Agent WranglersUS privacy and AI laws
US state privacy laws differ from the GDPR in scope, sales, sensitive data and deadlines. Federal health and state AI rules add more. Keep them as data.
- Required 5
- Recommended 4
Required
List every sale and every share
CMP-57 US lawList every flow of personal data to another company that could count as a sale or targeted advertising. Offer an opt-out that stops each one.
Ask before using sensitive data
CMP-58 US lawProcess sensitive data only after an opt-in where any applying state requires it, and record each consent with its time and wording.
Give notice and an appeal before automated decisions
CMP-67 US lawBefore software alone decides on credit, housing, education, work or health care, tell people in advance. Let them get an explanation and appeal to a person.
Report health data leaks under the FTC rule when HIPAA does not cover you
CMP-77 US lawIf your app holds health data on US users and HIPAA does not cover you, treat any disclosure without the person's authorisation as a breach. Notify the people and the FTC within 60 days of finding it.
Process California deletion requests from DROP every 45 days
CMP-78 US-CA lawIf you sell personal data of people you have no direct relationship with, register as a data broker in California each January. Fetch and process the deletion requests in DROP at least every 45 days.
Recommended
Compute which state laws apply
CMP-56 US lawKeep a table of the US state privacy laws with their thresholds and start dates. Compute from your facts file which ones apply to you.
Track request deadlines by law
CMP-59 EU, US lawCompute the due date of every privacy request from the law that applies to the person. Offer the appeal step that US state laws require.
Assess risky processing for US laws too
CMP-60 US lawWrite a data protection assessment before targeted advertising, selling data, profiling with large effects or using sensitive data, in every state that asks for one.
Keep the US breach notice laws as data
CMP-61 US lawKeep a table of the breach notice law of every US state where affected people live. Compute each deadline and each notice to a regulator from it.
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws">Agent Wranglers compliance and governance playbook</a>. In code you write, add a comment next to it with the same link.