Processes personal data, in the United States

15 U.S.C. Section 45 · Read the law's page

• Do not engage in unfair or deceptive practices when collecting, using, or sharing personal data.
• Assess foreseeable privacy harms before deploying a system that collects or uses biometric identifiers derived from photographs, videos, or voice recordings, and disclose material facts about that collection.

18 U.S.C. 2721 to 2725 · Read the law's page

• Do not knowingly obtain or disclose personal information from a motor vehicle record (a record of a motor vehicle operator's permit, title, registration or identification card issued by a department of motor vehicles) for any use the Act does not permit, and do not make a false representation to obtain it. Personal information does not include information on vehicular accidents, driving violations, and driver's status.
• Use such information only for a purpose section 2721(b) lists, for example use by a government agency, safety, recall and theft matters, verifying the accuracy of information an individual gave your business (and, if it is wrong, getting the correct information only to prevent fraud, pursue legal remedies or recover a debt or security interest against the individual), court and arbitral proceedings, research and statistical reports (so long as the information is not published, redisclosed or used to contact individuals), or a use for which you hold the individual's written consent.
• If you are an insurer, an insurance support organization or a self-insured entity (or its agent, employee or contractor), you may use personal information from a motor vehicle record in connection with claims investigation activities, antifraud activities, rating or underwriting under section 2721(b)(6), and for any other purpose only if another paragraph of section 2721(b) permits it.
• Do not use personal information from a motor vehicle record for bulk distribution for surveys, marketing or solicitations unless the State has obtained the express consent of the person to whom the information pertains (section 2721(b)(12)); express consent means consent in writing, including consent conveyed electronically that bears an electronic signature, and a recipient under section 2721(b)(12) may resell or redisclose the information only under that paragraph.
• If you resell or redisclose such information, do so only for a use section 2721(b) permits (but not for uses under section 2721(b)(11) or (12)), unless you obtained it under section 2721(b)(11), in which case you may resell or redisclose it for any purpose, or under section 2721(b)(12), in which case only as that paragraph permits; keep for 5 years records identifying each person or entity that receives it and the permitted purpose (a recipient under section 2721(b)(11) is exempt from that duty), and make the records available to the motor vehicle department on request.
• If you are a State department of motor vehicles, or an officer, employee or contractor of one, do not knowingly disclose or make available personal information obtained in connection with a motor vehicle record except as section 2721(b) permits, and do not disclose highly restricted personal information (a photograph or image, social security number, or medical or disability information) without the individual's express consent in writing, except for the uses in section 2721(b)(1), (4), (6) and (9).when it serves a public body

Protecting Americans' Data from Foreign Adversaries Act of 2024, 15 U.S.C. 9901 · Read the law's page

• Do not, as a data broker, sell, license, rent, trade, transfer, release, disclose, provide access to, or otherwise make available personally identifiable sensitive data of a United States individual to any foreign adversary country.
• Do not, as a data broker, make that data available to any entity that is controlled by a foreign adversary, which includes an entity in which a foreign person organized in, headquartered in, or domiciled in a foreign adversary country directly or indirectly owns at least a 20 percent stake.
• The prohibition does not apply to an entity to the extent it transmits data at the request or direction of the individual, offers a product or service in which sensitive data, or access to it, is not the product or service, reports or publishes news or information of public interest or available to the general public other than an obscene visual depiction, or acts as a service provider.

12 CFR Part 1033 · Read the law's page

• If you are a data provider (a financial institution, a card issuer, or any other person that controls or possesses information about a Regulation E account, a Regulation Z credit card, or the facilitation of payments from either), make covered data available on request to the consumer and to an authorized third party in an electronic form they can use, including the most recently updated data you hold and information about authorized transactions not yet settled (12 CFR 1033.111, 1033.201(a), (b)).
• Maintain a consumer interface and a developer interface, make covered data available in a machine-readable file on request, and impose no fee or charge on a consumer or an authorized third party for the interfaces or for requests (12 CFR 1033.301(a) to (c)).
• Take no action with the intent of evading the rule, and no action you know or should know is likely to render covered data unusable or to prevent, interfere with, or materially discourage a consumer or authorized third party from accessing it (12 CFR 1033.201(a)(2)).
• If you are a third party seeking access to covered data on a consumer's behalf, give the consumer an authorization disclosure that is clear, conspicuous and segregated from other material, certify in it that you agree to the third party obligations, and obtain the consumer's express informed consent, signed electronically or in writing (12 CFR 1033.401, 1033.411).
• Limit your collection, use and retention of covered data to what is reasonably necessary to provide the consumer's requested product or service; targeted advertising, cross-selling of other products or services, and the sale of covered data are not reasonably necessary (12 CFR 1033.421(a)).
• Stop collecting covered data one year after the consumer's most recent authorization unless the consumer gives a new authorization no later than the anniversary of the most recent one (12 CFR 1033.421(b)).
• Apply to your systems for the collection, use and retention of covered data an information security program that satisfies the Gramm-Leach-Bliley Act safeguards rules or, if you are not subject to them, the Federal Trade Commission's Standards for Safeguarding Customer Information, 16 CFR part 314 (12 CFR 1033.421(e)).
• Give the consumer a method to revoke your authorization that is as easy to access and operate as the initial authorization, and notify the data provider, any data aggregator and other third parties holding the consumer's covered data when you receive a revocation request (12 CFR 1033.421(h)).

28 CFR Part 202 · Read the law's page

• Do not engage in a prohibited bulk data-brokerage transaction involving bulk U.S. sensitive personal data, including biometric identifiers such as facial images or voice prints, or government-related data, with a country of concern or covered person.
• Apply the required security safeguards to a restricted vendor, employment, or investment transaction that would give a country of concern or covered person access to that data.
• Treat data as in scope even when it is anonymized, pseudonymized, de-identified or encrypted: a collection of sensitive personal data counts toward the bulk threshold in any of those forms (28 CFR 202.206).

Pub. L. 119-36 (Homebuyers Privacy Protection Act), adding 15 U.S.C. 1681b(c)(4) · Read the law's page

• If you are a consumer reporting agency, do not furnish a consumer report to another person on the strength of a request made in connection with a credit transaction involving a residential mortgage loan unless the transaction consists of a firm offer of credit or insurance and that person has certified its authorization from the consumer, or has originated or services a current residential mortgage loan of the consumer, or is an insured depository institution or credit union holding a current account for the consumer (15 U.S.C. 1681b(c)(4)).

15 U.S.C. 1681 et seq. · Read the law's page

• If you assemble or evaluate consumer information to furnish consumer reports to third parties, furnish a consumer report only under the circumstances section 1681b(a) lists, and follow reasonable procedures to assure maximum possible accuracy of the information in it.
• If you are a consumer reporting agency, disclose to a consumer on request the information in the consumer's file, and when the consumer disputes an item, conduct a reasonable reinvestigation free of charge before the end of the 30-day period that begins when you receive the notice, which extends by not more than 15 additional days if you receive relevant information from the consumer during that period.
• If you use or obtain a consumer report, do so only for a purpose section 1681b authorizes and certify that purpose; before procuring a report for employment purposes, make a clear and conspicuous written disclosure in a document that consists solely of the disclosure and get the consumer's written authorization, unless the transportation-applicant procedure in section 1681b(b)(2)(B) applies.
• If you use a consumer report for employment purposes and intend to take adverse action based on it, first give the consumer a copy of the report and a written description of the consumer's rights under the Act, unless the transportation-applicant procedure in section 1681b(b)(3)(B) applies.
• If you take adverse action based in whole or in part on a consumer report, give the consumer notice of the action, disclosure of any numerical credit score you used in taking it, the name, address and telephone number of the agency that furnished the report, a statement that the agency did not make the decision, and notice of the consumer's right to a free copy of the report and to dispute its accuracy.
• If you furnish information to a consumer reporting agency, do not furnish information you know or have reasonable cause to believe is inaccurate, and when the agency notifies you of a dispute, investigate, report the results, and modify, delete or permanently block an item found inaccurate, incomplete or unverifiable.
• Applies to a consumer reporting agency, to a person that uses a consumer report, and to a person that furnishes information to a consumer reporting agency; a consumer report is a communication of information bearing on a consumer's credit worthiness, character or mode of living that is used as a factor in eligibility for credit, insurance, employment or another purpose section 1681b authorizes.

S. 2367, 119th Congress · Read the law's page

• Do not appropriate, use, collect, process, sell, or otherwise exploit an individual's covered data, in or affecting interstate or foreign commerce, without the individual's express, prior consent (Section 3(a)).
• Do not train a generative artificial intelligence system that you sell, rent, license, or otherwise use on an individual's covered data without that individual's express, prior consent, and do not generate covered data pertaining to an individual, including content that imitates, replicates, or is substantially derived from the individual's covered data, without it (Section 2(1) with Section 3(a)).
• Treat covered data as information that can reasonably be linked to a specific individual, information derived, inferred, or generated from it, and material the individual created that is protected by copyright whether or not it is registered (Section 2(4)).
• Obtain consent as a clear, affirmative act made in advance, freely given, informed, and unambiguous, for the specific use (Section 2(5)); consent obtained through coercion or deception, or as a condition of using a product or service where the use exceeds what is reasonably necessary to provide it, is not valid (Section 3(b)(3)(B)).
• Where covered data goes to or is used by a third party, specifically and clearly disclose each third party to the individual when consent is sought, present the disclosure distinctly and separately from any privacy policy or terms of service, and do not rely on a hyperlink or a general reference to a privacy policy (Section 3(d)).
• Do not rely on a predispute arbitration agreement or a predispute joint-action waiver to avoid a claim under the Act; neither is valid or enforceable for it (Section 3(c)).

S. 2925, 119th Congress · Read the law's page

• Track the MIND Act of 2025 (S. 2925), which would direct the Federal Trade Commission to study the governance of neural data and other related data that can reveal an individual's mental state; the bill as introduced sets the study and report and states no duty for a business that handles such data.