Laws and data licensing
United States: privacy laws and AI data licensing
Short answer
If your records include people in United States, the main rules are: No single federal privacy law; sector laws (HIPAA, GLBA, FERPA), the FTC Act and a growing number of state privacy laws.
In short
- Country
- United States
- Main privacy laws
- No single federal privacy law; sector laws (HIPAA, GLBA, FERPA), the FTC Act and a growing number of state privacy laws.
- Note
- U.S. suppliers are SourceX's priority. State law depends on where the people in the records live.
- Last reviewed
- 2026-10-09
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
What to know#
U.S. suppliers are SourceX's priority. State law depends on where the people in the records live.
For suppliers#
- U.S. businesses are SourceX's priority, and their records may include customers abroad
- Records tied to other countries are reviewed against their rules or excluded
- Personal details are removed before anything is shared
Is there a federal data privacy law in the United States?#
No single comprehensive federal data privacy law covers all personal data in the United States. Federal privacy law instead comes from statutes that each cover one sector or one kind of record, plus the FTC Act, which the FTC uses as its main privacy authority in the absence of a general privacy law.
The practical consequence is that the same company can be under several federal rules at once, or under none for a given dataset, depending on who collected the records and what they describe. The table shows the federal laws most often asked about and the rule in each that matters when records are reused or shared.
| Federal law | Who it covers | What it protects | Rule that matters for reuse |
|---|---|---|---|
| HIPAA Privacy Rule | Health plans, health care clearinghouses, health care providers that conduct standard transactions electronically, and their business associates | Individually identifiable health information in any form, electronic, paper or oral | Use or disclosure only as the Rule permits or as the individual authorizes in writing |
| GLBA Privacy Rule | Financial institutions | Nonpublic personal information collected in providing a financial product or service | Privacy notices, and an opt-out before most sharing with nonaffiliated third parties |
| FERPA | Schools and agencies that receive funds under U.S. Department of Education programs | Student education records | Written consent from a parent or eligible student before disclosing personally identifiable information, unless an exception applies |
| COPPA Rule | Operators of websites and online services directed to children under 13, or with actual knowledge they collect from them | Personal information collected online from children under 13 | Verifiable parental consent before collecting the information |
| FTC Act Section 5 | Most businesses in or affecting commerce (not nonprofits or common carriers) | Consumers against unfair or deceptive practices, including privacy and security practices | Data practices must match what the company told consumers |
What happened to the American Data Privacy and Protection Act?#
The American Data Privacy and Protection Act (ADPPA), H.R. 8152, was a 2022 bill for a comprehensive federal consumer privacy law that never received a House floor vote. It was introduced on June 21, 2022, and the House Energy and Commerce Committee reported it to the full House in December 2022, after which the 117th Congress ended without further action.
As drafted, it would have limited collection and transfer of personal data to what is reasonably necessary and proportionate, added protections for sensitive data, been enforced by the FTC and state attorneys general with a delayed private right of action, and generally preempted state laws covered by its provisions while preserving listed categories of state law.
Its successor proposal, the American Privacy Rights Act, was released as a discussion draft in April 2024 and introduced as H.R. 8818 in June 2024, building on elements of the ADPPA. Congress has not enacted either bill. If a federal law does pass, its preemption terms will decide how much of the state-law picture changes.
How do you tell which U.S. privacy laws apply to a set of records?#
Work from the records outward: the type of record and who collected it decide the federal law. State comprehensive privacy laws generally apply only above thresholds. California's CCPA, for example, covers for-profit businesses doing business in California that meet a revenue threshold, buy, sell or share personal information of 100,000 or more California residents or households, or earn half or more of their revenue from selling it.
Use these questions in order before records are prepared for any reuse:
- Did a health plan, clearinghouse or electronically billing provider (or its business associate) create the records? Start with HIPAA.
- Did a financial institution collect them while providing a financial product or service? Start with GLBA.
- Are they education records from a school that receives Department of Education funds? Start with FERPA.
- Were any collected online from children under 13? Check COPPA.
- Which states do the people in the records live in, and does the business meet each state law's thresholds?
- What did the privacy notices in force when the data was collected say about sharing and new uses? The FTC Act holds the company to them.
- Is the data truly de-identified under the standard of the law that applies? Removing names alone is usually not enough, and de-identification does not by itself grant the right to license the data.
Sources for this section
- H.R. 8152, the American Data Privacy and Protection Act, was introduced June 21, 2022 and reported by the House Energy and Commerce Committee to the Union Calendar in December 2022. Source
- The Congressional Research Service summarizes the ADPPA's data minimization duty, FTC and state attorney general enforcement, delayed private right of action and preemption of covered state laws. Source
- The Congressional Research Service describes the April 2024 American Privacy Rights Act draft as building on prior efforts and incorporating elements of the ADPPA. Source
- The text of H.R. 8818, the American Privacy Rights Act of 2024, as introduced in the 118th Congress in June 2024 and referred to the House Energy and Commerce Committee. Source
- HHS lists health plans, health care clearinghouses and providers that conduct standard transactions electronically as HIPAA covered entities and limits use or disclosure of protected health information to what the Privacy Rule permits or the individual authorizes in writing. Source
- The FTC explains that the GLBA Privacy Rule requires notices and an opt-out before most sharing of nonpublic personal information with nonaffiliated third parties. Source
- The Department of Education states that FERPA protects student education records at institutions receiving its program funds and generally requires written consent before disclosure. Source
- The FTC states that COPPA covers operators of sites and services directed to children under 13, or with actual knowledge of collecting from them, and requires verifiable parental consent before collection. Source
- The FTC reports that, in lieu of a general privacy law, Section 5 of the FTC Act is its primary privacy and data security authority, and that it cannot reach nonprofits or common carriers under Section 5. Source
- The California Attorney General lists the CCPA's thresholds, including buying, selling or sharing personal information of 100,000 or more California residents or households. Source
Frequently asked questions
Which privacy laws apply to records about people in United States?
No single federal privacy law; sector laws (HIPAA, GLBA, FERPA), the FTC Act and a growing number of state privacy laws. U.S. suppliers are SourceX's priority. State law depends on where the people in the records live.
Which rules decide what a U.S. business can license?
There is no single federal privacy law. Sector laws, the FTC Act and state privacy laws apply, and which state law applies depends on where the people in the records live. Personal details are removed before anything is shared.
What happens to records that cannot be cleared?
Records that can't be cleared under the rules that apply are excluded, and the company approves every release before data moves.
General information, not legal advice. Laws change and their application depends on your facts. SourceX assesses which rules apply deal by deal with your counsel. Last reviewed 2026-10-09.