The United States has no single federal privacy law; instead a growing patchwork of state laws led by California's CCPA/CPRA grants consumers rights to know, delete, correct and opt out of the sale or sharing of their personal information, alongside sector-specific federal rules.
19 of our 22 tracked controls apply in USA, graded by how firmly the law requires each one.
A published, current privacy notice giving the prescribed information.
Ability to find, correct and delete one person's data on request within the legal deadline.
Encryption in transit and at rest, least-privilege access, and access logging.
A written breach plan and knowledge of each market's notification clock.
DPAs with vendors handling your data, with controller/processor roles defined.
Explicit consent, tighter access, and often a DPIA for special-category data.
A living inventory of what personal data you hold, why, where it sits and where it flows.
A valid legal reason for each use of personal data, mapped per activity.
Where you rely on consent it is freely given, specific, informed, unbundled and withdrawable, with a record.
Defined, enforced retention periods and deletion, balancing storage-limitation and legal keep-periods.
Age assurance and verifiable parental consent; no behavioural tracking of children.
Cookie/tracker consent and an accurate cookie policy where required (esp. EU/UK).
Lawful basis/consent for e-marketing and an unsubscribe route.
A DPIA/impact assessment for high-risk processing; some markets require a filed dossier.
Safeguards and transparency for automated decision-making and profiling.
Card data offloaded to a compliant processor; PCI-DSS scope controlled.
A named person or role accountable for data protection, with published contact where required.
A published route to raise a privacy complaint; India requires a grievance officer.
Every export of personal data is covered by a lawful transfer mechanism.
Answer a few questions and PrivMatrix shows you exactly where you stand against CCPA/CPRA + states, then generates the policies, notices and registers that close each gap - written for USA.
