The U.S. lacks a comprehensive federal privacy law. Sectoral laws cover medical (HIPAA), financial (GLBA), education (FERPA), and child (COPPA) data. State laws — California Consumer Privacy Act/CPRA, Virginia, Colorado, Connecticut, others — create a growing patchwork.
The American Privacy Rights Act (APRA), the latest federal-bill effort, would establish baseline rights (access, correction, deletion, portability), data-minimization requirements, and limits on targeted advertising. It has stalled over preemption (whether to override state laws) and private-right-of-action questions.
Key debates:
- Preemption: Federal floor, ceiling, or middle-ground that preserves stronger state laws.
- Private right of action: Whether individuals can sue, or only enforcement by AGs / FTC.
- Special categories: Biometric data, location, health data outside HIPAA.
- Children's privacy: COPPA modernization, age-verification rules.