← Lois sur la protection des données et la cybercriminalité par pays
United States : protection des données, cybercriminalité, amendes et peines
No general federal privacy law: enforcement is split among the FTC, SEC, HHS/OCR, NYDFS and state agencies, with 24 comprehensive state laws and high class-action exposure.
- Law
- No general federal law; sectoral laws (FTC Act §5, HIPAA, COPPA) and 24 state laws (e.g. CCPA/CPRA)
- Authority
- FTC, SEC, HHS/OCR, CPPA (California), NYDFS and state attorneys general
- Max fine
- Per violation, varies by law; CPPA record: US$1.35M; breach settlements up to US$700M (Equifax)
- Breach notification
- SEC 8-K: 4 business days after materiality; NYDFS: 72h (extortion payment 24h); CIRCIA (pending): 72h / 24h
- DPO
- —
Crimes
| Unauthorized access (CFAA) | 18 U.S.C. §1030 | Up to 1 year (simple first offense); up to 5 or 10 years (aggravated) |
| Cyber extortion | 18 U.S.C. §1030(a)(7) | Up to 5 years |
| Wire fraud | 18 U.S.C. §1343 | Up to 20 years |
| Identity theft | 18 U.S.C. §1028 | Up to 15 years |
| Aggravated identity theft | 18 U.S.C. §1028A | Mandatory consecutive 2 years |
Risks
- Post-breach class actions (settlements up to US$700M)
- Material incident disclosure to the SEC (8-K Item 1.05)
- Patchwork of 24 state laws with effective dates through 2028
- Children: COPPA and FTC actions (Cognosphere US$20M; Disney US$10M)
- Health: HIPAA risk-analysis failures (cited in every 2025 resolution)
- SEC 8-K Item 1.05 in force since 18 Dec 2023; incidents disclosed: 64 (2023), 55 (2024), 32 (2025)
- CIRCIA: final rule expected Sep 2026; publication unconfirmed as of 31 Oct 2026
- SECURE Data Act (H.R. 8413), introduced 22 Apr 2026: broad preemption, no private right of action; in committee
- TAKE IT DOWN Act (19 May 2025) and Homebuyers Privacy Protection Act (5 Sep 2025) enacted; 49 federal bills pending
- California: ADMT rules from 1 Jan 2027; initial risk assessments due 1 Apr 2028
- HIPAA 2025: 19 HHS/OCR actions, about US$6.7M
Source: White & Case – CPPA/Tractor Supply · Perkins Coie – FTC 2025 · Board Cybersecurity – SEC disclosures · Hunton – CIRCIA · IAPP – SECURE Data Act