United States privacy law

United States privacy law
Name	United States privacy law
Jurisdiction	United States
Established	1890 (tort concept) – ongoing
Key legislation	Fourth Amendment; Privacy Act of 1974; Health Insurance Portability and Accountability Act of 1996; Gramm–Leach–Bliley Act; Children's Online Privacy Protection Act of 1998; Electronic Communications Privacy Act of 1986; California Consumer Privacy Act
Notable cases	Katz v. United States; Riley v. California; Carpenter v. United States; Smith v. Maryland; Whalen v. Roe
Related topics	Surveillance; Intelligence Community; Consumer protection; Data breach notification laws

United States privacy law United States privacy law comprises a mosaic of constitutional doctrines, federal statutes, state legislation, common-law torts, and administrative rules that structure personal information protection. Rooted in nineteenth-century torts and the Fourth Amendment, the field intersects with landmark decisions from the Supreme Court of the United States, statutory regimes shaped by Congress, and a proliferation of state initiatives exemplified by California Proposition 24 (2020) and the Virginia Consumer Data Protection Act. Scholars, courts, agencies, and interest groups including the American Civil Liberties Union, Electronic Frontier Foundation, Federal Trade Commission, and major technology companies drive ongoing doctrinal evolution.

Overview and Legal Foundations

Early doctrinal foundations trace to scholarly work by Samuel D. Warren and Louis Brandeis and tort developments like intrusion upon seclusion, appropriation, public disclosure of private facts, and false light adjudicated in state courts such as New York Court of Appeals. Constitutional underpinnings derive from the Fourth Amendment to the United States Constitution and related decisions by the Supreme Court of the United States including Olmstead v. United States, Katz v. United States, and United States v. Jones. Administrative frameworks arise under agencies such as the Federal Trade Commission, Department of Health and Human Services, Federal Communications Commission, and Securities and Exchange Commission, each enforcing sectoral statutes and adjudicating privacy-related regulatory actions.

Federal Privacy Statutes

Congress has enacted sector-specific statutes like the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Gramm–Leach–Bliley Act (GLBA), the Family Educational Rights and Privacy Act (FERPA), the Children's Online Privacy Protection Act of 1998 (COPPA), and the Video Privacy Protection Act. Electronic surveillance and communications are governed by the Electronic Communications Privacy Act of 1986 (ECPA), the Stored Communications Act, and amendments via the USA PATRIOT Act. Records access and government handling are further constrained by the Privacy Act of 1974 and disclosures regulated under the Freedom of Information Act. Financial privacy, healthcare privacy, education records, and cable subscriber protections reflect congressional choices balancing industry regulation with individual rights.

State Privacy Laws and Variations

States have developed diverse regimes: California Consumer Privacy Act (CCPA) and subsequent amendments under California Privacy Rights Act created broad consumer rights; Virginia Consumer Data Protection Act and Colorado Privacy Act enacted comprehensive frameworks; New York SHIELD Act and Massachusetts Data Privacy Law emphasize data security. State tort law, exemplified by cases in California Supreme Court and New York Court of Appeals, preserves intrusion and publicity claims. States also maintain breach notification statutes such as California Civil Code § 1798.82 and sectoral rules for health, finance, and education administered by entities like the New York Department of Financial Services and Massachusetts Attorney General.

Privacy in Criminal Procedure and Fourth Amendment

Criminal-procedure privacy doctrine centers on searches and seizures under the Fourth Amendment to the United States Constitution as construed in decisions like Katz v. United States, Riley v. California, and Carpenter v. United States. Doctrines such as probable cause, reasonable expectation of privacy, warrant requirements, exigent circumstances, and third-party doctrine—examined in Smith v. Maryland and critiqued in scholarly responses—shape law-enforcement collection of data. Procedural safeguards interact with statutory authorities including the Foreign Intelligence Surveillance Act of 1978 (FISA) and judicial oversight by the Foreign Intelligence Surveillance Court and district courts.

Data Protection, Consumer Privacy, and Sectoral Regulation

Data-protection approaches reflect sectoral regulation in HIPAA, GLBA, COPPA, and trade-regulatory enforcement by the Federal Trade Commission Act under the Federal Trade Commission. Industry self-regulation and codes from groups like the Interactive Advertising Bureau and standards-setting by National Institute of Standards and Technology influence practice. Private-sector initiatives by Microsoft Corporation, Google LLC, Facebook, Inc. (Meta Platforms), Apple Inc., Amazon.com, Inc., and major telecommunications carriers interact with statutory duties and enforcement actions by state attorneys general and federal agencies.

Surveillance, Intelligence, and National Security Exceptions

Intelligence-collection regimes under FISA and post-9/11 statutes including provisions of the USA PATRIOT Act and amendments debated in Congress involve national-security exceptions to ordinary privacy protections. Agencies such as the National Security Agency, Central Intelligence Agency, and Federal Bureau of Investigation operate under statutory authorities and oversight from the Privacy and Civil Liberties Oversight Board, congressional committees such as the House Permanent Select Committee on Intelligence, and political oversight by the President of the United States. Revelatory litigation involving whistleblowers like Edward Snowden and congressional inquiries have catalyzed reform efforts and public debate.

Enforcement, Remedies, and Litigation Trends

Enforcement occurs through federal agencies—principally the Federal Trade Commission and Department of Justice—state attorneys general including the California Attorney General and New York Attorney General, private class actions under state statutes, and constitutional litigation before the Supreme Court of the United States and circuit courts such as the Second Circuit Court of Appeals and Ninth Circuit Court of Appeals. Remedies include injunctive relief, statutory penalties under laws like CCPA and GLBA, civil damages in tort suits, and criminal sanctions under statutes such as ECPA when applicable. Recent trends feature algorithmic-systems scrutiny involving European Union–United States Privacy Shield disputes, cross-border data flows examined in litigation with multinational firms, and increasing legislative activity at state and federal levels spurred by advocacy from organizations like the Electronic Frontier Foundation and the American Civil Liberties Union.

Category:Privacy law