You've built a robust GDPR compliance program. Your data protection impact assessments are thorough, your Data Subject Access Request workflows are documented, and your EU operations meet every Article 32 security requirement. Now you're entering the US market, and you assume the hard work is behind you.
It isn't.
These myths persist because the US regulatory landscape looks deceptively simple from outside. There's no single data protection authority or omnibus federal law. Surely that means less oversight, not more? The reality is the opposite: more than 20 states have enacted comprehensive consumer privacy statutes, and federal sectoral laws like HIPAA and the Gramm-Leach-Bliley Act create obligations that GDPR never contemplated. This fragmentation isn't a compliance gap; it's a compliance multiplier.
Myth 1: GDPR Compliance Covers US Requirements
Reality: GDPR compliance addresses fundamentally different risks than US privacy laws. The General Data Protection Regulation focuses on lawful bases for processing, cross-border data transfers, and supervisory authority oversight. US state privacy laws focus on consumer rights mechanisms (access, deletion, correction, opt-out), vendor contracting obligations, and private rights of action that enable class litigation.
Consider California's framework: the California Consumer Privacy Act created the California Privacy Protection Agency as a dedicated enforcement body with an aggressive regulatory posture. Your GDPR-compliant privacy notice won't satisfy California's specific disclosure requirements about categories of personal information sold or shared, or the required "Do Not Sell or Share My Personal Information" link placement.
More critically, GDPR doesn't prepare you for sectoral federal laws. If you're entering healthcare, HIPAA governs protected health information held by covered entities and their business associates with specific contracting, security, and breach notification requirements that operate independently of any EU framework. Financial services? The Gramm-Leach-Bliley Act regulates "non-public personal information" sharing and imposes information security requirements distinct from GDPR's Article 32 safeguards.
Treat sectoral laws as primary regulatory regimes, not supplements. Your GDPR playbook is a starting point, not a passport.
Myth 2: One State Law Means You Understand Them All
Reality: Each state's comprehensive privacy statute is distinct in applicability triggers, exemptions, consumer rights scope, and enforcement mechanisms. You can't copy-paste your California compliance program to Texas, Virginia, or Colorado.
The threshold assessment matters first. State laws apply based on different criteria: revenue thresholds, data volume thresholds, percentage of revenue from data sales. Your operations might trigger obligations in California but not Connecticut, or vice versa. Some states exempt certain business types or data categories that others regulate heavily.
Then come the operational differences. California requires businesses to honor opt-out preference signals. Colorado mandates universal opt-out mechanisms for targeted advertising. Virginia's correction right differs from California's in scope and exception handling. These aren't minor variations; they're distinct compliance workflows.
The enforcement landscape varies dramatically too. California's dedicated regulator pursues enforcement aggressively. Other states rely on attorney general enforcement with different priorities and interpretive approaches. Some state laws include private rights of action; others don't. Your risk profile changes state by state.
Build a compliance matrix that maps which state laws apply to your operations, then design state-specific controls rather than assuming a lowest-common-denominator approach will suffice.
Myth 3: "Reasonable Security" Means the Same Thing Everywhere
Reality: US cybersecurity obligations are increasingly prescriptive, not principle-based. Many state privacy laws require "appropriate technical, administrative and physical safeguards" but then layer sector-specific and state-specific mandates that go far beyond GDPR's risk-based approach.
California will soon require certain businesses covered by the Children's Online Privacy Protection Act to conduct cybersecurity audits and submit certifications. That's not a principle; it's a procedural mandate with documentary evidence requirements. Financial services entities face Gramm-Leach-Bliley Act safeguards that specify encryption, access management, multifactor authentication, vendor oversight, incident response, and board-level reporting expectations.
Your ISO/IEC 27001 certification demonstrates systematic security management, but it won't automatically satisfy state requirements for specific controls. Some state laws prescribe risk assessment frequencies, audit documentation, and governance structures that your global standard might not address at the required granularity.
Map your existing security controls to US state and sectoral requirements explicitly. Where gaps exist between your GDPR-driven program and US prescriptive mandates (particularly around vendor oversight documentation, incident response timelines, and board reporting cadences), build US-specific enhancements rather than assuming equivalence.
Myth 4: Marketing Compliance Is Just About Consent
Reality: US marketing and communications laws create strict liability risks that consent mechanisms don't eliminate. The Telephone Consumer Protection Act and state equivalents heavily regulate telemarketing, text messaging, and automated calling with requirements unrelated to GDPR's consent standards. These laws have driven substantial class action litigation with statutory damages that accumulate per violation.
The CAN-SPAM Act governs commercial email with identification requirements, opt-out mechanisms, and header-information accuracy rules distinct from GDPR's direct marketing provisions. You need accurate physical postal addresses, not just compliant unsubscribe workflows.
Do-not-call list rules apply particularly to telemarketing but extend beyond that context. State mini-TCPA statutes create additional layers. Some jurisdictions require one-party consent for call recording; others require all-party consent. The variation isn't about consent quality; it's about which party's consent matters.
Plaintiffs are also challenging session replay and online tracking technologies like cookies and pixels under federal and state wiretapping and eavesdropping statutes. Your cookie consent banner satisfies GDPR but doesn't address whether your session replay tool creates wiretapping liability under state law.
Review your marketing technology stack and communication practices against US-specific statutes, not just GDPR consent principles. The compliance question isn't "did we get consent?" but "does this technology or practice trigger statutory liability regardless of consent?"
Myth 5: Employee Privacy Works Like GDPR Article 88
Reality: US employee privacy is a patchwork of federal and state laws addressing specific practices, not a comprehensive framework. GDPR contemplates member state laws for employment processing; US law fragments employment privacy across background checks, criminal history, credit reports, salary history, biometrics, drug testing, social media, and off-duty conduct with no unifying principle.
The federal Fair Credit Reporting Act and state equivalents regulate third-party background screening reports with specific disclosure, authorization, and adverse action requirements. State and local "ban the box" and "fair chance" laws restrict when and how you can request criminal history information during hiring, typically requiring delayed inquiries and individualized assessments. These aren't Data Minimisation principles; they're procedural mandates about timing and decision-making processes.
Other state laws restrict using credit reports or salary history information in hiring. Several states have biometric privacy statutes (Illinois Biometric Information Privacy Act being the most prominent) that require informed consent, data retention limits, and secure disposal for technologies like fingerprint time clocks and facial recognition access systems. These requirements operate independently of your GDPR employment processing policies.
Employee health plans may also trigger HIPAA requirements for covered entities, creating another sectoral overlay. The result: your global HR policies need US-specific annexes addressing background checks, criminal history inquiries, biometric technologies, and health plan administration that your GDPR employment framework doesn't contemplate.
Myth 6: No Federal Law Means Less Cross-Border Complexity
Reality: The US recently finalized regulations restricting certain "covered data transactions" involving bulk US sensitive personal data with specified "countries of concern" and "covered persons." Unlike GDPR, which regulates data exports from the EU, these US Department of Justice regulations restrict data flows to specific jurisdictions.
The rule defines "bulk US sensitive personal data" broadly: personal identifiers, precise geolocation, biometric identifiers, health and financial data, and human genetic data when certain thresholds are met within a 12-month period. A separate law enacted in 2024 restricts third-party data brokers from selling or transferring personal data to "adversary countries" or entities under their control.
This creates bidirectional transfer complexity. Your GDPR transfer impact assessments address adequacy decisions and supplementary measures for data leaving the EU. Now you need parallel assessments for data flows from US operations to certain jurisdictions, with different threshold calculations, covered data definitions, and contractual safeguard requirements.
The compliance question isn't whether you have Standard Contractual Clauses or Binding Corporate Rules. It's whether your data flows trigger US restrictions based on data volume thresholds, data categories, and recipient jurisdiction. These measures apply in addition to your home-country data transfer requirements, not instead of them.
What to Do Instead
Start with a threshold assessment: which state comprehensive privacy laws actually apply to your operations based on revenue, data volume, and geographic footprint? Don't assume all 20-plus state laws matter equally to your business model.
Then layer sectoral analysis: if you're entering healthcare, treat HIPAA as your primary framework. Financial services? Gramm-Leach-Bliley Act governs first. These sectoral laws create baseline obligations that state privacy laws supplement, not replace.
Build US-specific protocols for breach notification (all states and territories have distinct statutes), marketing communications (CAN-SPAM Act, Telephone Consumer Protection Act, state equivalents), and employee privacy (Fair Credit Reporting Act, ban-the-box laws, biometric statutes). These aren't GDPR gaps; they're parallel compliance domains.
For AI and automated decision-making, adapt your EU AI Act governance to address US state laws focusing on transparency, bias risks, and impact assessments where models affect employment, housing, credit, or essential services access. The regulatory concerns overlap, but the disclosure, consent, and opt-out expectations differ.
Finally, map your existing security controls to US prescriptive requirements. Where your risk-based GDPR program meets US mandates, document the equivalence. Where gaps exist (vendor oversight documentation, specific technical controls, board reporting cadences), build targeted enhancements rather than rebuilding your entire program.
The US regulatory landscape isn't simpler than GDPR. It's more fragmented, more litigious, and more prescriptive in specific domains. Your GDPR compliance demonstrates regulatory maturity, but it doesn't transfer directly to US obligations. Treat US market entry as a distinct compliance build, not a compliance translation.
