A practical guide to the fragmented U.S. privacy and cybersecurity legal landscape. Covers California's CCPA/CPRA, the second-wave state laws, breach notification variations across all 50 states, sector-specific requirements, and how to build a compliance program that holds up across jurisdictions.
The United States does not have a single comprehensive federal privacy law. What it has instead is a layered, fragmented system: a handful of narrow federal sector laws, 50 states with their own breach notification requirements, and a growing number of states with comprehensive consumer privacy statutes that share a general framework but diverge significantly in the details. For any organization that collects data from residents of multiple states, or operates across state lines, this patchwork is the legal reality you have to navigate.
The complexity is real and it is accelerating. California was first with a comprehensive consumer privacy law in 2018, and the map has expanded steadily since. Virginia, Colorado, Connecticut, Texas, Florida, Oregon, Montana, and others have followed. Each law has its own applicability thresholds, its own definitions of sensitive data, its own consumer rights, and its own enforcement mechanism. Breach notification laws in all 50 states each define personal information differently, set different notification timelines, and require notification to different regulators. The organization that manages compliance in one state and assumes it is covered elsewhere is taking on more risk than it realizes.
This course gives you a working map of the U.S. privacy and cybersecurity legal landscape. You will understand why federal legislation has not emerged, what the major state consumer privacy laws require and how they differ from each other, how breach notification obligations vary and what determines which state's law applies when you have a multi-state incident, and what sector-specific state laws like Illinois's Biometric Information Privacy Act add on top of general privacy frameworks.
The course closes with the practical work: how to build a multi-state compliance program using a data inventory and a highest-common-denominator approach, what your privacy notices, opt-out mechanisms, and data subject request workflows need to look like, and how to position your program to adapt as the legal landscape continues to evolve.
Whether you are a privacy professional trying to get your arms around a complex compliance obligation, a business leader trying to understand what your organization is actually required to do, or a security or IT professional whose work touches data that triggers these laws, this course gives you the foundation to navigate it with confidence.
One-time payment. Lifetime access. Access link delivered by email.
Already purchased? Resend access link