--- title: "US privacy and AI laws · Agent Wranglers" url: https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws parts: 9 tokens_total: 8355 updated: 2026-10-27 build: a2a6bdfed830 tokens: 1071 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # US privacy and AI laws For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Compliance and governance](https://agentwranglers.se/playbook/compliance.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. > US state privacy laws differ from the GDPR in scope, sales, sensitive data and deadlines. Federal health and state AI rules add more. Keep them as data. **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers compliance and governance playbook`. In code you write, add a comment next to it with the same link. ## Required - CMP-57 [List every sale and every share](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/sales-and-sharing-inventory.md) · 1,152 tokens · updated 2026-10-27 List every flow of personal data to another company that could count as a sale or targeted advertising. Offer an opt-out that stops each one. - CMP-58 [Ask before using sensitive data](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/us-sensitive-data-consent.md) · 646 tokens · updated 2026-10-27 Process sensitive data only after an opt-in where any applying state requires it, and record each consent with its time and wording. - CMP-67 [Give notice and an appeal before automated decisions](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/automated-decision-rights.md) · 1,131 tokens · updated 2026-10-27 Before software alone decides on credit, housing, education, work or health care, tell people in advance. Let them get an explanation and appeal to a person. - CMP-77 [Report health data leaks under the FTC rule when HIPAA does not cover you](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/health-breach-notification.md) · 778 tokens · updated 2026-10-27 If your app holds health data on US users and HIPAA does not cover you, treat any disclosure without the person's authorisation as a breach. Notify the people and the FTC within 60 days of finding it. - CMP-78 [Process California deletion requests from DROP every 45 days](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/california-data-broker-drop.md) · 754 tokens · updated 2026-10-27 If you sell personal data of people you have no direct relationship with, register as a data broker in California each January. Fetch and process the deletion requests in DROP at least every 45 days. ## Recommended - CMP-56 [Compute which state laws apply](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/us-state-scope.md) · 820 tokens · updated 2026-10-27 Keep a table of the US state privacy laws with their thresholds and start dates. Compute from your facts file which ones apply to you. - CMP-59 [Track request deadlines by law](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/request-deadlines-by-law.md) · 1,029 tokens · updated 2026-10-27 Compute the due date of every privacy request from the law that applies to the person. Offer the appeal step that US state laws require. - CMP-60 [Assess risky processing for US laws too](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/us-risk-assessments.md) · 661 tokens · updated 2026-10-27 Write a data protection assessment before targeted advertising, selling data, profiling with large effects or using sensitive data, in every state that asks for one. - CMP-61 [Keep the US breach notice laws as data](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/us-breach-notice-laws.md) · 1,384 tokens · updated 2026-10-27 Keep a table of the breach notice law of every US state where affected people live. Compute each deadline and each notice to a regulator from it. - Previous: [Product and data laws](https://agentwranglers.se/playbook/compliance/product-and-data-laws.md) - Next: [Online platforms](https://agentwranglers.se/playbook/compliance/online-platforms.md) - [All chapters](https://agentwranglers.se/playbook/compliance.md)