does not mean every consumer or company receives or owes the same protections.
#1 Best Overall
For example, the CFPB’s November 2024 report explains that financial institutions subject to the Gramm-Leach-Bliley Act (GLBA) or Fair Credit Reporting Act (FCRA) may be exempt from newer state privacy rights. That qualification varies with each state statute and the circumstances; it is not a blanket rule that all financial institutions or all financial data are excluded. The report also describes firms collecting and monetizing information such as income, expenses, and account balances.
How many states have comprehensive privacy laws?
A 2026 annual report filed with the SEC by PepGen Inc. reported that 20 states had comprehensive privacy laws in effect as of January 2026. That is an attributed, dated count—not a definitive official state-by-state inventory. State enactments and effective dates can change, so the number should not be treated as a live count beyond the date the report specifies.
What rights do state privacy laws give consumers?
Depending on the state law, a consumer may be able to request access to personal data, correct inaccuracies, delete data, obtain a portable copy, or opt out of certain uses, such as targeted advertising or the sale of personal information. These rights commonly depend on statutory definitions, business thresholds, exceptions, and the kind of data or processing involved. A right in one state does not automatically apply to a resident of another.
California’s CCPA is an example—not a national model
The CPRA amended the CCPA
California’s Consumer Privacy Act (CCPA) was amended by Proposition 24, also known as the California Privacy Rights Act (CPRA). The CPRA did not create a separate replacement law: the California Privacy Protection Agency describes the operative statute as the CCPA, as amended.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →California resident rights
The California Privacy Protection Agency lists rights for California residents that include the ability to:
- Know what personal information is collected and how it is used or shared.
- Correct inaccurate personal information.
- Request deletion, subject to exceptions.
- Opt out of the sale or sharing of personal information for cross-context behavioral advertising.
- Limit certain uses and disclosures of sensitive personal information.
- Receive equal treatment for exercising privacy rights.
Covered businesses must also follow purpose-limitation and data-minimization rules and disclose their privacy practices. The specific right and available process remain subject to the law’s scope and exceptions.
Rank #3
Which businesses may be covered?
The CCPA applies to qualifying for-profit businesses doing business in California that determine the purposes and means of processing personal information and meet at least one statutory threshold. The California Privacy Protection Agency’s FAQ states that, effective January 1, 2025, one threshold is annual gross revenue of at least $26.625 million. The other summarized tests are handling personal information of 100,000 or more California residents or households, or deriving at least half of annual revenue from selling or sharing residents’ personal information. These are alternative tests, and the statute contains qualifications; the summary is not an eligibility determination for any particular business.
California rulemaking status
As of the California Privacy Protection Agency materials accessed on October 4, 2026, the agency listed CCPA regulations and Delete Act materials as effective January 1, 2026. The same page labeled several topics “preliminary rulemaking,” said those proposals had not advanced to formal rulemaking, and listed no proposed regulation packages at that time. Because agency rulemaking status can change, consult the agency’s current materials for the latest position.
Does federal law override state privacy laws?
There is no single answer that applies to every privacy statute. Whether a federal law displaces a state requirement depends on the particular law and the conflict involved. GLBA, for example, generally preserves state laws except where they are inconsistent, and provides a process under which more protective state provisions may remain following a specified agency determination. That is a GLBA rule, not a universal rule for all federal privacy laws.
For consumers and businesses, the practical point is that federal and state duties may overlap, and a federal statute does not automatically erase every state privacy protection. The relevant statutes, exemptions, and facts determine which obligations apply.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why Congress and states disagree
The central policy dispute is federal preemption: whether a federal privacy law would replace state requirements, preserve stronger state protections, or displace state rules only in selected areas. A national standard could make compliance more uniform, while retaining state laws could preserve protections that differ by jurisdiction. Those are design choices for lawmakers, not settled features of a comprehensive federal privacy statute.
To compare a federal proposal with existing state laws, examine these questions:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Preemption: Would the proposal replace state rules, preserve stronger state protections, or divide coverage by subject?
- Rights and duties: What choices would individuals have, and what limits would businesses face on collecting, using, retaining, or disclosing data?
- Scope and exemptions: Which kinds of data and entities would be covered, and which sectors, nonprofits, or smaller businesses would be excluded?
- Enforcement and remedies: Which agencies could enforce the law, and would individuals have a private right to sue?
- Federalism and constitutional fit: How would the law interact with state statutes and constitutional limits?
These issues reflect questions identified by the Congressional Research Service and gaps described by the CFPB; their answers depend on the wording of each proposal.
Is there a federal data privacy law?
There are federal privacy laws for particular sectors and types of information, but no single federal statute that comprehensively regulates personal data collection and use across the economy. A targeted search for current federal legislation did not establish the definitive status of a comprehensive bill as of October 4, 2026. Narrower proposals, including the 2025 My Body, My Data Act and DELETE Act, do not by themselves establish that a general federal consumer privacy regime has been enacted. Check the relevant official bill page for the status of any specific proposal.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
