The more connected we become, the more data we continue to share, sell, or allow to be processed about us. Every time you access the internet and input or view sensitive information\u2014whether checking health information, paying bills, or tagging your location on social media\u2014you\u2019re generating data that can be collected and brokered across services and devices.<\/p>\n\n\n\n
According to a national study, Pew Research Center<\/a> finds that 81% of U.S. adults say they have very little or no control over the data companies collect about them and 79% are concerned<\/a> about how companies use that data. In a time when our lives are so heavily entwined with the internet<\/a>, knowing what\u2019s done with the data you share is critical.<\/p>\n\n\n\n Landmark security breaches remind us how vulnerable our data really is. Equifax<\/a>, one of the top three credit reporting<\/a> agencies, disclosed a data breach that exposed Social Security numbers, names, addresses, and driver\u2019s license numbers; information was compromised for 147 million people<\/a>, along with 209,000 customer credit card numbers. Given the severity and importance of the information leaked, the Equifax breach is regarded as unprecedented in impact. The settlement reached with the Federal Trade Commission amounted to $425 million<\/a> to be paid out to help people who were affected. More recently, 2024 brought disruptive ransomware and third\u2011party cloud incidents that affected U.S. healthcare services and exposed large telecom and entertainment datasets, underscoring how a single vendor or platform can create downstream risk across entire ecosystems.<\/p>\n\n\n\n Facebook has experienced a series of security issues, which has resulted in federal scrutiny. In recent years, the user data of large caches of users<\/a> was exposed on Amazon\u2019s cloud computing services. It was also revealed that Facebook had data-sharing partnerships with more than 150 companies<\/a> that people were not aware of. In research by the Pew Research Center<\/a>, people spoke negatively about the consequences of sharing data and cited that companies could have an ulterior motive for collecting their data. Regulators have since increased enforcement attention on sensitive datasets like precise location and detailed browsing data, especially when collected or sold by data brokers without clear consent.<\/p>\n\n\n\n There is no single catch-all data privacy law. Instead, there are a mixture of federal and state laws<\/a> that address different aspects of data protection. In the absence of a comprehensive federal consumer privacy statute, individual states have enacted their own laws protecting residents\u2014many of which took effect in 2024\u20132025 and continue to expand consumer rights and opt-outs. There is still a lot of ground that needs to be covered to ensure that American consumers are completely protected.<\/p>\n\n\n\n Do you ever wonder why things like Facebook or Instagram are free? You pay in privacy. These types of online services are free of monetary charge because they collect your data<\/a> in exchange for their hosted services. Today, consumer expectations are higher: global research shows majorities will avoid brands they don\u2019t trust with data, and many have switched providers over data practices. In the U.S., Pew Research Center<\/a> finds most adults feel they have little or no control over companies\u2019 data collection and are concerned about how their data is used.<\/p>\n\n\n\n The California Consumer Privacy Act<\/a> empowers residents with rights to know, access, delete, and opt out of the sale or sharing of personal information, with additional protections strengthened by subsequent amendments. California also recognizes browser-based global privacy controls to effect certain opt-outs. Similar comprehensive privacy laws in many other states now provide access, deletion, correction, portability, and opt-outs for targeted advertising, sale, and certain profiling\u2014expanding across the country through 2025.<\/p>\n\n\n\n One of the only inclusive data privacy laws is concerned with children\u2019s online privacy<\/a>. Children\u2019s Online Privacy Protection Act (COPPA) is a federal law that prohibits the collection of data from children who are under 13 years old. This means that parents have control over the information the companies can have and can request that any collected data be deleted. The FTC has also proposed updates to strengthen the COPPA Rule\u2019s data minimization, retention, and consent requirements.<\/p>\n\n\n\n TikTok paid $5.7 million<\/a> to the FTC over concerns that the video app was in violation of COPPA<\/a>. The largest children\u2019s privacy civil penalty to date at the time, TikTok was accused of illegally collecting personal information from children without parental consent. In addition to the substantial settlement, TikTok was required to update its practices and remove all videos that are made by children under the age of 13. TikTok is only one example; regulators have also brought significant actions against other platforms and devices handling children\u2019s data, including cases involving Google and YouTube, as well as actions targeting deceptive design and unlawful retention.<\/p>\n\n\n\n There are only a handful of states that have laws governing consumer privacy when it comes to e-readers. These laws prohibit entities from collecting or sharing information regarding the type of material being rented or bought using the e-reader. Within the states that have laws pertaining to e-readers, most have focused on information that can be gathered by public entities like libraries. However, efforts are being made to protect the privacy of the content people choose to read on their electronic devices. The Electronic Frontier Foundation took the time to comb through the popular e-book platforms\u2019 privacy policies to give you the answers you\u2019ve been searching for<\/a>.<\/p>\n\n\n\n Consumers are seeing changes when it comes to online services and privacy data. Companies are now more transparent about their data practices and, in several states, are required to honor browser-based universal opt-out signals for sales\/sharing or targeted advertising. Many people take steps to maintain their online privacy\u2014clearing cookies, using a virtual private network, and encrypting their email, for example\u2014but Pew Research Center<\/a> also finds that Americans feel a lack of control and remain concerned about how companies use their data. Still, many say<\/a> they want to do more to protect themselves.<\/p>\n\n\n\n While businesses collecting and sharing your information is nothing new, recent changes require that companies clearly inform you of what their intentions are when collecting that information. The reason why the company collects your data will vary, though generally companies use it to<\/a> improve customer experience, assess their marketing strategy, or make money. The relationship around data privacy is a give and take between both consumers and data collectors. Businesses must be held accountable for the data privacy methods they have in place and be transparent about how they use the data they harvest. It\u2019s also imperative that consumers know their rights and ability to impact how companies collect and use their information.<\/p>\n\n\n\n Generally, the biggest concern when recording phone calls is consent. Many states are one-party consent states, meaning that phone calls can be recorded as long as one person consents. But what is considered consent? Think about when you call a customer service line and hear the ever-identifiable \u201cthis call may be monitored or recorded\u2026\u201d message. When a caller continues with the call, many states take that as implied consent.<\/p>\n\n\n\n Some states require both parties to consent to the recording. Sometimes regardless of which law the state follows, there are exceptions to the rules. Which include<\/a>: police recordings, court orders, and emergency services.<\/p>\n\n\n\n Every single state has a data breach notification law<\/a> in place, and many states are actively amending<\/a> their laws and expanding the definitions they hold. States like New Jersey, New York, and Oregon have broadened the scope of what is protected and established what regulations they impose on companies. Breach notification laws require that companies notify consumers of any data breaches involving personal or otherwise identifying information. Each law has a specified time frame in which action needs to be taken.<\/p>\n\n\n\n Data disposal laws<\/a> are concerned with what happens to your information when the company no longer wants to store it. To prevent unauthorized access, both government and private agencies are required to destroy or make indecipherable information in consumer reports. The Federal Trade Commission has impressed a disposal rule<\/a> that outlines what the rule applies to and what constitutes proper disposal. Proper disposal of consumer records should be a part of every company\u2019s security program.<\/p>\n\n\n\n Understandably, the mashup of federal and state laws can be hard to navigate. This table can help you break it down.<\/p>\n\n\nWhy it matters<\/h3>\n\n\n\n
Federal Laws<\/h2>\n\n\n\n
Types of Data Privacy Laws<\/h2>\n\n\n\n
Consumer privacy<\/h3>\n\n\n\n
Children\u2019s online privacy<\/h3>\n\n\n\n
E-reader<\/h3>\n\n\n\n
Online services<\/h3>\n\n\n\n
Information sharing by business<\/h3>\n\n\n\n
Notice when recording phone calls<\/h3>\n\n\n\n
Breach notification laws<\/h3>\n\n\n\n
Data disposal<\/h3>\n\n\n\n