Compliance for US digital marketing isn’t one law — it’s a stack of them, each governing a different channel: state privacy laws for how you collect and use data, CAN-SPAM for email, the TCPA for texts and calls, and the FTC’s rules for truthful advertising and influencer disclosure. There’s no single federal privacy statute, so US marketers navigate a patchwork of state laws plus federal channel rules, and the penalties are assessed per violation, which is how a single non-compliant campaign turns into seven-figure exposure. This guide is the practical checklist: which laws apply, what each one requires, and the concrete steps to stay clean.
Key Takeaways
- There’s no single US privacy law. As of 2026, 20 states have enacted comprehensive consumer privacy laws (per the IAPP US State Privacy Legislation Tracker), so compliance means meeting a multi-state baseline, not one federal rule.
- Email is governed by CAN-SPAM. Penalties reach up to $53,088 per email under the FTC’s inflation adjustment effective January 2025 — assessed per message, not per campaign.
- Texts and calls fall under the TCPA. Statutory damages run $500 per violation and up to $1,500 for willful violations, per contact, with no cap.
- The FTC polices truth in advertising. Its Endorsement Guides (revised 2023) require clear, conspicuous disclosure of any material connection — paid or free product — in influencer content.
- Consent and disclosure are the through-line. Get permission before you contact, be honest about what you collect and why, and honor opt-outs promptly.
What Laws Actually Govern US Digital Marketing?
Four bodies of law do most of the work, and they map to what you’re doing rather than to a single regulator. State privacy laws (led by California’s /CPRA) govern how you collect, use, sell, and share consumer data. CAN-SPAM governs commercial email. The TCPA governs telemarketing texts and calls. And the FTC Act — enforced by the Federal Trade Commission — governs truthfulness in advertising, including endorsements and influencer disclosures. Sector rules layer on top for specific industries (HIPAA for health, GLBA for finance), but those four cover general digital marketing.
The critical thing to internalize: the United States has no single, comprehensive federal privacy law, so there’s no one checkbox for “privacy compliance.” You meet a baseline built from the strictest state requirements that apply to your audience, plus the federal channel-specific rules. That patchwork is the defining feature of US compliance — and the reason a “we follow the law” mindset has to be replaced with “we follow these laws, per channel.”
Which US Privacy Laws Apply to You?
As of 2026, 20 US states have comprehensive consumer privacy laws in effect or enacted, according to the IAPP US State Privacy Legislation Tracker — a number that has climbed steadily and shows no sign of stopping. Because these laws are triggered by where your customers live, not where your business sits, most companies with a national audience are effectively subject to several at once.
California remains the strictest and the enforcement bellwether. Under the CCPA as amended by the CPRA, California is the only state that gives consumers a private right of action — limited to certain data breaches, with statutory damages reported at $100 to $750 per consumer per incident. Administrative penalties under the CPRA reach roughly $7,988 per intentional violation, enforced by the dedicated California Privacy Protection Agency (CPPA), which secured a $1.35 million settlement against Tractor Supply Company and has signaled increasingly active enforcement (as reported across 2025–2026 privacy-law trackers such as the IAPP and Bloomberg Law). The practical takeaway: build to California’s standard — explicit notice, easy opt-out of sale/sharing, honored deletion requests — and you clear most other states by default.
How Do You Stay CAN-SPAM and TCPA Compliant?
These two federal laws govern your outbound channels, and both assess penalties per message or contact — which is why they carry outsized risk at scale.
- CAN-SPAM (email): don’t use deceptive subject lines or headers, identify the message as an ad where relevant, include a valid physical postal address, and provide a working unsubscribe that you honor promptly (within 10 business days). Penalties reach up to $53,088 per email under the FTC’s inflation adjustment effective January 17, 2025 — and it’s assessed per email, so a single bad blast multiplies fast.
- TCPA (texts and calls): get prior express consent before sending marketing texts or making telemarketing calls, honor opt-outs (a “STOP” reply), and respect quiet hours and do-not-call rules. Statutory damages are $500 per violation and up to $1,500 for willful or knowing violations — per text, per call, per person, with no cap. A non-compliant SMS blast to a large list is how these reach the millions.
The common thread is consent and an easy, honored exit. If you can’t show that a contact opted in and that you make opting out trivial, you have exposure — regardless of how good the offer is.
Why Does the FTC Care About Endorsements and Reviews?
Because the FTC’s core mandate is preventing deceptive advertising, and an undisclosed paid endorsement is, in its view, deception — the audience is being sold to without knowing it. The FTC’s Endorsement Guides, revised in 2023, make the rule plain: any material connection between an endorser and a brand must be disclosed clearly and conspicuously. “Material connection” is broad — cash, free product, discounts, affiliate commissions, an ongoing ambassadorship — and the obligation applies to everyday creators, not just famous influencers.
Practically, that means disclosures have to be hard to miss: in the content itself, before any “more” cut, in plain language a normal person immediately understands — not a buried hashtag or a vague “thanks to my friends at.” The same honesty standard covers reviews: no fake or incentivized-but-undisclosed reviews, and no suppressing negative ones. For marketers, the safe posture is a written disclosure policy for every creator and affiliate you work with, because the brand — not just the influencer — can be held responsible.
How Do You Build Compliance Into Your Marketing? (The Checklist)
Compliance is an operating habit, not a one-time legal review. Bake these into how the team works:
- Map your channels to their laws. Email → CAN-SPAM; SMS/calls → TCPA; data collection → state privacy laws; ads and creators → FTC. Know which apply before you launch anything.
- Get and record consent. Capture opt-in with a timestamp and source, and keep the record — proof of consent is your defense.
- Make opt-out and data requests easy. Working unsubscribe on every email, “STOP” honored on SMS, and a clear path for privacy requests (access, deletion, opt-out of sale).
- Publish an honest privacy notice. Say what you collect, why, and who you share it with — and keep it current as your stack changes.
- Require disclosures from creators. A written policy and clear, conspicuous disclosure on every sponsored or incentivized post.
- Audit periodically. Regulations and your own practices drift; review both on a cadence rather than after a complaint.
Frequently Asked Questions
Is there a single federal privacy law for US digital marketing?
No. As of 2026 the US has no comprehensive federal privacy law; instead, 20 states have enacted their own comprehensive consumer privacy laws (per the IAPP US State Privacy Legislation Tracker), alongside federal channel-specific statutes like CAN-SPAM for email and the TCPA for texts and calls. Compliance means meeting a multi-state baseline plus those federal rules, not checking one federal box.
How much can a CAN-SPAM violation cost?
Up to $53,088 per email, under the FTC’s inflation adjustment effective January 17, 2025. The penalty is assessed per individual message, not per campaign, so a single non-compliant send to a large list can multiply into serious exposure. The safeguards — accurate headers, a physical address, and a working, promptly honored unsubscribe — are inexpensive relative to the risk.
Do I need consent before texting customers marketing messages?
Yes. The TCPA requires prior express consent before sending marketing texts, and you must honor opt-outs like a “STOP” reply. Damages are $500 per violation and up to $1,500 for willful violations — per message, per person, with no overall cap — which is why texting a purchased or unconsented list is one of the highest-risk moves in digital marketing.
What do FTC rules require for influencer and affiliate marketing?
Under the FTC Endorsement Guides (revised 2023), any material connection between a creator and a brand — payment, free product, discounts, affiliate links, ambassadorships — must be disclosed clearly and conspicuously, in the content itself and in plain language. It applies to everyday creators, not just big influencers, and the brand can share responsibility, so require written disclosure practices from everyone you partner with.
Does compliance apply to my business if I’m small?
Often, yes — but it depends on the law. Some state privacy laws have revenue or data-volume thresholds that exempt the smallest businesses, while federal channel rules like CAN-SPAM and the TCPA apply broadly regardless of size. Because thresholds vary by state and change over time, treat the core habits — consent, honest disclosure, easy opt-out — as universal, and check the specific thresholds (or consult counsel) for the states where your customers live.