The American Data Privacy and Protection Act (ADPPA) takes effect July 1, 2026, establishing the first comprehensive federal data privacy framework and imposing significant requirements on businesses of all sizes.
Key Requirements
- Explicit consent required for data collection beyond service delivery
- Right to delete personal data within 30 days of request
- Data minimization: only collect what you need
- Mandatory breach notification within 72 hours
- Fines up to 4% of global revenue for violations
Business Impact
The law preempts the patchwork of state privacy laws (except California's CCPA), creating a single national standard. Small businesses with under $25 million in revenue and fewer than 100,000 data records are exempt from most provisions.
