Why America's Patchwork of Privacy Laws Leaves Most Business Data Unregulated

By Atticus Smith, Legal Intern, Afissio Law

For both businesses and consumers, the digital landscape is still filled with uncertainty, and nowhere is that more apparent than in data privacy. One of the main reasons is that the United States lacks a comprehensive federal privacy law. No overarching rule governs what data companies can collect, how long they can keep it, or how they can use it. Instead, a patchwork of federal laws exists, each pertaining to a narrow slice of the economy. They are supplemented by a growing body of state laws that vary in scope and design.

Federal Laws

Most federal privacy statutes were written to address a specific problem, which is why each covers only one type of data or one type of business. HIPAA governs health plans, health care clearinghouses, health care providers, and their business associates, restricting how they use and disclose your medical information.¹ The Gramm-Leach-Bliley Act requires banks and other financial institutions to tell you how they share your information and to keep it secure.² COPPA requires websites and apps directed to children, and those that knowingly collect information from children under 13, to get a parent's consent before collecting a child's personal information.³ And the Fair Credit Reporting Act governs the credit bureaus, the lenders who pull your file, and the companies that feed data into it.⁴ As a result, most of the data that ordinary businesses collect—from browsing behavior to purchase history—falls outside all four statutes.

The Federal Trade Commission (FTC) fills much of this gap and has become the country's de facto privacy regulator.⁵ Its main tool is Section 5 of the FTC Act, which prohibits "unfair or deceptive acts or practices in or affecting commerce." In the privacy context, a company acts deceptively when it breaks a promise about how it handles your data. A practice is unfair when it causes, or is likely to cause, substantial injury that consumers cannot reasonably avoid and that is not outweighed by benefits to consumers or competition.⁶ You can see the range in recent orders. One barred Rite Aid from using facial-recognition technology for surveillance purposes for five years, after the FTC alleged that its system falsely flagged customers as suspected shoplifters.⁷ Another prohibited the data broker X-Mode Social and its successor, Outlogic, from selling sensitive location data, including data that could reveal visits to reproductive health clinics and places of worship.⁸ In 2022, the FTC also opened a rulemaking inquiry into "commercial surveillance and data security,"⁹ but that initiative has not produced a proposed rule.¹⁰ For now, case-by-case enforcement remains the federal government's primary tool.

State Laws

According to the International Association of Privacy Professionals (IAPP), 23 states have enacted comprehensive consumer privacy laws, 19 of which are in effect.¹¹ The four newest—Alabama, Louisiana, Oklahoma, and Vermont—were all enacted in 2026 and take effect over the next two years.¹² (Trackers that also count Florida's narrower Digital Bill of Rights put the total at 24.) Although drafted by different legislatures, these laws share a common blueprint. Consumers generally get the right to know what data a business holds about them, to correct it, to delete it, and to opt out of its sale or its use for targeted advertising. Many of the laws, including those in Virginia, Colorado, and Connecticut, divide businesses into "controllers," which decide why and how data is processed, and "processors," which handle it on a controller's behalf.¹³ With one meaningful exception, enforcement is reserved for state officials, usually the attorney general; consumers cannot sue on their own.

That exception is California, widely regarded as having the most comprehensive state privacy regime in the U.S. The state attorney general and the California Privacy Protection Agency (CPPA) enforce most of the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). But the statute also gives consumers a limited private right of action when certain categories of their personal information are exposed in a breach caused by a business's failure to maintain reasonable security.¹⁴ Statutory damages, adjusted for inflation in 2025, now run from $107 to $799 per consumer per incident, or actual damages if greater.¹⁵ In a class action, those per-consumer figures add up quickly.

The Illinois Biometric Information Privacy Act (BIPA) takes a different approach. BIPA isn't a comprehensive privacy law; it covers only fingerprints, face geometry, and other biometric identifiers. But it gives individuals a private right of action, with liquidated damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation.¹⁶ The Illinois Supreme Court has held that a person can be "aggrieved" under BIPA without proving an injury beyond the violation of the statute itself, although federal standing requirements can still affect whether a claim proceeds in federal court.¹⁷

In Cothron v. White Castle System, Inc., the Illinois Supreme Court held that, under the statute as then written, a separate claim accrued with each scan or transmission of biometric data. White Castle estimated that the resulting exposure could exceed $17 billion.¹⁸ In 2024, the Illinois legislature amended BIPA to limit plaintiffs to a single recovery per person for repeated collection by the same method. In April 2026, the U.S. Court of Appeals for the Seventh Circuit held in Clay v. Union Pacific Railroad Co. that the amendment applies retroactively to cases pending when it took effect.¹⁹ Because that decision is a federal court's prediction of Illinois law, and most Illinois trial courts to consider the question have reached the opposite conclusion, the final word will likely come from the Illinois Supreme Court.²⁰

Large BIPA settlements remain common. Facebook paid $650 million to settle a BIPA class action,²¹ and in 2025 an Illinois court approved an $8.75 million settlement resolving BIPA claims over Google Workspace for Education.²² Texas and Washington have their own biometric privacy laws, but neither allows individuals to sue; both are enforced by the state attorney general.²³

Outside Illinois and California's breach provision, then, enforcement depends on public officials, and several of the newer state laws give businesses a 30- to 60-day cure period to fix a violation after receiving notice.¹² But when state attorneys general do act, the numbers can dwarf anything in private litigation. Texas secured a $1.4 billion settlement with Meta in 2024 under its biometric privacy law²⁴ and a $1.375 billion settlement with Google in 2025 over the company's handling of Texans' data.²⁵ Most significantly, in August 2026, a week into trial, a bipartisan coalition of 52 attorneys general announced a settlement with Meta resolving claims that Facebook and Instagram were designed in ways that harmed young users and collected children's data without parental consent.²⁶ The settlement, which includes COPPA claims, provides for about $11.7 billion in payments to participating states plus roughly $5 billion more in contingent payments,²⁷ for a total of up to about $17 billion, along with sweeping changes to how minors use the platforms. It came after an investigation that began in 2021.²⁸

Cases like these take years to resolve. For most businesses, the more immediate threat is private class-action litigation, particularly after a data breach, where filings have surged in recent years.²⁹ That is where the risk lives: in the gap between what the law requires on paper and what companies actually do with data. Part 2 turns from the law on the books to companies' data practices, and Part 3 makes the case that closing that gap isn't just about avoiding risk, but about building something competitors can't easily copy.

Atticus Smith is a legal intern at Afissio Law. This series was edited by Jerry Stephen Smith, Principal of Afissio Law.

Notes

1. U.S. Dep't of Health & Human Services, The HIPAA Privacy Rule, https://www.hhs.gov/hipaa/for-professionals/privacy/index.html
2. FTC, Gramm-Leach-Bliley Act, https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act
3. FTC, Children's Privacy, https://www.ftc.gov/business-guidance/privacy-security/childrens-privacy
4. FTC, Credit Reporting, https://www.ftc.gov/business-guidance/privacy-security/credit-reporting
5. FTC, Consumer Privacy, https://www.ftc.gov/business-guidance/privacy-security/consumer-privacy
6. 15 U.S.C. § 45(a), (n), https://www.law.cornell.edu/uscode/text/15/45
7. FTC, Rite Aid Banned from Using AI Facial Recognition (Dec. 2023), https://www.ftc.gov/news-events/news/press-releases/2023/12/rite-aid-banned-using-ai-facial-recognition-after-ftc-says-retailer-deployed-technology-without
8. FTC, Order Prohibits Data Broker X-Mode Social and Outlogic from Selling Sensitive Location Data (Jan. 2024), https://www.ftc.gov/news-events/news/press-releases/2024/01/ftc-order-prohibits-data-broker-x-mode-social-outlogic-selling-sensitive-location-data
9. FTC, Trade Regulation Rule on Commercial Surveillance and Data Security, 87 Fed. Reg. 51273 (Aug. 22, 2022), https://www.federalregister.gov/documents/2022/08/22/2022-17752/trade-regulation-rule-on-commercial-surveillance-and-data-security
10. FTC, Commercial Surveillance and Data Security Rulemaking, https://www.ftc.gov/legal-library/browse/federal-register-notices/commercial-surveillance-data-security-rulemaking
11. IAPP, Vermont Becomes 23rd State to Enact Consumer Privacy Law, https://iapp.org/news/a/vermont-becomes-23rd-state-to-enact-consumer-privacy-law
12. Morgan Lewis, New US State Consumer Privacy Laws: What Businesses Should Know (July 2026), https://www.morganlewis.com/pubs/2026/07/new-us-state-consumer-privacy-laws-what-businesses-should-know
13. Trade Commissioner Service (Canada), Comprehensive State Privacy Laws, https://www.tradecommissioner.gc.ca/en/market-industry-info/search-country-region/country/canada-united-states-export/comprehensive-state-privacy-laws.html
14. Cal. Civ. Code § 1798.150, https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.150
15. California Privacy Protection Agency, Monetary Thresholds in the CCPA, https://privacy.ca.gov/laws-and-regulations/monetary-thresholds-in-the-ccpa/
16. Biometric Information Privacy Act, 740 ILCS 14, https://www.ilga.gov/Legislation/ILCS/Articles?ActID=3004&ChapterID=57
17. Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, https://law.justia.com/cases/illinois/supreme-court/2019/123186.html
18. Cothron v. White Castle System, Inc., 2023 IL 128004, https://law.justia.com/cases/illinois/supreme-court/2023/128004.html
19. Clay v. Union Pacific Railroad Co. (7th Cir. Apr. 1, 2026), https://caselaw.findlaw.com/court/us-7th-circuit/118259102.html
20. JD Supra, Seventh Circuit Issues Seminal Decision Holding BIPA Amendment Applies Retroactively (Apr. 2026), https://www.jdsupra.com/legalnews/seventh-circuit-issues-seminal-decision-6562703/
21. Robbins Geller, In re Facebook Biometric Information Privacy Litigation, https://www.rgrdlaw.com/cases-in-re-facebook-biometric-info-privacy-litig.html
22. Google Education BIPA Settlement (official settlement website), https://www.googleeducationbipasettlement.com/
23. Wash. Rev. Code ch. 19.375 (app.leg.wa.gov/RCW/default.aspx?cite=19.375); Tex. Bus. & Com. Code ch. 503, https://statutes.capitol.texas.gov/Docs/BC/htm/BC.503.htm
24. Texas Attorney General, Paxton Secures $1.4 Billion Settlement with Meta (July 30, 2024), https://www.texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-secures-14-billion-settlement-meta-over-its-unauthorized-capture
25. Texas Attorney General, Paxton Secures Historic $1.375 Billion Settlement with Google (May 2025), https://www.texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-secures-historic-1375-billion-settlement-google-related-texans-data
26. Al Jazeera, Meta Agrees to Settlement, Platform Changes in Youth Addiction Case (Aug. 26, 2026), https://www.aljazeera.com/news/2026/8/26/meta-agrees-to-settlement-platform-changes-in-youth-addiction-case
27. Clyde & Co, Meta's Multi-State Social Media Addiction Settlement (Aug. 27, 2026), https://www.clydeco.com/en/insights/2026/08/meta-s-multi-state-social-media-addiction-settleme
28. Nebraska Attorney General, Attorney General Hilgers Announces Largest Big Tech Settlement in History (Aug. 26, 2026), https://ago.nebraska.gov/sites/default/files/doc/Meta%20Release.pdf
29. Duane Morris, Data Breaches Give Rise to an Unprecedented Number of Class Action Filings (Jan. 2025), https://blogs.duanemorris.com/classactiondefense/2025/01/21/dmcar-trend-7-data-breaches-gives-rise-to-an-unprecedented-number-of-class-action-filings/

Afissio Law, LLC | Jerry Stephen Smith, Principal

1438 W Broadway Road, Suite 101, Tempe, Arizona 85282

This article is provided for general informational purposes only and is not legal advice. Reading it does not create an attorney-client relationship.