Federal Multistate and Cross Border Rules

This hub addresses the law outside Texas that still reaches a Texas organization. It begins with the federal sectoral landscape: the FTC Act's Section 5 authority in 15 U.S.C. § 45, COPPA, HIPAA, GLBA, the FCRA, the Stored Communications Act and CLOUD Act, CIRCIA incident reporting, and the TAKE IT DOWN Act, plus the SECURE Data Act and GUARD Financial Data Act as proposals rather than operative preemption, presented with a scoping map rather than one governing statute. It then covers the state privacy patchwork anchored on Texas: the CCPA and CPRA, California's assessment, audit, and automated decisionmaking rules with their staged implementation dates, the Delete Act and deletion requirements, and the children's codes, biometric laws, and consumer-health laws of other states that reach Texas businesses, with state-count claims kept to what the sources support and each state's law treated as a separate record. International transfers cover GDPR territorial scope, roles, lawful bases, and enforcement, with extraterritorial nexus analysis; the EU-U.S. Data Privacy Framework and its reported litigation status; standard contractual clauses; transfer impact assessments; the UK GDPR and the Data Use and Access Act; and localization rules. Foreign-adversary and national-security restrictions are treated as distinct regimes: the DOJ Data Security Program in 28 C.F.R. part 202 with its prohibited and restricted transactions, bulk and government-related data thresholds, counterparties, diligence, records, audit, certification, and reporting provisions; the FTC-enforced PADFAA broker statute; and CFIUS transaction review. National security stays a cross-listed section here, not a tenth hub.

Key questions

Which other-state privacy laws reach a Texas business
What do California's assessment, audit, and automated decisionmaking rules require, and when do they take effect
When may personal data transfer to the EU or UK
What do the DOJ data program and PADFAA restrict
When may health or genomic data cross a border
Which federal proposals might preempt state privacy law, and what is their actual status

Controlling authorities

15 U.S.C. § 45 (FTC Act Section 5); 28 C.F.R. part 202 (DOJ Data Security Program); the PADFAA (2024) as FTC-enforced broker statute; the GDPR and UK GDPR; the EU-U.S. Data Privacy Framework adequacy decision; California CCPA/CPRA and the approved assessment, audit, and ADMT regulations (staged dates); state privacy statutes as separate records (pinpoints are research leads for drafting).

Guides in this hub

Planned insights

I08 California Rules Are Effective Before Every Compliance Deadline (the approved assessment, audit, and ADMT rules and their staged implementation)
I09 Why Foreign Vendor Access Belongs in the Data Map (cross-listed with N07); candidates from the bank: the Data Privacy Framework appeal
DOJ audits and report calculations; current SECURE Data Act and GUARD Financial Data Act text and status; the 2027 Texas session; the annual Texas privacy review; government-contract cybersecurity cases.

Tracker records

K43 DOJ Data Security Program 28 CFR part 202
K44 PADFAA and FTC broker enforcement materials
K45 CISA CIRCIA reporting rule current status
K46 California CCPA and CPRA
K47 California approved privacy assessment audit and ADMT regulations
K48 California Delete Act and DROP requirements
K49 Colorado Connecticut Virginia and other relevant state laws (one record per enacted instrument)
K50 Washington and Nevada consumer-health-data regimes
K51 Illinois BIPA amendments and controlling decisions
K52 EU GDPR and territorial-scope authorities
K53 EU Data Act and operative implementation
K54 EU-US Data Privacy Framework and current litigation
K55 EU standard contractual clauses
K56 UK GDPR and Data Use and Access Act commencement
K57 UK transfer instruments and adequacy decisions
RK053 Protecting Americans' Data from Foreign Adversaries Act of 2024
RK054 DOJ Data Security Program, 28 C.F.R. part 202
RK065 CFIUS review of transactions involving sensitive personal data
RK066 federal preemption watch
RK067 the state patchwork
RK068 California
RK069 other states' children's codes, health data laws, and biometric laws
RK070 EU GDPR, UK GDPR, and the EU-U.S. Data Privacy Framework
RK071 multistate attorney general coordination
RK072 recent state changes to track.