United States

California Consumer Privacy Act tests. You are covered if your gross annual revenue is over $25 million. That figure is adjusted upward for inflation each year. You are also covered if you buy, sell or share the personal information of 100,000 or more California residents or households. Or if 50% or more of your annual revenue comes from selling California residents' personal information. Most other state privacy laws only count people. The common test is 100,000 residents, or 25,000 residents where more than 25% of revenue comes from selling data. Those states set no revenue floor at all. So a mid-sized foreign business can be caught in one state and not another. The Federal Trade Commission Act reaches conduct that affects United States commerce, wherever the company sits. The Justice Department's Data Security Program is written around 'U.S. persons'. It also binds foreign recipients through the deals it bans.

Industry by industry. OPEN (we found no rule about where the data must sit, checked 18 August 2026). Health under the federal health privacy law. Banking and payments under federal banking law. Insurance under state insurance data security laws. Education under the federal student records law. Online shopping, social media and online gaming. Map and location data on its own. Bank supervisors expect you to manage the legal risk of a foreign-based service provider. They also expect you to hand records to examiners. They do not say where the servers must sit. CONDITIONAL: every industry, because of the Justice Department's Data Security Program. You may not sell large amounts of sensitive data about Americans to China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia or Venezuela. You may not give them access to it either. The same goes for people and companies those countries control. Sensitive data here means genomic, biometric, precise location, health, financial and identifier data above set volume limits. Vendor, employment and investment arrangements with those countries are allowed only with strict security controls, audits and reporting. Defence technical data may sit on a foreign server only under three conditions. It must be encrypted end to end to a strong standard. It must not be stored in an embargoed country. And only authorised people may be able to read it. CLOSED: federal tax information handled for the tax authority. Criminal justice information under the police data policy, which allows only the United States, its territories, tribal lands and Canada. Department of Defense cloud contracts. Government data must stay in the United States or its outlying areas. A contracting officer can say otherwise in writing. MIRROR-LIKE: telecom carriers with foreign investment. Their agreements with the security agencies say United States records must be kept where American authorities can reach them. The agreements also require government vetting before foreign staff are given access.

The Justice Department programme splits deals into three groups. Prohibited: selling data to one of the six countries, or to a covered person. Also prohibited: any transfer of large amounts of human genomic data, or of the biospecimens behind it. Restricted: vendor, employment and investment agreements. These are allowed only with a defined security programme, annual independent audits and record-keeping. Exempt: ordinary administration inside your own corporate group, official United States government business, financial services activity, regulatory approvals, and personal communications. Volume limits decide when the rules apply. They start at more than 100 people for genomic data, and 1,000 people for biometric data. For precise location, 1,000 devices. For health or financial data, 10,000 people. For basic identifiers, 100,000 people. You count over any rolling twelve months. Separately, a 2024 law bans data brokers from selling sensitive data to North Korea, China, Russia or Iran at all. The consumer protection regulator enforces it. There is no volume limit, and the security-controls route does not apply here.

Evidence gathered on 18 August 2026. The Federal Trade Commission finalised an order against a car maker and its connected-car arm in January 2026 over selling driver location data. It sued two dating apps in March 2026 over sharing personal data. It finalised an order against an education technology company over student data in June 2026. In February 2026 it sent warning letters to thirteen data brokers about selling sensitive data to foreign adversaries. California's privacy agency has issued a run of fines. They include $1.35 million against a rural retailer in September 2025 and $632,500 against a car maker. It opened a fresh round of data broker cases in January 2026. The Texas attorney general sued a group of Chinese-linked companies in May 2025. It also warned over a hundred firms about the state data broker law. The communications regulator issued its first ever penalty for breaching a national security agreement in January 2026. The health department continues to settle security cases. The Justice Department's data security unit is the outlier. As of 18 August 2026 it lists no public enforcement action, licence or advisory opinion under the programme. It is staffed and publishing guidance, but has taken no action.

Minimums. Broker-dealer records: six years for the core books, with two years in an easily accessible place. Three years for most operational records. Formation documents for the life of the business. Customer account records run six years past account closure. Health privacy paperwork: six years. Tax records: the tax authority's normal periods, commonly three to seven years depending on the item. Investment advisers and funds have parallel rules. Maximums. The California rules require a retention schedule and require you to publish how long you keep data. The amended children's rule requires a written retention policy. It bans keeping children's data forever and requires deletion once the original purpose is met. State consumer privacy laws give people a right to have data deleted, unless the law requires you to keep it. No state deletion right overrides a federal duty to keep records. The state laws say so directly rather than leaving it to interpretation.

Deadlines verified 18 August 2026. New York Department of Financial Services rule Part 500: tell the regulator within 72 hours of deciding a cybersecurity incident happened. Report extortion payments within 24 hours. Communications regulator rule: tell the Federal Bureau of Investigation, the Secret Service and the Commission as soon as you can. The deadline is seven business days after you reasonably decide there was a breach. Then wait seven business days before telling customers, unless law enforcement extends the hold. The Sixth Circuit court upheld these rules, so they are live and not merely on the books. Amended Regulation S-P: tell affected people as soon as you can, and no later than 30 days after you learn of unauthorised access. Larger firms had to comply from December 2025 and smaller ones from June 2026. Consumer protection regulator's Safeguards Rule: report security events affecting 500 or more consumers within 30 days. Health privacy rule: tell individuals and the health department within 60 days. If more than 500 residents of one state are affected, tell the media too, within 60 days. Smaller breaches are reported once a year, within 60 days of the year end. Texas: 30 days to the attorney general where 250 or more Texans are affected. Securities disclosure rule: file Form 8-K within four business days of deciding an incident is material. The national critical infrastructure reporting law adds a 72-hour incident deadline and a 24-hour ransom-payment deadline. It is not yet switched on. See question eight.

Trap one. The data transfer programme runs on emergency economic powers. Civil penalties go up to the greater of $368,136 or twice the value of the deal. Criminal penalties go up to $1,000,000 and up to twenty years in prison for a person acting wilfully. This is not an administrative privacy fine. Trap two. The Illinois biometric law lets people sue you directly. Damages are set at $1,000 for negligent breaches and $5,000 for reckless or intentional ones. A 2024 change (Public Act 103-0769) limits each person to one claim per collection method, rather than one per scan. That cut the possible exposure enormously, but did not remove it. Washington's health data law also lets people sue. Trap three. The federal children's rule covers under 13. State design-code and social-media laws reach under 18 or under 16. The amended federal rule became fully enforceable on 22 April 2026. It now requires a written data retention policy, separate consent for targeted advertising, and a list of the third parties that receive children's data. Trap four. Criminal justice information may only be stored in the United States, its territories, tribal lands or Canada. The metadata derived from it is protected the same way and may not be used for advertising. Federal tax information must stay in the United States and its territories. Department of Defense cloud contracts require government data to stay in the United States or outlying areas. Trap five. Two live examples. A court struck down most of the 2024 health rule on reproductive health privacy nationwide in 2025, so it no longer applies. Some notice changes survived, with a compliance date of 16 February 2026. And most of California's children's design code has been blocked since 2022. In March 2026 the appeal court kept the block on the data-use and dark-pattern parts and lifted it on the rest. So parts of that law apply and parts do not.

Dated items. The critical infrastructure reporting rule: the agency's own page still says you do not have to report until the final rule takes effect. That date has slipped repeatedly through 2025 and 2026. Automated decision-making: businesses using it for significant decisions must comply from 1 January 2027. Risk assessments began on 1 January 2026, with first submissions due by 1 April 2028. Cybersecurity audit submissions start 1 April 2028 for businesses with revenue over $100 million. Businesses between $50 million and $100 million start in 2029, and those below $50 million in 2030. Open banking: the finance regulator reopened the rulemaking in August 2025. A federal court has blocked enforcement of the existing version, whose first compliance date was 1 April 2026. Health security rule: a proposal to tighten it was published in January 2025 and has not been finalised. Federal bills, including the SECURE Data Act introduced in April 2026, are still only proposals. Powers already held that could change things overnight. First and largest: the Attorney General can add a country to the list of countries of concern. The Attorney General can also name any person as a covered person. No consultation and no notice period are needed. Second: the communications regulator's list of untrusted suppliers can be expanded. A rulemaking opened in April 2026 to strip listed companies of blanket permission to provide domestic services. Third: export control decisions can move technical data into a restricted category without new legislation. Fourth: state attorneys general in Texas and California have shown they will open sweeps against whole categories of company at a few days' notice.