The US has no single privacy or AI law. Instead, startups face the FTC’s broad power over unfair and deceptive practices, federal sector laws (health, children, finance), comprehensive privacy laws in around twenty states, a fast-growing set of state AI laws and breach notification laws in every state.
The patchwork is manageable if you design for the strictest common rules. California is usually the baseline for privacy; Colorado, Texas and California set the pace on AI; COPPA governs children under 13. Federal efforts to preempt state AI laws exist but have not displaced them.
- Federal privacy law
- None comprehensive; FTC Act Section 5 plus sector laws
- State privacy laws
- About 20 comprehensive laws
- State AI laws
- California, Colorado (stayed), Texas, NYC hiring rule
- Children
- COPPA (amended Rule compliance by Apr 2026)
- Breach laws
- All 50 states
- Preemption
- Executive Order 14365; no statutory preemption
Who needs to comply
Every consumer-facing startup
The FTC Act prohibits deceptive privacy, security and AI claims, and unfair data practices, regardless of size.
Startups processing data of residents in privacy-law states
State laws apply above thresholds (often 100,000 consumers or revenue tests); Texas has no revenue or volume threshold.
AI products making or supporting significant decisions
California ADMT rules, Colorado’s AI law and NYC Local Law 144 regulate automated decisions in hiring, lending, housing, education and health.
Generative AI developers
California AB 2013 (training-data summaries), SB 942 (detection tools and disclosures) and SB 53 (frontier developers).
Services for children and teens
COPPA for under-13s, plus state children’s privacy and age-appropriate design laws.
Health-tech
HIPAA if you work with covered entities; state health-data laws such as Washington’s My Health My Data Act; the FTC Health Breach Notification Rule.
Fintech
Gramm-Leach-Bliley Act privacy and safeguards rules, plus state licensing and the CFPB.
The laws, in detail
01FTC Act Section 5
Unfair or deceptive acts and practices, including privacy, security and AI claims.
When it applies
Commercial activity in or affecting the US.
What you must do
- Keep privacy and security promises accurate
- Substantiate claims about AI capabilities
- Reasonable data security
- Avoid dark patterns and unfair data uses
Regulator
Federal Trade Commission
Penalties
Consent orders, civil penalties for order violations, and remedies including deletion of data and models.
02California CCPA/CPRA & CPPA regulations
Consumer privacy rights, opt-outs, sensitive data, risk assessments, cybersecurity audits and ADMT.
When it applies
For-profit businesses doing business in California above revenue or data thresholds.
What you must do
- Notice at collection and privacy policy
- Rights to know, delete, correct and limit use of sensitive data
- Opt-out of sale and sharing; honour Global Privacy Control
- Risk assessments (from 2026) and cybersecurity audits (phased from 2028)
- ADMT notices and opt-outs for significant decisions (from Jan 2027)
- Service-provider contracts
Regulator
California Privacy Protection Agency; Attorney General
Penalties
Administrative fines per violation, higher for intentional violations and minors’ data.
03Other state comprehensive privacy laws
Virginia-style consumer privacy rights, sensitive data consent and assessments.
When it applies
Thresholds per state; Texas applies broadly with a small-business exemption.
What you must do
- Consumer rights and appeals process
- Opt-in consent for sensitive data in most states
- Opt-outs for targeted advertising, sale and profiling
- Data protection assessments for high-risk processing
Regulator
State Attorneys General
Penalties
Civil penalties per violation, often after a cure period.
04State AI laws (California, Colorado, Texas, NYC)
Frontier model safety, training-data transparency, AI content disclosure, automated decisions and AI in hiring.
When it applies
Developing or deploying covered AI for residents of these jurisdictions.
What you must do
- California AB 2013: publish training-data summaries
- California SB 942: AI detection tool and disclosures for large GenAI providers
- Texas TRAIGA: no AI for prohibited purposes; disclosures for government and healthcare
- Colorado: notices, adverse-outcome explanations and human review (enforcement stayed)
- NYC LL144: bias audits and notices for automated hiring tools
Regulator
State Attorneys General; NYC DCWP
Penalties
Civil penalties; TRAIGA up to $200,000 per violation in some cases.
05COPPA & amended COPPA Rule
Personal information from children under 13.
When it applies
Services directed to children, or with actual knowledge of collecting children’s data.
What you must do
- Verifiable parental consent
- Separate consent for third-party disclosure, including targeted ads
- Written security programme and retention limits
Regulator
FTC
Penalties
Civil penalties per violation (over $50,000, adjusted annually).
06HIPAA and state health-data laws
Protected health information and consumer health data.
When it applies
Covered entities and business associates (HIPAA); consumer health apps (state laws, FTC HBNR).
What you must do
- Business associate agreements
- Security Rule safeguards and breach notification
- Consent for consumer health data under state laws
Regulator
HHS OCR; FTC; State AGs
Penalties
Tiered civil penalties; private right of action under Washington’s MHMDA.
07State breach notification laws
Notice to individuals and regulators after data breaches.
When it applies
Breach of residents’ personal information in any state.
What you must do
- Investigate and notify within state deadlines (often 30–60 days)
- Notify AGs and credit agencies above thresholds
- Maintain reasonable security
Regulator
State Attorneys General
Penalties
Civil penalties and litigation exposure.
Compliance checklist
01 · Before you launch in the US
- Check every marketing claim about privacy, security and AI for substantiation
- Map which state laws apply by user location and thresholds
- Build a rights-request workflow covering all states
- Decide if you are directed to children; design COPPA consent if so
- Identify any automated ‘significant decisions’ in your product
02 · At launch
- Privacy policy and notice at collection meeting CCPA and other states
- Honour Global Privacy Control and other opt-out signals
- Sensitive data consent flows
- Service-provider and processor contracts
- Breach response plan with a state-by-state notice matrix
03 · As you scale
- California risk assessments and, by revenue tier, cybersecurity audits
- ADMT notices and opt-outs by Jan 2027
- Training-data summary if you offer generative AI in California
- Bias audits for hiring tools used in NYC
- Track Colorado litigation and federal preemption developments
Key dates
- Jul 2023NYC Local Law 144 enforced
- Jan 2026CCPA regulations; Texas TRAIGA; California SB 53 and AB 2013; Indiana, Kentucky, Rhode Island privacy laws
- Apr 2026Amended COPPA Rule compliance date
- 2 Aug 2026California SB 942 AI Transparency Act
- 1 Jan 2027California ADMT rules; Colorado AI law (if not stayed)
- 1 Apr 2028CCPA risk assessment attestations; first cybersecurity audit certifications
Common mistakes
- Claiming ‘bank-grade security’ or ‘unbiased AI’ without evidence.
- Building for California only and missing sensitive-data opt-in elsewhere.
- Ignoring Global Privacy Control signals.
- Assuming federal preemption has removed state AI laws.
FAQs
Is there a federal privacy law?
No comprehensive one. Federal sector laws and the FTC Act apply, with state laws filling the gap.
Does the executive order on AI stop state AI laws?
No. It created a task force to challenge them, but state laws stay in force unless a court rules otherwise or Congress preempts them.
In the law library
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.