United States

California Consumer Privacy Act thresholds: gross annual revenue over $25 million (a figure adjusted upward for inflation each year), or buying/selling/sharing the personal information of 100,000 or more California residents or households, or deriving 50% or more of annual revenue from selling California residents' personal information. Most other state privacy laws use a volume test only (commonly 100,000 residents, or 25,000 residents where more than 25% of revenue comes from selling data) and have no revenue floor at all, so a mid-sized foreign business can be caught in one state and not another. The Federal Trade Commission Act reaches conduct affecting United States commerce regardless of where the company sits. The Justice Department's Data Security Program is drafted around 'U.S. persons' but also binds foreign recipients through the transactions it prohibits.

Sector-by-sector ratings. OPEN (no location rule found, checked 18 August 2026): health under the federal health privacy law; banking and payments under federal banking law; insurance under state insurance data security laws; education under the federal student records law; e-commerce; social media; online gaming; mapping and location data as such. Bank supervisors expect you to manage the legal risk of a foreign-based service provider and to be able to hand records to examiners, but they do not tell you where the servers must sit. CONDITIONAL: everything, because of the Justice Department's Data Security Program. Bulk sensitive data about Americans — genomic, biometric, precise location, health, financial and identifier data above set volume thresholds — may not be sold or made accessible to China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia or Venezuela, or to people and companies they control. Vendor, employment and investment arrangements with those countries are allowed only with strict security controls, audits and reporting. Defence technical data may sit on a foreign server only if it is end-to-end encrypted to a strong standard, is not stored in an embargoed country, and is only readable by authorised people. CLOSED: federal tax information handled for the tax authority; criminal justice information under the police data policy, which allows only the United States, its territories, tribal lands and Canada; Department of Defense cloud contracts, where government data must be maintained in the United States or its outlying areas unless a contracting officer says otherwise in writing. MIRROR-LIKE: telecom carriers holding foreign investment. Their agreements with the security agencies require United States records to be kept where American authorities can reach them and require prior government vetting before foreign staff are given access.

The Justice Department programme splits transactions into three buckets. Prohibited: data brokerage with a country of concern or a covered person, and any transfer of bulk human genomic data or the biospecimens behind it. Restricted: vendor, employment and investment agreements, which are permitted only with a defined security programme, annual independent audits and record-keeping. Exempt: ordinary corporate group administration, official business of the United States government, financial services activity, regulatory approvals, and personal communications. Volume thresholds trigger the rules: more than 100 people for genomic data, 1,000 for biometric data, 1,000 devices for precise location, 10,000 people for health or financial data, and 100,000 people for basic identifiers, measured over any rolling twelve months. Separately, data brokers may not sell sensitive data to North Korea, China, Russia or Iran at all under a 2024 statute enforced by the consumer protection regulator, with no volume threshold and no exemption for restricted transactions.

Observable evidence gathered on 18 August 2026. The Federal Trade Commission finalised an order against a car maker and its connected-car arm over selling driver location data in January 2026, sued two dating apps in March 2026 over sharing personal data, and finalised an order against an education technology company over student data in June 2026; in February 2026 it sent warning letters to thirteen data brokers about selling sensitive data to foreign adversaries. California's privacy agency has issued a run of fines including $1.35 million against a rural retailer in September 2025 and $632,500 against a car maker, and opened a fresh round of data broker cases in January 2026. The Texas attorney general sued a group of Chinese-linked companies in May 2025 and warned over a hundred firms about the state data broker law. The communications regulator issued its first ever penalty for breaching a national security agreement in January 2026. The health department continues to settle security cases. Against that, the Justice Department's data security unit lists no public enforcement action, licence or advisory opinion under the programme as of 18 August 2026 — it is staffed and publishing guidance, but has not yet bitten.

Floors. Broker-dealer records: six years for the core books with two years in an easily accessible place, three years for most operational records, and for the life of the business for formation documents; customer account records run six years past account closure. Health privacy documentation: six years. Tax records: the tax authority's normal periods, commonly three to seven years depending on the item. Investment advisers and funds have parallel rules. Ceilings. The California regulations require a retention schedule and disclosure of retention periods; the amended children's rule requires a written retention policy, bans indefinite retention, and requires deletion once the original purpose is met; state consumer privacy laws give a deletion right subject to a legal-obligation exception. Note that no state deletion right overrides a federal retention duty — the statutes say so explicitly rather than leaving it to interpretation.

Deadlines verified 18 August 2026. New York Department of Financial Services rule Part 500: notify within 72 hours of determining a cybersecurity incident occurred; extortion payments reported within 24 hours. Communications regulator rule at 47 CFR 64.2011: notify the Federal Bureau of Investigation, the Secret Service and the Commission as soon as practicable and no later than seven business days after a reasonable determination of a breach, then wait seven business days before notifying customers unless law enforcement extends the hold; the Sixth Circuit upheld these rules, so they are live and not merely on the books. Amended Regulation S-P: notify affected individuals as soon as practicable and no later than 30 days after becoming aware of unauthorised access, with compliance from December 2025 for larger firms and June 2026 for smaller ones. Consumer protection regulator's Safeguards Rule: report security events affecting 500 or more consumers within 30 days. Health privacy rule: individuals, the health department and, above 500 residents of one state, the media within 60 days; smaller breaches reported annually within 60 days of year end. Texas: 30 days to the attorney general where 250 or more Texans are affected. Securities disclosure rule: Form 8-K within four business days of deciding an incident is material. The national critical infrastructure reporting law adds 72-hour incident and 24-hour ransom-payment duties but is not yet switched on — see question eight.

Trap one. The data transfer programme runs on emergency economic powers, so penalties are civil up to the greater of $368,136 or twice the value of the transaction, and criminal up to $1,000,000 with up to twenty years' imprisonment for a natural person acting wilfully. This is not an administrative privacy fine. Trap two. The Illinois biometric statute gives a private right of action with liquidated damages of $1,000 for negligent and $5,000 for reckless or intentional violations. A 2024 amendment (Public Act 103-0769) limits recovery to a single claim per person per method of collection rather than per scan, which cut the theoretical exposure enormously but did not remove it. Washington's health data statute also carries a private right of action. Trap three. The federal children's rule covers under 13. State design-code and social-media laws reach under 18 or under 16. The amended federal rule became fully enforceable on 22 April 2026 and now requires a written data retention policy, separate consent for targeted advertising, and disclosure of the third parties that receive children's data. Trap four. Criminal justice information may only be stored in the United States, its territories, tribal lands or Canada, and the metadata derived from it is protected the same way and may not be used for advertising. Federal tax information must stay in the United States and its territories. Department of Defense cloud contracts require government data to be maintained in the United States or outlying areas. Trap five. Two live examples. Most of the 2024 health rule on reproductive health privacy was struck down nationwide in 2025 and no longer applies, although some notice changes survived with a compliance date of 16 February 2026. And most of California's children's design code has been enjoined since 2022; in March 2026 the appeal court kept the injunction over the data-use and dark-pattern provisions and lifted it over the rest, so parts of that law are enforceable and parts are not.

Dated items. The critical infrastructure reporting rule: the agency's own page still says organisations are not required to report until the effective date of the final rule, which has slipped repeatedly through 2025 and 2026. Automated decision-making: businesses using such technology for significant decisions must comply from 1 January 2027; risk assessments began on 1 January 2026 with first submissions due by 1 April 2028; cybersecurity audit submissions start 1 April 2028 for businesses over $100 million of revenue, 2029 between $50 million and $100 million, and 2030 below $50 million. Open banking: the finance regulator reopened the rulemaking in August 2025 and a federal court has blocked enforcement of the existing version, whose first compliance date was 1 April 2026. Health security rule: a proposal to tighten the health security rule was published in January 2025 and has not been finalised. Federal bills, including the SECURE Data Act introduced in April 2026, remain proposals. Dormant switches — powers already held that can change the picture overnight. First and largest: the Attorney General can add a country to the countries-of-concern list by determination, and can designate any person as a covered person, with no consultation and no notice period. Second: the communications regulator's Covered List of untrusted suppliers can be expanded, and a rulemaking opened in April 2026 to strip listed entities of blanket authority to provide domestic services. Third: export control designations can move technical data into a restricted category without legislation. Fourth: state attorneys general in Texas and California have shown they will open sweeps against whole categories of company on days' notice.