# US privacy law applicability checklist

Use this to make a first map of which US privacy laws reach a product, a dataset or a business line. It
follows the structure of the IAPP CIPP/US Body of Knowledge: federal sector laws, then state laws. It is a
planning aid, not legal advice; thresholds and exemptions decide coverage, so check each law's text.

## Federal: who is regulating you?

- [ ] Consumer-facing practices: the FTC's authority over unfair or deceptive practices (Section 5)
- [ ] Health data held by a covered entity or business associate: HIPAA (45 CFR Part 164)
- [ ] A financial institution: the Gramm-Leach-Bliley Act and the FTC Safeguards Rule (16 CFR Part 314)
- [ ] Education records at a school that receives US Department of Education funding: FERPA (34 CFR Part 99)
- [ ] Online services collecting personal information from children under 13: COPPA (16 CFR Part 312)
- [ ] Telephone, text or email marketing: the TCPA and CAN-SPAM
- [ ] Consumer reports used for credit, employment or insurance decisions: the FCRA

## State: whose residents are you dealing with?

- [ ] Which states' residents' data you process, and how many in each: ____________
- [ ] Whether each state consumer privacy law applies, given its thresholds and exemptions
- [ ] Entity-level or data-level exemptions (for example GLBA or HIPAA) checked state by state
- [ ] How each state defines a "sale" (monetary only, or other valuable consideration too)
- [ ] Sensitive data: which states require opt-in consent before processing it
- [ ] Consumer requests: response process, and an appeal process where the state requires one
- [ ] Data protection assessments: when each state makes one mandatory
- [ ] Who enforces each law (in California, the California Privacy Protection Agency and the Attorney General)

## Breach

- [ ] Every state where affected residents live, because each state's breach notification law applies to its residents
- [ ] Whether any state gives consumers a private right of action for breaches