What US Privacy Law Actually Protects — and What It Leaves Open

People ask whether the law protects their personal data, and they expect a yes or no. The honest answer in the United States is that the question is malformed. There is no general federal privacy law, so “does the law protect me” has no single answer — only answers that depend on who is holding the data and what kind it is.

That is not a dodge. It is the actual structure of American privacy protection, and once you can see the structure, you can predict which rights you have in a given situation instead of guessing. The rest of this article maps that structure: three layers, each covering a different slice of the problem, and the specific gaps between them.

Layer one: the Constitution constrains the government, not companies

The most common misunderstanding is that the Fourth Amendment is a general privacy shield. It is not. The Fourth Amendment limits what the government — police and agencies — may do. It says nothing about what a private company may collect, keep, or sell.

This matters because the line between the two has been moving, and the movement shows how the doctrine works. Under the “third-party doctrine,” the Supreme Court long held that a person has no reasonable expectation of privacy in information voluntarily handed to a third party — bank records in United States v. Miller (1976), dialed phone numbers in Smith v. Maryland (1979). The theory was that you take the risk of disclosure when you reveal your affairs to someone else.

In 2018 the Court narrowed that doctrine in Carpenter v. United States. The question was whether police needed a warrant to obtain historical cell site location information — the record of which towers your phone connected to, which can reconstruct where you have been. The government argued that the third-party doctrine applied: you gave the data to your carrier, so you had no expectation of privacy in it. The Court disagreed, 5–4.

Two parts of the reasoning are worth carrying around. First, the Court said that cell phone location data is not really “shared” in the ordinary sense, because carrying a phone is “indispensable to participation in modern society” and a phone logs a cell-site record “by dint of its operation” — you do not meaningfully choose to hand it over. Second, the Court described the resulting capability as “near perfect surveillance,” an “intimate window into a person’s life” revealing not just movements but through them a person’s “familial, political, professional, religious, and sexual associations.”

The holding is narrower than it sounds. It covers historical cell site location information. It did not abolish the third-party doctrine, and the Court was explicit that it had not decided how the doctrine applies to other technologies. Banking records, for instance, remain governed by the older rule. So the practical takeaway is not “the Fourth Amendment now protects my data.” It is: the Fourth Amendment sometimes requires a warrant for government access to certain kinds of digital records, and the boundary is being litigated case by case. And none of it touches what a company may collect from you in the first place.

Layer two: sector laws that protect by category, not by person

If the Constitution is the wrong tool for private collection, the plausible candidate is a statute. And there are statutes — but they are built around specific industries and specific kinds of data, not around you as a person. Four of them do most of the work.

Law	Who it covers	What it protects	What it does not reach
HIPAA	Health plans, healthcare clearinghouses, and providers that transmit standard electronic health transactions — plus their business associates	Protected health information held by those entities	A wellness app, a wearable, or a health website that does not act for a covered entity. The data can be about your health and still sit outside HIPAA.
GLBA	“Financial institutions,” a broad and non-intuitive category under the Gramm-Leach-Bliley Act — it reaches businesses significantly engaged in financial activities, including lenders, debt collectors, and tax preparers	Nonpublic personal information, with notice and opt-out duties	Businesses that are not engaged in financial activities as the rule defines them. The category is wider than most people expect, but it still turns on what the business does, not on whether it handles money.
COPPA	Sites and services directed to children under 13, general-audience sites with “actual knowledge” of collecting from a child under 13, and third-party services running on kids’ sites	Personal information from children under 13, including persistent identifiers such as IP addresses	Adults entirely. It also does not require a general-audience site to go find out users’ ages — but asking for information that establishes a visitor is under 13 brings the obligation into play.
FCRA	Consumer reporting agencies and the users of consumer reports	The accuracy, privacy, and permitted uses of consumer report information	Data about you that is not a consumer report. Your browsing history is not a credit file.

The pattern is the point. Each of these laws answers the question “what kind of entity are you, and what kind of data is this?” — not “are you a person with a right to privacy?” A health app and a hospital can hold the same fact about you, and only one of them is covered by HIPAA. A bank and a landlord can both know your income, and the legal obligations diverge.

This is why privacy policies so often contain a line about whether HIPAA applies. It is not boilerplate. It is a statement about which of these regimes, if any, governs the data the company is holding.

Layer three: one general law that works indirectly

The gap between the sector laws is filled — partially — by a statute that was never written as a privacy law. Section 5 of the FTC Act declares unlawful “unfair or deceptive acts or practices in or affecting commerce.” The Federal Trade Commission has used that general authority to become the closest thing the United States has to a national privacy regulator.

Two theories do the work. A practice is deceptive if it is a material representation or omission likely to mislead a consumer acting reasonably. A practice is unfair if it causes or is likely to cause substantial injury that consumers cannot reasonably avoid and that is not outweighed by benefits to consumers or competition.

Apply those to privacy and you get the FTC’s most settled principle: a company is bound by the promises it makes. Gather, use, or disclose personal information in a way that contradicts your posted privacy policy, and the FTC treats that as deceptive. Fail to protect data as your policy says you will, and that is a broken promise too. Over years of cases this has produced what scholars call a kind of common law of privacy — not a statute, but a body of consent decrees showing what the agency considers out of bounds.

Read that carefully, though, because the limits are as important as the power.

The FTC’s authority is derivative. It attaches to a broken promise or an injury that meets the unfairness test. Where there is no promise and no provable injury within the test, the same conduct can be lawful. A company that never claimed to protect your data may be able to sell it.

Section 5 does not allow civil penalties for a first-time privacy violation. The Commission has said so directly, and it has asked Congress for the authority. Its principal remedy is prospective: an order requiring the company to change its practices, delete data, and submit to outside assessments.

It does not reach everyone. Nonprofits and common carriers — in some circumstances, telecommunications services among them — fall outside FTC jurisdiction. And the FTC does not have jurisdiction over banks, credit unions, or savings and loan institutions; those are supervised by other agencies.

After AMG Capital Management v. FTC (2021), one common route to monetary relief in these cases narrowed. The Supreme Court unanimously held that Section 13(b) of the FTC Act — the provision the Commission had used for decades to seek restitution and disgorgement directly in court — does not authorize equitable monetary relief. The FTC can still seek consumer redress in some situations, through the older and more procedurally burdened section 19 path after a cease-and-desist order, but it lost the direct route it had come to rely on. The case was decided on statutory interpretation, so Congress can restore the authority; it has not.

The FTC itself makes the summary argument: Section 5 is “an imperfect tool” for privacy, which is why the Commission has repeatedly asked Congress to pass privacy and data security legislation enforceable by the FTC with civil penalty authority and jurisdiction over nonprofits and common carriers. That legislation has not passed.

The newest layer: state law, which is where the real rights now live

Because Washington has not acted, the states have — and this is the layer that has changed fastest. As of early 2026, roughly 20 states have a comprehensive consumer privacy law in effect. Indiana, Kentucky, and Rhode Island joined on January 1, 2026; Oklahoma has been signed and takes effect in 2027.

The laws follow a shared model, set first by Virginia in 2023. If you are a resident of one of these states and the business meets the law’s threshold, you generally have the right to:

• Access the personal data a business holds about you
• Delete it and correct it
• Opt out of its sale and of targeted advertising
• Appeal a business’s refusal to honor a request

But three cautions, and they are the reason this section cannot simply say “move to California.”

The thresholds matter more than the rights. Every one of these laws exempts small businesses, and the thresholds vary widely — some states count consumers processed, some require revenue, some require both. A business can be large by your standards and still fall below the line.

Coverage is by residency, and the numbers are moving. The count above is a snapshot. State legislatures add laws and amend effective dates every session, so any specific number in any article — including this one — should be checked against a current tracker before you act on it.

There is no federal backstop if your state has not acted. If you live in a state without a comprehensive law, the rights in that list may simply not exist for you as a matter of statute. What remains is the FTC layer — real, but narrower and dependent on a broken promise or a provable unfair practice.

Where the gaps actually are

Stepping back, the gaps are easier to see as a list than as an abstraction.

Data brokers are the clearest example. A business that buys and sells personal information may not be a consumer reporting agency under FCRA, may not be a financial institution under GLBA, and may not be a covered entity under HIPAA. It may have made promises it keeps. What constrains it, if anything, is state law in states that have acted — and federal enforcement against specific deceptive or unfair conduct, case by case.

Health data outside the clinic. A period tracker, a fitness app, a symptom checker: all can hold information that would be protected in a doctor’s office and fall outside HIPAA in an app, because the app is not acting for a covered entity.

Anything you post or carry. The Fourth Amendment analysis in Carpenter was about government access to records held by a carrier. It does not regulate what a platform does with what you upload, beyond the platform’s own terms and the Section 5 limit on breaking them.

Adults on general-audience services. COPPA is real and enforced, but its protections run to children under 13. There is no federal equivalent for adults.

What to do with this

The structure suggests a few practical habits.

Stop asking “is this legal?” and ask “which layer applies?” When you hand data to a company, identify what kind of entity it is and what kind of data it is. Health data at a hospital and health data in an app are the same fact under two different regimes.

Read the promises, because they are enforceable. The privacy policy is not decoration. Under the FTC’s most settled principle, a company that contradicts its own policy is engaged in a deceptive practice. The policy tells you what the company has committed to — and that commitment is the thing the law will hold it to.

Use the state rights if you have them, and know their shape. Access, delete, correct, opt out of sale and targeted ads, and appeal. Check whether your state has a law in effect and whether the business meets its threshold before assuming the right applies.

Do not rely on paid services that promise to enforce your privacy. The tools that work are the ones the law or the agency provides directly: your state attorney general or consumer protection office for state law, and ReportFraud.ftc.gov for a deceptive or unfair practice. Neither costs anything.

Treat the Fourth Amendment as a limit on government, not a shield against companies. It can require a warrant for certain government access to digital records. It does not tell a business what it may collect.

The bottom line

The United States protects privacy in slices. The Constitution limits the government; sector laws protect specific data in specific industries; Section 5 gives the FTC a general but indirect authority that attaches to broken promises and provable injuries; and state law, in about 20 states, is where actual consumer rights to access, delete, and opt out now live. There is no single law that protects you as a person, and a business handling data you consider sensitive may sit in a gap between all four layers.

The useful move is not to memorize the statutes. It is to internalize the question that replaces “does the law protect me”: Who holds this data, what kind is it, and what did they promise? Those three answers tell you which layer you are standing in.

Byte is the technology site of the Omni Mundi Compendium network. The specific tools that stop someone from opening accounts in your name are in Credit Freeze, Fraud Alert, or Credit Lock, and what to do in the days after a breach notice is in You Got a Data Breach Notice.

This article is general information about US privacy law, not legal advice. Whether a particular business is covered by any of these regimes depends on facts — its role, its data, and its jurisdiction — and comprehensive state privacy laws vary by state and change with each legislative session. The count of states with a law in effect is a snapshot, not a standing figure. It is AI-written and independently AI-reviewed before publication; the review standard and this article’s findings are recorded in the network’s editorial review log.