CIPP/US key terms

A U.S. regulatory model in which separate laws govern specific industries or data types, such as health, financial, or children's information, rather than one comprehensive statute covering all personal data.

The part of the Federal Trade Commission Act that prohibits unfair or deceptive acts or practices in commerce; the FTC uses it to enforce privacy promises and challenge deceptive data practices and unreasonable security.

A set of widely referenced privacy principles-including notice, choice, access, security, and accountability-that guide many privacy laws and corporate privacy programs, though they are not self-executing in the U.S.

A federal statute governing how federal agencies collect, maintain, use, and disclose records about individuals, including access and correction rights and limits on disclosure without consent.

Four traditional civil claims-intrusion upon seclusion, public disclosure of private facts, false light, and appropriation-that allow individuals to sue over privacy harms independent of statutes.

A legal standard asking whether a person showed an actual subjective expectation of privacy and whether society recognizes that expectation as reasonable; used in Fourth Amendment and tort analysis.

A federal law requiring financial institutions to safeguard customer information, provide privacy notices, and limit certain disclosures; enforced largely by federal financial regulators and the FTC.

Federal regulations protecting individually identifiable health information held by covered entities and business associates, setting rules for use, disclosure, safeguards, and patient rights.

A federal law requiring parental consent and special protections for personal information collected online from children under 13, enforced by the FTC and state attorneys general.

A privacy framework in which organizations tell consumers what data they collect and how it is used, then offer choices such as opt-in or opt-out consent for certain uses or disclosures.

The principle that personal information should be collected for specified, legitimate purposes and not used or disclosed inconsistently with those purposes without additional justification or consent.

The principle that organizations should collect and retain only personal information that is adequate, relevant, and necessary for a stated purpose, reducing privacy and security risk.

Online advertising targeted to users based on inferred interests from browsing or app activity across sites or over time, often relying on cookies or device identifiers.

A browser or device signal that communicates a user's opt-out preference for the sale or sharing of personal information and sometimes targeted advertising, recognized by some state laws.

User-interface designs that manipulate or trick people into making choices they would not otherwise make, such as hard-to-find opt-outs or confusing consent flows.

Categories of personal information considered especially sensitive-such as health, biometric, precise geolocation, racial or ethnic origin, religious beliefs, or sexual orientation-that often trigger heightened consent or protection.

A company that collects personal information about consumers from various sources and sells, licenses, or discloses it to other parties, often without a direct consumer relationship.

A legal and regulatory standard requiring organizations to implement safeguards proportionate to the sensitivity of data and risks they face, often enforced through FTC actions and breach litigation.

The constitutional protection against unreasonable searches and seizures by government actors, requiring warrants supported by probable cause in many circumstances and underpinning many privacy disputes.

A court order authorizing a search or seizure, typically requiring probable cause and particularity, and often needed for government access to the contents of communications or private places.

A legal demand for documents or testimony issued by a court, agency, or grand jury, generally subject to relevance and sometimes notice requirements rather than probable cause.

A federal statute within ECPA that restricts voluntary and compelled disclosure of stored electronic communications and records by service providers, with different rules for content and non-content data.

A federal framework that includes the Wiretap Act, Stored Communications Act, and Pen Register Act, regulating interception of and access to electronic communications.

A federal statute prohibiting intentional interception of wire, oral, or electronic communications unless an exception or valid court order applies, with criminal and civil penalties.

A legal principle holding that people generally lack a reasonable expectation of privacy in information they voluntarily share with third parties, such as banks or phone companies.

A Supreme Court decision holding that government acquisition of historical cell-site location records over an extended period is a search requiring a warrant or exception.

An administrative subpoena issued by the FBI in national security investigations to obtain certain records, usually accompanied by a nondisclosure requirement.

Employer practices of observing or recording employees' work activity, communications, location, or device use, generally lawful if disclosed and reasonably related to legitimate business needs.

A workplace arrangement in which employees use personal devices for work, raising issues about employer access, privacy expectations, security controls, and remote wiping.

An employer's inspection of employee desks, lockers, devices, or communications, generally permitted but constrained by company policy, consent, and reasonable expectations of privacy.

A federal law protecting employees' rights to engage in concerted activity about working conditions, which can limit employer monitoring and discipline related to protected communications.

A federal law generally prohibiting private employers from requiring lie detector tests, with narrow exceptions for security services and ongoing investigations.

State laws that prevent employers from demanding applicants' or employees' social media credentials or requiring them to log in in the employer's presence, with limited exceptions.

Employer inquiries into a candidate's criminal, employment, credit, or other history, often regulated by the FCRA and state laws requiring notices, consent, and fair-chance procedures.

California's comprehensive privacy law, as amended by the CPRA, granting consumers rights to know, delete, correct, and opt out of sale or sharing, with limited private action for breaches.

A comprehensive state privacy law establishing controller and processor duties, consumer rights, opt-out rights, and exemptions, enforced by the attorney general without a private right of action.

A comprehensive state privacy law granting consumers rights and imposing duties on controllers, including data protection assessments and opt-out rights, with attorney general enforcement.

Roles describing an entity that determines the purposes and means of processing personal data (controller) and one that processes data on the controller's behalf (processor), with different legal duties.

Defined broadly in some state laws as exchanging personal information for monetary or other valuable consideration, triggering opt-out and disclosure obligations.

A state law requiring notice, written consent, retention limits, and security for biometric identifiers and information, with a private right of action for violations.