Introduction to the U.S. Privacy Environment
The sectoral baseline
The U.S. has no single omnibus privacy law. It regulates by sector and by actor: health (HIPAA), financial services (GLBA), education (FERPA), children's data (COPPA), and credit reporting (FCRA). The FTC Act Section 5 fills gaps by prohibiting deceptive and unfair practices, but it is not a general privacy code.
Constitutional and common-law roots
The Constitution contains no express privacy right. Fourth Amendment protection applies only to government action and turns on the Katz reasonable-expectation-of-privacy test. Common law recognizes four privacy torts: intrusion upon seclusion, public disclosure of private facts, false light, and appropriation of name or likeness. State constitutions (for example, California Article I, Section 1) can create broader rights.
The Privacy Act of 1974 governs federal agency records. Fair Information Practice Principles (notice, choice, access, security) inform U.S. law but do not bind private firms directly. Cross-border transfers rely on contracts, such as standard contractual clauses, and the EU-U.S. Data Privacy Framework.
Traps
Candidates wrongly assume GDPR-style omnibus duties; apply the Fourth Amendment to private employers or retailers; mix up the four torts; treat FTC guidance as a statute carrying civil penalties for first violations; and forget that sectoral means industry-specific.
Worked example
A retailer's loyalty program promises it never shares purchase data with third parties, then sells the data. No sector statute applies. The promise is a material representation, so the sale is likely deceptive under Section 5. Rule of thumb: identify the actor, the data type, and the sector first; if none applies, ask whether a promise was broken (deception) or a harm was unavoidable (unfairness).