United States

Requires a financial institution covered by the FTC's Safeguards Rule to notify the FTC as soon as possible, and no later than 30 days after discovery, of a security event involving unauthorized acquisition of unencrypted customer information affecting 500 or more consumers. The notification requirement in Section 314.4(j) took effect on May 13, 2024, per 16 CFR 314.5's own effective-date provision.

Requires a covered entity to notify each affected individual, and in some cases HHS and the media, following discovery of a breach of unsecured protected health information, without unreasonable delay and no later than 60 calendar days after discovery. First effective under a 2009 interim final rule; the 2013 Health Insurance Portability and Accountability Act (HIPAA) Omnibus Rule finalized these requirements with a general compliance date of September 23, 2013.

Prohibits U.S. persons from engaging in data-brokerage transactions involving bulk U.S. sensitive personal data or government-related data with a country of concern or covered person, and restricts, subject to required security measures, vendor, employment, and investment-agreement transactions that would give such a country or person access to bulk sensitive personal data, including biometric identifiers such as facial images or voice prints collected on more than 1,000 U.S. persons, or human genomic data on more than 100.

Requires operators of websites and online services directed to children under 13, or that have actual knowledge they are collecting personal information from such children, to give notice and obtain verifiable parental consent before collecting, using, or disclosing a child's personal information, and to give parents a means to review and delete it.

The FTC's 2025 amendments, effective June 23, 2025, add biometric identifiers, including voiceprints and facial templates, to the covered definition of personal information.

Prohibits unfair or deceptive acts or practices in or affecting commerce and empowers the FTC, not private plaintiffs, to investigate and enforce against them. This is the primary federal vehicle for privacy and data-security enforcement in the absence of a comprehensive statute, reaching misrepresentations about data collection or protection and unfair data practices that cause substantial, unavoidable consumer injury.

The Commission's 2023 Policy Statement on Biometric Information applies this authority to biometric identifiers, including those derived from photographs, videos, or voice recordings.

Restricts covered entities (health plans, health care clearinghouses, and most health care providers) and their business associates from using or disclosing protected health information except as the Rule permits or requires, and conditions most non-routine disclosures on individual authorization.

Its de-identification safe harbor is the one place federal law names biometric identifiers, including voice prints and full-face photographic images, as identifiers that must be stripped before health data is treated as de-identified.

Criminalizes the knowing nonconsensual publication of an intimate visual depiction of an identifiable individual, including an AI-generated depiction, and requires covered platforms to establish a process to remove such content within 48 hours of a valid request from the depicted individual or their representative, enforced by the FTC as an unfair or deceptive practice. The Act's criminal prohibition on nonconsensual publication took effect immediately upon its enactment on May 19, 2025.

The Section 3 platform notice-and-removal duty described by this row's own penalty and enforcement fields did not take effect until May 19, 2026, one year after enactment.

Prohibits a video tape service provider from knowingly disclosing a consumer's personally identifiable information about video-viewing history to a third party without informed, written consent, and arms an aggrieved consumer with a private right of action for statutory damages of at least $2,500, punitive damages, and attorneys' fees.

A 2013 amendment allowed ongoing consent through an electronic means, enabling social-media sharing features; the statute has driven a large wave of litigation since 2022 over website tracking-pixel disclosures of video-viewing activity.

The Computer Fraud and Abuse Act (CFAA) prohibits intentionally accessing a protected computer without authorization, or exceeding authorized access.

The Supreme Court held in Van Buren v. United States (593 U.S. 374, 2021) that exceeding authorized access is a gates-up-or-down inquiry into files or areas an existing permission structure puts off limits, not a purpose-based test, and the Ninth Circuit held in hiQ Labs v. LinkedIn (31 F.4th 1180, 2022) that without authorization does not reach a computer presumptively open to all comers, so a public, unauthenticated page has erected no gate at all.

The line runs through revocation: in Facebook v. Power Ventures (844 F.3d 1058, 9th Cir. 2016), discussed inside the hiQ opinion, liability attached once the scraper, after an individualized cease-and-desist, circumvented an IP block to keep reaching password-protected profiles. hiQ's own case did not end there: on remand it entered a stipulated consent judgment (N.D. Cal., filed Dec.

2022, secondary-sourced) holding it liable for breaching LinkedIn's User Agreement and for California trespass to chattels and misappropriation, for $500,000 and a permanent injunction, despite winning the CFAA claim outright. Section 1030 was added by the Counterfeit Access Device and Computer Fraud and Abuse Act of 1984, Pub.

L. 98-473, title II, § 2102(a); the without-authorization and exceeds-authorized-access language the courts above construe was already present in that original 1984 enactment, so the section dates to its original commencement rather than to the 1986 amendments that broadened its reach to protected computers generally.

Section 1201 prohibits circumventing a technological measure that effectively controls access to a copyrighted work. It functions as an escalation point rather than a scraping-specific rule: it is invoked once a target has put up a technical access barrier and a collector defeats it, the same fact pattern that also triggers Computer Fraud and Abuse Act (CFAA) and state computer-misuse exposure once notice and continued access or circumvention are shown, as in Facebook v. Power Ventures.

Section 1201 was added by title I of the Digital Millennium Copyright Act, Pub. L. 105-304, approved October 28, 1998; the anti-circumvention prohibition in subsection (a)(1)(A) itself carried a built-in two-year delayed effective date, so it did not bind conduct until October 28, 2000, the same window in which the Librarian of Congress ran the first rulemaking under subsection (a)(1)(C) to identify exempt classes of works.

The Comptroller of the Currency, the Federal Reserve Board, and the Federal Deposit Insurance Corporation issued this Computer-Security Incident Notification rule as one joint final rule, codified in parallel at 12 CFR Part 53 for the Comptroller, 12 CFR Part 225, Subpart N for the Board, and 12 CFR Part 304, Subpart C for the Corporation. For the Comptroller, a banking organization is a national bank, Federal savings association, or Federal branch or agency of a foreign bank.

For the Board, a banking organization is a bank holding company, savings and loan holding company, state member bank, the United States operations of a foreign banking organization, or an Edge or agreement corporation. For the Corporation, a banking organization is an insured state nonmember bank, insured state licensed branch of a foreign bank, or insured State savings association.

None of the three agencies treats a designated financial market utility as a banking organization or as a bank service provider. A bank service provider is a bank service company or other person that performs covered services under the Bank Service Company Act. A computer-security incident is any occurrence that results in actual harm to the confidentiality, integrity, or availability of an information system or the information the system processes, stores, or transmits.

A notification incident is a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, a banking organization's ability to carry out banking operations, activities, or processes, or to deliver banking products and services to a material portion of its customer base, a business line whose failure would result in a material loss of revenue, profit, or franchise value, or operations whose failure or discontinuance would threaten the financial stability of the United States.

A banking organization must notify its primary federal regulator about a notification incident as soon as possible and no later than 36 hours after the banking organization determines that a notification incident has occurred.

A bank service provider must separately notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible when the bank service provider determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to that banking organization for four or more hours.

This bank service provider notification duty does not apply to scheduled maintenance, testing, or a software update previously communicated to the banking organization customer. The rule's own regulatory text became effective on April 1, 2022. Both notification duties began binding their subjects on the May 1, 2022 compliance date.

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 is a federal statute enacted March 15, 2022 that would require a covered entity to report a covered cyber incident and a ransom payment to the Cybersecurity and Infrastructure Security Agency. A covered entity must report a covered cyber incident to the Agency not later than 72 hours after the covered entity reasonably believes the incident has occurred.

A covered entity that makes a ransom payment must report the payment to the Agency not later than 24 hours after the payment is made, even where the underlying attack is not itself a covered cyber incident. A covered entity must also submit a prompt supplemental report whenever substantial new information becomes available or a later ransom payment is made, continuing until the covered entity reports the incident concluded, and must preserve data relevant to the incident or payment.

The statute leaves the definition of covered entity, and the effective date of all four of these duties, to a final rule the Agency must issue. The Agency published a notice of proposed rulemaking on April 4, 2024 at 89 FR 23644, docket CISA-2022-0010, proposing to define covered entity by a small-business size standard or by one of several sector-based criteria across sixteen critical infrastructure sectors.

The statute required the Agency to issue the final rule not later than 18 months after that publication, a deadline of October 4, 2025, and the Agency has not met it. As of September 20, 2026 the Agency has not published a final rule, and its own published status page states that it continues to work on the final rule after multiple lapses in its own funding disrupted the rulemaking.

Until the final rule takes effect none of these four duties binds anyone, and the Agency asks entities only to volunteer cyber incident information in the meantime.

The proposed rule states that a cloud service provider or a managed service provider is not itself obligated to report merely because a compromise of its own systems caused the impact at a customer, since the reporting duty runs to the covered entity whose systems were affected rather than to the vendor, unless that vendor independently meets the covered-entity criteria in its own right.

An Securities and Exchange Commission (SEC) reporting company must describe, in its annual report under Regulation S-K Item 106, its processes for assessing and managing cybersecurity risk. It must also describe its board's and management's oversight of that risk. This duty applies beginning with annual reports for fiscal years ending on or after December 15, 2023. Under Item 1.05 of Form 8-K, the same company must determine, without unreasonable delay after discovering a cybersecurity incident, whether the incident is material.

If the incident is material, the company must file a Form 8-K describing it within four business days of that determination. The United States Attorney General may authorize a delay of up to 30 days, and a further 30 days, where disclosure would pose a substantial risk to national security or public safety, and in extraordinary circumstances a final 60 days where the continuing risk is to national security, up to 120 days in total.

Registrants other than smaller reporting companies had to comply with Item 1.05 from December 18, 2023, and smaller reporting companies from June 15, 2024.

The clause requires a contractor to provide adequate security on every covered contractor information system that processes, stores, or transmits covered defense information. For a system that is not part of an information technology service the government operates on its own behalf, that duty means implementing the safeguards in NIST Special Publication 800-171. The contractor must rapidly report a cyber incident, defined as reporting within 72 hours of discovery of the incident.

That report is made to the Department of Defense at its DIBNet portal, dibnet.dod.mil. Filing that report requires a DoD-approved medium assurance certificate. The contractor must preserve and protect forensic images of the affected information systems and related monitoring and packet-capture data for at least 90 days from the date it submits the cyber incident report.

Malicious software isolated in connection with a reported incident must be submitted to the Department of Defense Cyber Crime Center rather than to the contracting officer. The clause must be included without alteration in a subcontract that involves covered defense information or operationally critical support, including a subcontract for a commercial product or service.

A contractor using an external cloud service provider must require that provider to meet security requirements equivalent to the FedRAMP Moderate baseline and to comply with the clause's duties on incident reporting, malicious software, media preservation, forensic access, and damage assessment.

Requires separate verifiable parental consent for disclosing a child's personal information to third parties for targeted advertising, adds a text plus consent method, and expands recordkeeping and data retention limits. Operators had until April 22, 2026 to come into full compliance.

Requires operators of websites and online services directed to children under 13, or that have actual knowledge they collect data from a child under 13, to provide notice and obtain verifiable parental consent before collecting personal information.

Section 301 preempts all state law rights that are equivalent to the exclusive rights under the Copyright Act in works fixed in a tangible medium. Under Barclays Capital, most state hot-news misappropriation claims are preempted unless they contain genuine 'extra elements' beyond the act of copying and redistributing protected expression. There is no US federal press-publisher neighbouring right.

The EU-style ancillary copyright (Article 15 Digital Single Market (DSM) Directive) has no counterpart in US federal law, and § 301 blocks states from creating functional equivalents.

The federal fair-use statute is the primary framework for evaluating whether news aggregators, search engines, and AI training pipelines may reproduce copyrighted content without a license. Courts weigh four factors: purpose and character of the use (especially transformativeness), nature of the copyrighted work, amount and substantiality taken, and effect on the market for the original.

Commercial, non-transformative snippet aggregation that substitutes for licensed feeds fails fair use (Meltwater); transformative indexing and limited display may succeed (Google Books, Perfect 10).