Federal Laws That Reach Your Business: FTC, GLBA, HIPAA, FCRA, COPPA, CAN-SPAM, TCPA, Wiretap, SEC and CIRCIA

The map: who each federal law reaches

Start with this table, then read the sections for the rows that describe you. "Enforcer" means the agency that brings cases. "Private suits" says whether an individual can sue you directly under the statute.

FTC Act Section 5 and "reasonable security"

Section 5(a)(1) of the FTC Act declares "unfair or deceptive acts or practices in or affecting commerce" unlawful. Two theories matter for data. A practice is deceptive when you tell customers one thing about how you handle their data and do another, such as promising "bank-level encryption" and storing passwords in plain text. A practice is unfair under Section 45(n) when it causes or is likely to cause substantial injury to consumers that they cannot reasonably avoid and that is not outweighed by benefits to consumers or competition. Weak security that exposes customers to identity theft has been pleaded as an unfair practice.

Two appeals decisions frame the theory. In FTC v. Wyndham Worldwide Corp. (3d Cir., August 24, 2015), the court held the FTC has authority under the unfairness prong of Section 5 to regulate corporate cybersecurity, and it affirmed the denial of Wyndham's motion to dismiss. In LabMD, Inc. v. FTC (11th Cir., June 6, 2018), the court vacated an FTC order as unenforceable. It assumed without deciding that LabMD's data security failures were an unfair practice, and held that an order requiring an overhaul of the company's security program to meet an indefinite reasonableness standard did not prohibit any specific act, so it could not be enforced. The practical results: the FTC does have the authority, and its later orders tend to list specific required measures instead of a general demand to be reasonable.

What does "reasonable" mean in practice? Section 5 gives no checklist. The FTC's published Safeguards Rule, its business guidance and its settled cases describe the measures it expects, and the same ones recur: know what data you hold, limit access, require strong authentication, encrypt, patch, train people, oversee vendors, monitor, plan for incidents and delete what you no longer need. If you follow lessons 02 to 03 and CIS IG1 (lesson 04), you have the measures. The documentation that shows you did it is what turns a bad day into a defensible one.

Money: a first Section 5 violation does not carry civil penalties by itself. The FTC enters a consent order, and civil penalties follow for violating an order or a rule (Sections 5(l) and 5(m)(1)(A)). The maximum is $53,088 per violation under the adjustment published January 17, 2025, as listed in 16 CFR 1.98. Check that section for the current amount, since the figure adjusts for inflation.

GLBA and the FTC Safeguards Rule

The Gramm-Leach-Bliley Act (GLBA) directs regulators to set security standards for financial institutions. The FTC covers financial institutions that no other regulator covers, and the category is wider than banks. The FTC's guidance lists example types that include mortgage lenders, payday lenders, check cashers, tax preparers and finders. If you are "significantly engaged in financial activities" (16 CFR 314.2(h)), the Rule applies to all customer information you hold, including information about other institutions' customers. The FTC's guidance says the Rule covers institutions not subject to another regulator's enforcement authority under GLBA section 505, so banks and others with their own regulators are outside it, and a business that is not a bank still needs to ask whether its activities are financial in nature.

The Rule, at 16 CFR 314.4, requires a written information security program with these elements.

Two exceptions and one definition matter. Section 314.6 says that institutions holding information on fewer than 5,000 consumers are excused from four parts: the written risk assessment (314.4(b)(1)), the testing requirements (314.4(d)(2)), the written incident response plan (314.4(h)) and the annual board report (314.4(i)). They still must run a program with the other elements. The notification event is defined at 314.2(m) as acquisition of unencrypted customer information without the individual's authorization. Unauthorized access is presumed to include acquisition unless you hold reliable evidence otherwise, and information counts as unencrypted if an unauthorized person obtained the encryption key. The notice requirement took effect May 13, 2024 (314.5), after the FTC's 2023 amendment.

A broader term in the Rule is a "security event," an event that causes unauthorized access to, or disruption or misuse of, an information system or customer information in physical form (314.2(q)). Not every security event is a notification event, but a good incident process logs every one and decides.

HIPAA: Privacy, Security and Breach Notification

HIPAA applies to covered entities, which are health plans, health care clearinghouses and health care providers that transmit health information electronically in connection with a standard transaction, and to their business associates, the vendors that create, receive, maintain or transmit protected health information (PHI) for them. A billing company, an IT provider that can reach a clinic's records, a shredding service and a cloud host are business associates when they handle PHI for a covered entity. If you are a business associate, your contract with the covered entity (a business associate agreement) sets duties, and the Security Rule applies to you directly.

The Security Rule requires administrative, physical and technical safeguards. Its first standard is the security management process, which includes the risk analysis at 45 CFR 164.308(a)(1)(ii)(A), an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic PHI (ePHI) the entity holds. HHS says the labels "required" and "addressable" do not make a specification optional. An addressable specification must be implemented if reasonable and appropriate. If not, the entity documents why and adopts an equivalent alternative.

Note the thresholds differ slightly: media notice applies to "more than 500" residents of a State, and HHS notice to "500 or more" individuals. Penalties are tiered by culpability under 45 CFR 160.404: did not know, reasonable cause, willful neglect corrected within 30 days, and willful neglect not corrected. The base ranges in the text run from $100 per violation to $50,000 or more per violation with an annual cap of $1,500,000 for identical violations, and the section says the amounts are adjusted for inflation each year in 45 CFR Part 102. Look up the current table in 45 CFR 102.3 before quoting a dollar figure to your board.

Where the proposed HIPAA Security Rule changes stand

On January 6, 2025, HHS Office for Civil Rights published a Notice of Proposed Rulemaking (90 FR 898, RIN 0945-AA22) to strengthen the Security Rule. The comment period closed March 7, 2025. The proposal would require encryption of ePHI with limited exceptions, add a defined multi-factor authentication requirement, require an inventory of technology assets and a map of how ePHI moves, and add a compliance audit standard. It remains a proposal. A secondary report dated July 15, 2026 says the federal regulatory agenda now shows the final rule no earlier than July 2027, with the item moved from the "final rule stage" to "long-term actions" (OCR had earlier targeted May 2026). That agenda entry was not checked against reginfo.gov, so treat the date as reported, not verified, and note that agency timetables are not binding. Until a final rule issues, the 2003 Security Rule as it now stands is the law. Even so, the asset inventory and data map in lesson 03 are good practice for any health data handler, and they would be required if the proposal is finalized as written.

Health data outside HIPAA

The FTC's Health Breach Notification Rule (16 CFR Part 318) covers vendors of personal health records, related entities and their service providers that are not HIPAA covered entities or business associates. A fitness or wellness app is the typical example. Notice to individuals and the media is due without unreasonable delay and within 60 calendar days of discovery. For a breach involving 500 or more individuals, the FTC is notified at the same time as individuals, and smaller breaches can be logged and reported annually within 60 days of the end of the calendar year. The rule was amended in 2024 (89 FR 47028, May 30, 2024, effective July 29, 2024). Under 16 CFR 318.4 individuals must be told without unreasonable delay and no later than 60 calendar days after discovery.

FCRA and FACTA: Red Flags and disposal

The Fair Credit Reporting Act (FCRA), as amended by the Fair and Accurate Credit Transactions Act (FACTA), gave the FTC two rules that reach ordinary businesses. The Red Flags Rule, 16 CFR 681.1, applies to financial institutions and creditors that hold "covered accounts." A covered account is one offered for personal, family or household purposes that involves or is designed to permit multiple payments or transactions, or any other account with a reasonably foreseeable risk of identity theft to customers or to the business. The rule's definition of creditor points to 15 U.S.C. 1681m(e)(4). That statute covers a creditor that regularly and in the ordinary course of business obtains or uses consumer reports in connection with a credit transaction, furnishes information about a credit transaction to consumer reporting agencies, or advances funds based on the person's obligation to repay. Advances of funds for expenses incidental to a service the business provides are excluded from the third test. Read the three tests against how you actually bill customers.

If the rule applies to you, you need a written program, approved by the board or a committee of the board, that identifies relevant red flags, detects them, responds appropriately and is updated periodically (681.1(d)(2)). The program must have senior management or board oversight, staff training and oversight of service providers (681.1(e)). The appendix to the rule lists 26 illustrative red flags, such as a consumer reporting agency alert, a suspicious document or a change of address followed by a request for a new card.

The Disposal Rule, 16 CFR 682.3, applies to any person with FTC jurisdiction who maintains consumer information for a business purpose. It requires "reasonable measures to protect against unauthorized access" when disposing of it. The examples include shredding paper, destroying or erasing electronic media and, after due diligence, hiring a records destruction company. Businesses covered by the Safeguards Rule can fold disposal into that program. The two disposal rules overlap, and the Safeguards two-year outer limit is stricter for covered institutions.

COPPA and the 2025 amendments

The Children's Online Privacy Protection Act and its Rule (16 CFR Part 312) apply to commercial websites and online services, including mobile apps and connected devices, that are directed to children under 13 and collect, use or disclose their personal information. They also apply to general audience sites that have actual knowledge they collect personal information from a child under 13. Operators must generally obtain verifiable parental consent before collecting personal information. The FTC's FAQ lists acceptable methods, including a signed consent form, a payment card transaction, a call or video conference with trained staff, government ID checked against databases and then deleted, and "email plus" only for internal use.

The FTC published amendments to the Rule on April 22, 2025. They took effect June 23, 2025, and the compliance date for most provisions is April 22, 2026, which has passed. The Federal Register notice and the Rule text show these changes: a definition for mixed audience sites and services (a subset of child-directed sites, with a neutral age screen); a mobile phone number counts as online contact information when used to text a parent for consent, plus a new "text plus" consent method in 312.5(b)(2)(ix); biometric identifiers (fingerprints, iris patterns, genetic data, voiceprints, gait patterns, facial templates) and government-issued identifiers (state ID, birth certificate and passport numbers) are added to the definition of personal information; separate verifiable parental consent is required before disclosing a child's data to third parties such as ad networks; 312.8(b) requires a written information security program with a designated coordinator, at least annual risk assessment and testing; and a written data retention policy is required under 312.10. The FTC did not finalize its proposals on ed tech and school authorization, citing pending changes to FERPA regulations, and it dropped a proposed limit on using persistent identifiers to prompt use of a service. Read sections 312.4, 312.8 and 312.10 before you describe your obligations.

Who does this reach among ordinary businesses? A retailer with a "kids club" email sign-up, a family entertainment venue with an app, a tutoring franchise with a student portal and any firm whose website invites children to enter contests. If your site is general audience and you never intend to collect from children, the exposure comes from actual knowledge, such as a form that asks for a birth date and accepts one under 13.

CAN-SPAM and the TCPA

Email marketing: CAN-SPAM

The FTC's compliance guide lists eight requirements. Headers must be accurate. Subject lines must match the content. The message must be identified as an advertisement. It must carry a valid physical postal address. It must explain how to opt out and give an easy way to do it. Opt-out requests must be honored within 10 business days, and the opt-out mechanism must work for at least 30 days after sending. You may not charge a fee or demand extra information, and you may not sell or transfer opted-out addresses. And hiring another company to send does not hand off the responsibility: both the company promoted and the company that sends can be liable. The guide states a civil penalty of up to $53,088 for each separate email in violation.

The penalty is a ceiling per message, and a mailing list multiplies it. An invented example: a regional equipment distributor sends one promotional message to 12,000 addresses with no working opt-out link. The theoretical maximum is 12,000 times $53,088, or $637,056,000. Nobody expects a penalty near that number. The arithmetic shows how fast a per-message ceiling grows with a list, and why the opt-out link is worth testing.

Calls and texts: the Telephone Consumer Protection Act

Under 47 U.S.C. 227(b)(1)(A)(iii), it is unlawful to call a cell phone using an autodialer or an artificial or prerecorded voice without the called party's prior express consent, with exceptions for emergency calls and certain government debt collection. Subsection (b)(3) lets a person sue, in state court if state law allows, for the greater of actual monetary loss or $500 per violation, and a court may award up to three times that for willful or knowing violations. Subsection (c)(5) gives a private action to someone who received more than one telephone solicitation call in a 12-month period from the same entity in violation of the do-not-call rules, with a defense for businesses that established and implemented, with due care, reasonable practices to prevent violations. Text messages are treated as calls under the FCC's rules, which the revocation rule's coverage of "robocalls and robotexts" reflects.

Three regulatory points are current as of October 2026, per secondary reports that cite FCC actions. The Eleventh Circuit ruled on January 24, 2025 in Insurance Marketing Coalition v. FCC that the FCC exceeded its authority in requiring "one-to-one" consent, and the older prior express written consent standard is back. Since April 11, 2025, callers must honor opt-out requests within 10 business days, down from 30, and must recognize words such as STOP, QUIT, END, REVOKE, OPT OUT, CANCEL and UNSUBSCRIBE. A "revoke all" provision at 47 CFR 64.1200(a)(10), which would make an opt-out to one type of message apply to all robocalls and robotexts from that caller, was delayed first to April 11, 2026 and then, by an FCC Consumer and Governmental Affairs Bureau order reported in January 2026, to January 31, 2027. Check the FCC's site for updates, since waivers have moved that date more than once.

FERPA for businesses that serve schools

The Family Educational Rights and Privacy Act (20 U.S.C. 1232g) binds educational agencies and institutions that receive funds under an applicable federal program. A private business is not directly subject to it unless it is itself such an institution. But vendors that serve schools, such as tutoring platforms, student information systems, bus routing services and learning apps, live inside FERPA through contracts. Under the Department's regulations (34 CFR 99.31(a)(1)(i)(B)), a school may disclose education records without consent to a contractor performing an institutional service or function that the school would otherwise use its own employees for, when the contractor is under the school's direct control for the use and maintenance of the records and is subject to the redisclosure limits in 99.33(a). So a vendor's conduct is governed through the school's contract terms, and the vendor's own breach can cost it the contract and its reputation with every other district. The enforcement route under the statute runs through the Department of Education, which can end funding to a noncompliant school after voluntary compliance fails. The Supreme Court held in Gonzaga University v. Doe (2002) that FERPA's nondisclosure provisions do not create rights individuals can enforce through a federal civil rights suit.

Employee monitoring: the Wiretap Act and the Stored Communications Act

These two statutes, parts of the Electronic Communications Privacy Act (ECPA), catch employers that monitor staff, record calls or look inside accounts. The Wiretap Act, 18 U.S.C. 2511(1)(a), makes it a crime to intentionally intercept a wire, oral or electronic communication. Section 2511(2)(d) allows interception by a person who is a party to the communication or when one party has given prior consent, unless the purpose is to commit a crime or tort. Criminal penalties reach up to five years (2511(4)(a)). Civil damages under 2520 are the greater of actual damages plus profits, or statutory damages of $100 a day for each day of violation or $10,000, plus punitive damages and attorney's fees in appropriate cases, with a two-year filing limit after the claimant first has a reasonable opportunity to discover the violation. The definition of "device" at 2510(5)(a) excludes telephone equipment that a provider furnishes to a subscriber or user and that the subscriber uses in the ordinary course of business, which is the source of the "business extension" argument for monitoring on a company phone line.

The Stored Communications Act, 18 U.S.C. 2701, makes it an offense to intentionally access without authorization a facility through which an electronic communication service is provided, or to exceed the access you were given, and thereby obtain, alter or block access to a communication in storage. Aggravated cases carry up to five years for a first offense. In an office this plays out when a manager logs into a departing employee's personal email using a saved password, or an administrator reads an employee's personal webmail account. Business email on a company-owned system with a clear policy is a different matter from a personal account.

The federal floor is one-party consent. Many states require all parties to consent to recording, and states add their own monitoring notice duties (lesson 07). The practical rule for management: write a monitoring policy that names what is monitored, on which systems and for what purpose; get a signed acknowledgment; post notices; do not record calls without the consent your strictest applicable state requires; and keep personal accounts out of reach. Lesson 10 covers the policy side.

The SEC: public companies and regulated financial firms

Most businesses of the size this module serves are not SEC registrants. If yours is, or if you sell to public companies and regulated firms, two sets of rules matter, and even the others will meet them as contract flow-downs.

Cyber disclosure for public companies. Under the SEC's July 2023 rule (Release 33-11216), a registrant must file Form 8-K Item 1.05 within four business days after determining that a cybersecurity incident is material, and must make that materiality determination "without unreasonable delay." The filing describes the material aspects of the nature, scope and timing of the incident and its material impact. The Attorney General may ask for a delay if disclosure would pose a substantial risk to national security or public safety: an initial delay of up to 30 days, extendable by up to 30 more, and in extraordinary circumstances a final delay of up to 60 days. Annual reports must describe, under Regulation S-K Item 106, how the company assesses, identifies and manages material cybersecurity risks and how the board and management oversee them. Compliance dates: Item 1.05 began December 18, 2023 for registrants that are not smaller reporting companies and June 15, 2024 for smaller reporting companies. Item 106 applies for fiscal years ending on or after December 15, 2023. The rule remains in force as of October 2026 so far as this lesson's sources show, but several financial industry associations petitioned the SEC on May 22, 2025 to rescind Item 1.05, and any change would need a proposal and public comment. Check sec.gov before relying on the Item 1.05 clock for a decision.

Regulation S-P for broker-dealers, funds, advisers and transfer agents. The SEC's 2024 amendments (published June 3, 2024, 89 FR 47688, effective August 2, 2024) require covered institutions to adopt written policies and procedures for an incident response program, to notify affected individuals whose sensitive customer information was or is reasonably likely to have been accessed or used without authorization as soon as reasonably practicable and no later than 30 days after becoming aware, and to oversee service providers, which must notify the institution as soon as possible and no later than 72 hours after becoming aware of a breach. The rule gives 18 months from Federal Register publication for larger entities and 24 months for smaller ones, which law-firm summaries confirm as December 3, 2025 for larger entities and June 3, 2026 for smaller ones, so both dates have now passed. Larger means investment companies (together with their related group) with $1 billion or more in net assets, registered investment advisers with $1.5 billion or more in assets under management, and broker-dealers and transfer agents that are not small entities under the Exchange Act. The size thresholds come from the SEC's release as commonly summarized (the $1.5 billion adviser figure is confirmed by a law-firm note), so confirm your own category against the release.

CIRCIA: the reporting rule that is not yet in force

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) was signed in March 2022. It directs CISA to write rules requiring covered entities in critical infrastructure sectors to report covered cyber incidents to CISA within 72 hours after they reasonably believe an incident occurred, and ransom payments within 24 hours of payment. CISA published its proposed rule on April 4, 2024 (89 FR 23644, proposing 6 CFR Part 226). The proposal defines covered entities by sector-based criteria in the critical infrastructure sectors plus a size-based criterion tied to SBA size standards, according to secondary reports. The notice's own sections on the size-based and sector-based criteria were not checked for this lesson, so read them in 89 FR 23644 if you think you might be covered.

Status as of October 2026. Reporting under CIRCIA is not required of anyone today. CISA's own page states that organizations are not required to submit reports under CIRCIA until a final rule takes effect and encourages voluntary reporting to report@cisa.gov or (888) 282-0870. The statutory target for the final rule was October 2025, CISA missed it, then targeted May 2026 and then September 2026. Trade reporting dated October 14, 2026 says CISA sent its final rule to the White House Office of Information and Regulatory Affairs on October 1, 2026, that the text under review is not public, that no effective date is set and that it remains unclear how far the final scope differs from the proposal. CISA's own CIRCIA page was out of date when checked (it still describes the proposal as forthcoming), so confirm the voluntary-reporting contact details on CISA's current site. If you are in a critical infrastructure sector (energy, water, health care, food and agriculture, manufacturing of critical goods, transportation and others), put a CIRCIA review on the calendar for the first month after the final rule is published.

Which law applies to me: a decision table

The federal clock table

When a security event turns into a reportable event, the clocks run in parallel. Put this table in your incident plan (lesson 11) and fill in the owner for each line.

Questions and answers

Is there one federal law that tells every business how to protect customer data?

No. Section 5 of the FTC Act reaches nearly every business through its ban on unfair and deceptive practices, but it sets no list of controls. The specific rules attach by industry and data: the Safeguards Rule for non-bank financial firms, HIPAA for health care, COPPA for children's data and so on. The decision table above is the starting point.

We are a small accounting firm. Does the Safeguards Rule apply to us?

Tax preparers appear in the FTC's list of example financial institutions, so a firm that prepares returns for consumers is a strong candidate. Count the consumers whose information you hold. At 5,000 or more, the full set applies. Below 5,000, the rule excuses four items (the written risk assessment, the testing section, the written incident plan and the board report) but not the rest. Read 16 CFR 314.1 to 314.6 for your own facts.

Does the 30-day FTC notice replace state breach notices?

No. It is an additional duty to a different recipient. State laws set their own notice to consumers and, often, to the attorney general, with their own clocks (lesson 07). Build one incident timeline that tracks every clock at once, and send the earliest-due notice first.

What is the difference between a covered entity and a business associate?

A covered entity is a health plan, a clearinghouse or a provider that conducts standard electronic transactions. A business associate is a vendor that creates, receives, maintains or transmits PHI for one. Both must follow the Security Rule, and the business associate agreement sets how the associate handles PHI and reports problems to the covered entity.

If a vendor has the breach, who notifies the customers?

It depends on the contract and the law. Under HIPAA, the business associate must tell the covered entity within 60 days of discovery, and the covered entity usually notifies individuals. The Safeguards Rule keeps your duty to oversee service providers, and the incident plan should say who sends what. Under Regulation S-P, the service provider has 72 hours to tell the institution. Settle the answer in the contract before the breach (lesson 09).

Do the COPPA changes affect a company that does not target children?

Only if you have actual knowledge that you collect personal information from a child under 13, or if part of your service is directed to children. A mixed audience definition added in 2025 applies to services directed to children without that being the primary audience. If neither fits, you are outside the Rule.

Can we monitor employee email and chat?

On company systems, with a clear written policy, notice and acknowledgment, employers commonly do. The Wiretap Act allows interception with the consent of a party, and stored messages on your own system sit differently from a personal account the employee reaches through your network. State laws can require more. The step that causes most trouble is an administrator opening an employee's personal webmail.

How do we keep up when these rules keep moving?

Assign one owner to a federal obligations register, set a quarterly review, and subscribe to the FTC, HHS OCR and CISA announcement feeds. Record the "as of" date on each entry. The lessons in this module mark dates as of October 2026 because several of them (HIPAA Security Rule, CIRCIA, the TCPA revocation provision) were still moving.

Hard questions

"The FTC lost LabMD. Why take Section 5 seriously?"

The Eleventh Circuit vacated that order because it was too vague to enforce, and it did not rule that data security is outside Section 5. The Third Circuit in Wyndham confirmed the authority. What changed after LabMD is the drafting of orders, which now name specific measures. A company facing the FTC still faces a long-running consent order and, if it violates the order, per-violation penalties.

"We are below 5,000 consumers, so the Safeguards Rule barely applies, right?"

The exception is narrower than it sounds. It removes four items and leaves the Qualified Individual, the safeguards in 314.4(c), training, service provider oversight and the FTC notice requirement. And a customer or insurer will ask the same questions the missing items answer. Treat the exception as a floor on the paperwork, not a reason to skip the risk assessment.

"Our budget is tight. Which of these rules can we safely ignore?"

None that apply to you. The decision table is built to show which ones you can set aside on facts: you do not bill electronically for health services, you do not collect from children, you do not text consumers. Rules that fit the facts have owners and dates. Rules that do not fit get one line in the obligations register explaining why, signed and dated, so the question does not come back at the first audit. The primary texts are free and linked above.

"HIPAA's new security rule never arrived. Doesn't that prove regulators are bluffing?"

It proves rulemaking is slow. The existing Security Rule is in force and OCR enforces it, including the risk analysis requirement. The proposal would tighten it, and a delay until 2027 or later, as secondary reports suggest, changes the timing of new duties and not the duty to protect PHI today. Preparing early is cheaper than a rushed project.

"CIRCIA is not law yet. Why plan for it?"

The statute is law, and the 72-hour and 24-hour clocks come from Congress. What is missing is the rule that defines who is covered and how to report. With the final rule at White House review, publication could come with little warning, followed by a set application date. Mapping now which of your operations fall in a critical infrastructure sector, and who would file, takes an afternoon. Starting after the effective date means meeting a 72-hour deadline with no contacts and no process.