United States

Open in Knowledge map

Sources last checked: 2026-11-09

The United States has no general federal privacy law. Federal rules cover specific areas, such as children online, and comprehensive laws come from individual states. A trade publication counted 24 states with such laws, including some not yet in effect, in October 2026.¹

Source note: no official list of states exists to check this against, so the count comes from a trade publication. This site does not yet have a page for each state.

California

California’s Consumer Privacy Act, the CCPA, gives people the right to know what a business collects about them, to have it deleted with some exceptions, to opt out of its sale or sharing, to correct it, and not to be penalised for using these rights.²

The right to opt out can be used through a browser signal, the Global Privacy Control.²³ From 1 January 2027, a business may not develop or maintain a browser unless it lets people send such a signal.⁴

Fines are up to $2,500 per violation, or $7,500 for intentional violations or those involving under-16s, adjusted over time.⁵

Children online

The federal COPPA Rule covers commercial websites and online services directed to children under 13, or that know they are collecting from one.⁶⁷ It was amended on 22 April 2025.⁶ Civil penalties reach $53,088 per violation.⁶

What this page does not cover yet

State breach-notification laws, and sectoral federal laws on matters such as health and finance.

References

1. MultiState, 28 October 2026: Twenty-four states now have comprehensive consumer privacy laws (secondary source) ↩

2. California Attorney General: California Consumer Privacy Act ↩ ↩²

3. California Civil Code, section 1798.135: opt-out methods ↩

4. California Assembly Bill 566 (2025) ↩

5. California Civil Code, section 1798.155: administrative enforcement ↩

6. Federal Trade Commission: Complying with COPPA, frequently asked questions ↩ ↩² ↩³

7. Code of Federal Regulations, title 16, part 312: the COPPA Rule ↩