Why there are so many privacy laws

Europe has one big privacy law. The US has a patchwork. As of the IAPP's late-2025 overview, Congress had not passed a comprehensive federal privacy law, and the IAPP, the main association for privacy professionals, noted that calls continue for it to do so. In the meantime, states have written their own rules.

The IAPP's state privacy overview, updated October 27, 2025, covers "each of the 19 states that have passed comprehensive privacy laws to date": California, Virginia, Colorado, Utah, Connecticut, Delaware, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, New Hampshire, New Jersey, Kentucky, Maryland, Minnesota, Nebraska and Rhode Island. Legislatures keep debating more, so check the IAPP's live legislation tracker for the current list.

What rights do these laws give people?

Details differ by state, including which businesses are covered, usually based on revenue or how many residents' data you handle. The IAPP summarizes the common core:

  • The ability to access, correct and delete personal data a company holds.
  • Opt-out rights for targeted or cross-contextual behavioral advertising, meaning ads based on what someone did on other sites and apps.
  • Opt-out rights for the sale of personal data and for profiling.
  • Business duties such as data protection assessments and honoring universal opt-out mechanisms, settings that send an opt-out automatically from a person's browser.
US adults who say there should be more regulation of company data use (2023)
  • All US adults72%
  • Democrats78%
  • Republicans68%

Each bar is the share of that group saying there should be more regulation of what companies can do with personal data than there is now.

Source: Pew Research Center

What California has fined companies for

The California Privacy Protection Agency, which now also calls itself CalPrivacy, is the most active state enforcer, and its cases read like a checklist of marketing mistakes. In March 2025, it ordered Honda to pay a $632,500 fine. The agency alleged Honda used a privacy tool that did not offer choices "in a symmetrical or equal way" and shared personal information with ad tech companies without the required contracts.

In September 2025, it ordered Tractor Supply to pay $1,350,000, which the agency called "the largest in the CPPA's history." Among the problems: no effective way to opt out of data sales and sharing, including through opt-out preference signals such as Global Privacy Control. The company must also scan its digital properties to inventory its tracking technologies.

The stakes add up quickly. California law allows a fine of up to $2,500 for each violation, or $7,500 for each intentional violation, plus an increase for inflation, and fines apply per violation.

What customers want

The pressure is not only legal. In Pew Research Center's 2023 survey, 72% of Americans said there should be more regulation of what companies can do with personal data than there is now; just 7% wanted less. The support crossed party lines: 78% of Democrats and 68% of Republicans agreed, as the chart below shows. Treating privacy well is less a legal chore than a way to keep customers' trust, which is the theme of our first-party data guide.

A practical checklist for marketers

This is not legal advice, and a privacy lawyer is worth the fee if you handle a lot of customer data. These steps cover the issues regulators have actually raised in recent cases. None of them requires new software, just attention and one person who owns the job:

  • List every pixel, tag and tracking tool on your site and in your apps. You can't control what you haven't inventoried.
  • Make opting out as easy as opting in. Equal-sized buttons, no extra steps for saying no.
  • Honor Global Privacy Control and similar browser signals as an opt-out of sale and sharing.
  • Have written contracts with ad tech vendors that limit how they use your customers' data.
  • Keep your privacy notice current, including for job applicants. If you also reach Europe, see Consent Mode and GDPR.
  • Limit who can see customer data inside your team. Matrix ROI, created by Smith App Studio, stores connection credentials encrypted and offers two-step sign-in, user roles and an audit trail.