Data, privacy and safety
🔐 Privacy and Data Security Laws™
The federal and state privacy and data security laws in plain terms: what each one covers, who it binds, the rights it gives and how it is enforced, from the Privacy Act, HIPAA, GLBA, FERPA, COPPA and the wiretap laws to the state consumer privacy, biometric, health data and breach notice laws, with Idaho's statutes up close, every key term defined, real enforcement cases, and a short closing lesson on mitigation and best practices.
- 1The Terms and the MapHow U.S. privacy law is built from sector laws, state laws, FTC Section 5 and the Constitution, and the exact statutory meaning of the words that decide who owes what: personal information, PII, sensitive data, PHI, NPI, education records, consumer reports, breach versus incident, encryption safe harbor, controller and processor, consent, sale, data broker, de-identified data, assessments and notice deadlines.24 min
- 2The Privacy Act and Government RecordsHow the Privacy Act of 1974 governs federal agency files: systems of records, SORNs, the 13 disclosure exceptions, routine uses, access and amendment rights, damages after Doe v. Chao and FAA v. Cooper, computer matching, privacy impact assessments, the Social Security number rule, FOIA's privacy exemptions, the 2025 and 2026 lawsuits over DOGE access to Social Security data, the Driver's Privacy Protection Act and Idaho's motor vehicle and public records rules.25 min
- 3Health Privacy: HIPAA and BeyondHIPAA's Privacy, Security and Breach Notification Rules in depth: who is covered, what PHI is, minimum necessary, the patient's right of access, permitted disclosures, breach notice, the inflation-adjusted penalty tiers, state attorney general suits, OCR cases from Anthem to 2026 ransomware settlements, Change Healthcare, the vacated 2024 reproductive health rule, the stalled Security Rule update, 42 CFR Part 2, the FTC Health Breach Notification Rule, health data outside HIPAA, state health data laws, GINA and the 23andMe bankruptcy.27 min
- 4Money, Credit and Financial DataThe Fair Credit Reporting Act, FACTA's Red Flags and Disposal Rules, Gramm-Leach-Bliley and Regulation P, the FTC Safeguards Rule and its 30-day breach notice, SEC Regulation S-P, New York's Part 500, the CFPB's open banking rule, and the Equifax and Capital One cases.24 min
- 5Children and StudentsCOPPA and the FTC's 2025 rule amendments, the record COPPA penalties, FERPA and the student records rights it gives parents and students, the PPRA, state student privacy laws on the California SOPIPA model, the court fights over age-appropriate design codes and age verification, and where KOSA and COPPA 2.0 stand as of October 2026.24 min
- 6Wiretaps, Computers and CommunicationsThe Electronic Communications Privacy Act's three parts (the Wiretap Act, the Stored Communications Act and the Pen Register Act), one-party and all-party recording states, website tracking lawsuits under state wiretap laws, the Computer Fraud and Abuse Act after Van Buren, the Video Privacy Protection Act case now before the Supreme Court, and the TCPA and CAN-SPAM rules for calls, texts and email.25 min
- 7The FTC and Federal Security RulesHow the FTC turned Section 5 of the FTC Act into the country's main privacy and data security enforcer, what Wyndham, LabMD and AMG Capital did to its powers, the recent location data, facial recognition and connected car cases, and the other federal security rules: the SEC's four-business-day incident disclosure, CIRCIA's 72-hour reports, PADFA and the DOJ bulk data rule, the TikTok law, FCC carrier rules, the banking 36-hour rule, and the federal privacy bills that have and have not passed.26 min
- 8State Consumer Privacy LawsCalifornia's CCPA and its privacy agency, then every state with a broad consumer privacy law as of October 2026 (23 states, 19 in effect), with citations, effective dates, thresholds, cure periods and enforcers; the Virginia model and where states depart from it; universal opt-out signals; data broker registries and California's DROP; biometric laws in Illinois, Texas, Washington and Colorado; and the state enforcement cases so far.30 min
- 9Breach Notification Laws in All 50 StatesEvery state, D.C., Puerto Rico, Guam and the U.S. Virgin Islands requires notice when personal information is breached. The parts every law shares, where they split (definitions, harm tests, encryption, deadlines, regulator and credit bureau notice, private suits), a 51-row table built from the statutes, the federal overlays, how to read a breach letter, and what to do after one arrives.28 min
- 10Idaho Privacy Law Up CloseIdaho has no broad consumer privacy law as of October 2026. What it has is a stack of narrower statutes: the breach law at Idaho Code 28-51-104 to 107, the student data law at 33-133, the Consumer Protection Act, the wiretap and identity theft crimes, the Genetic Testing Privacy Act, the 2024 age verification law, the 2025 license plate reader law, the 2026 social media and digital ID laws, and the bills from 2023 to 2026 that passed and failed.30 min
- 11Mitigation and Best PracticesThe short closing lesson: what to do after a breach letter, how small businesses, nonprofits and campaigns can collect less, lock down accounts, encrypt, manage vendors and plan a response timed to the strictest law that applies, the frameworks to use, a one-page checklist, and the course's verified numbers in one place.18 min