More than you would expect, and the oldest ones often carry the most risk. Depending on what your product does, you may be subject to the new state privacy laws (California's CCPA/CPRA and the wave of similar state laws), and a set of older, established statutes—several of them decades old—that carry private rights of action and statutory damages: the TCPA (messaging), CAN-SPAM (e-mail), HIPAA (health data), GLBA (financial data), BIPA (biometrics in Illinois and others), and state wiretap and recording-consent laws. If you sell into the EU, add the GDPR and the EU AI Act. We map which of these apply to your specific use case—rather than handing you a generic policy.

Very likely, if any of them are automated. The Telephone Consumer Protection Act restricts autodialed and prerecorded calls and texts and generally requires prior express consent. It carries a private right of action and statutory damages of $500 to $1,500 per message—which is why it drives some of the largest class actions in the country. And in February 2024, the FCC confirmed that calls using AI-generated or cloned voices count as "artificial" voices under the TCPA—so AI voice bots and agents need that same prior express consent. If your growth or product team sends marketing SMS, runs an AI calling agent, or uses automated dialing, you are in TCPA territory, and consent capture and recordkeeping matter.

The CAN-SPAM Act governs commercial e-mail. In short: accurate "from" and subject lines, clear identification that the message is an advertisement, a working opt-out that you honor within 10 business days, and a valid physical postal address. There is no private right of action—the FTC and state attorneys general enforce it—but penalties can be assessed per e-mail, so volume adds up quickly.

Maybe directly, maybe not—but you are rarely off the hook, and the bigger surprise is usually the state consumer-health-data laws. HIPAA applies only to "covered entities" (providers, health plans, clearinghouses) and their "business associates." Many apps, wearables, and SaaS tools that touch health data fall outside HIPAA entirely—yet are squarely reached by a newer wave of state consumer-health-data laws: Washington's My Health My Data Act (which defines "consumer health data" broadly, requires consent to collect and share it, and carries a private right of action), Nevada's SB 370, and Connecticut's consumer-health-data amendments, among others. On top of that, the FTC Health Breach Notification Rule and Section 1557 of the ACA can apply. The upshot: a company with zero HIPAA obligations can still carry serious health-privacy exposure. We help you figure out which regime you are actually in before you build—read our analysis of the state consumer-health-data wave.

A fast-growing category that reaches far beyond HIPAA. Washington's My Health My Data Act (MHMDA) defines "consumer health data" broadly—data that identifies a person's past, present, or future physical or mental health—requires consent to collect it and separate authorization to share it, and carries a private right of action, which makes it especially dangerous. Nevada's SB 370 takes a similar approach (enforced by the attorney general), and Connecticut amended its privacy law to treat consumer health data as sensitive data requiring opt-in consent. The catch: "health data" is defined so broadly that ordinary apps, wearables, advertising pixels, and websites—well outside HIPAA—can be swept in. If your product or marketing touches anything health-adjacent, we map which of these apply and build the consent and data flows to match. Read our deep dive on the shifting state consumer-health-data landscape →

It can be. In two-party (all-party) consent states, recording or intercepting a communication without everyone's consent can violate decades-old wiretap statutes. Plaintiffs have used these laws against session-replay trackers and AI note-takers and transcription tools (see the Otter.ai and Google transcription cases). If your product or your team records calls, meetings, or on-site behavior, consent design is not optional.

A data processing agreement (DPA) is the contract that governs how a vendor processes personal data on your behalf—purpose limits, security, sub-processors, deletion, and audit rights. It is required under the GDPR (Article 28) and under many U.S. state privacy laws when you share personal data with a service provider or processor. In practice, your enterprise customers will also demand one before they sign. We draft and negotiate these—including DPAs for AI vendors, agents, and agentic workflows, where the data flows and sub-processors are harder to pin down—so they protect your data without stalling the deal.

If you collect faceprints, voiceprints, fingerprints, or similar identifiers, yes. The Illinois Biometric Information Privacy Act (BIPA) requires notice, consent, and a written retention/destruction policy—and, critically, it carries a private right of action with statutory damages, which has produced very large settlements. Texas and Washington have biometric laws too, and other states are following. Voice AI, face recognition, and even some authentication features can trigger these.

It can. The GDPR reaches companies that offer goods or services to, or monitor, people in the EU—regardless of where the company sits. The EU AI Act similarly reaches providers and deployers placing AI systems on the EU market. If you sell into or track users in the EU, we assess which obligations attach and on what timeline—and through our strategic partnership with Nor Law in the Netherlands, we coordinate EU and U.S. compliance under one roof.

The work overlaps; the framing differs. This practice focuses on privacy and data protection across your product and marketing. Our AI governance practice covers the broader AI risk and contracting picture, and our Fractional GC program embeds all of it on a predictable monthly plan. If you are not sure which fits, the fit call will tell you.

Book a 20-minute fit call or e-mail info@ambartlaw.com. We will learn about your product, your data flows, and your risk, and then recommend a plan to move forward—or tell you if we are not the right fit.

More than you would expect, and the oldest ones often carry the most risk. Depending on what your product does, you may be subject to the new state privacy laws (California's CCPA/CPRA and the wave of similar state laws), and a set of older, established statutes—several of them decades old—that carry private rights of action and statutory damages: the TCPA (messaging), CAN-SPAM (e-mail), HIPAA (health data), GLBA (financial data), BIPA (biometrics in Illinois and others), and state wiretap and recording-consent laws. If you sell into the EU, add the GDPR and the EU AI Act. We map which of these apply to your specific use case—rather than handing you a generic policy.

Very likely, if any of them are automated. The Telephone Consumer Protection Act restricts autodialed and prerecorded calls and texts and generally requires prior express consent. It carries a private right of action and statutory damages of $500 to $1,500 per message—which is why it drives some of the largest class actions in the country. And in February 2024, the FCC confirmed that calls using AI-generated or cloned voices count as "artificial" voices under the TCPA—so AI voice bots and agents need that same prior express consent. If your growth or product team sends marketing SMS, runs an AI calling agent, or uses automated dialing, you are in TCPA territory, and consent capture and recordkeeping matter.

The CAN-SPAM Act governs commercial e-mail. In short: accurate "from" and subject lines, clear identification that the message is an advertisement, a working opt-out that you honor within 10 business days, and a valid physical postal address. There is no private right of action—the FTC and state attorneys general enforce it—but penalties can be assessed per e-mail, so volume adds up quickly.

Maybe directly, maybe not—but you are rarely off the hook, and the bigger surprise is usually the state consumer-health-data laws. HIPAA applies only to "covered entities" (providers, health plans, clearinghouses) and their "business associates." Many apps, wearables, and SaaS tools that touch health data fall outside HIPAA entirely—yet are squarely reached by a newer wave of state consumer-health-data laws: Washington's My Health My Data Act (which defines "consumer health data" broadly, requires consent to collect and share it, and carries a private right of action), Nevada's SB 370, and Connecticut's consumer-health-data amendments, among others. On top of that, the FTC Health Breach Notification Rule and Section 1557 of the ACA can apply. The upshot: a company with zero HIPAA obligations can still carry serious health-privacy exposure. We help you figure out which regime you are actually in before you build—read our analysis of the state consumer-health-data wave.

A fast-growing category that reaches far beyond HIPAA. Washington's My Health My Data Act (MHMDA) defines "consumer health data" broadly—data that identifies a person's past, present, or future physical or mental health—requires consent to collect it and separate authorization to share it, and carries a private right of action, which makes it especially dangerous. Nevada's SB 370 takes a similar approach (enforced by the attorney general), and Connecticut amended its privacy law to treat consumer health data as sensitive data requiring opt-in consent. The catch: "health data" is defined so broadly that ordinary apps, wearables, advertising pixels, and websites—well outside HIPAA—can be swept in. If your product or marketing touches anything health-adjacent, we map which of these apply and build the consent and data flows to match. Read our deep dive on the shifting state consumer-health-data landscape →

It can be. In two-party (all-party) consent states, recording or intercepting a communication without everyone's consent can violate decades-old wiretap statutes. Plaintiffs have used these laws against session-replay trackers and AI note-takers and transcription tools (see the Otter.ai and Google transcription cases). If your product or your team records calls, meetings, or on-site behavior, consent design is not optional.

A data processing agreement (DPA) is the contract that governs how a vendor processes personal data on your behalf—purpose limits, security, sub-processors, deletion, and audit rights. It is required under the GDPR (Article 28) and under many U.S. state privacy laws when you share personal data with a service provider or processor. In practice, your enterprise customers will also demand one before they sign. We draft and negotiate these—including DPAs for AI vendors, agents, and agentic workflows, where the data flows and sub-processors are harder to pin down—so they protect your data without stalling the deal.

If you collect faceprints, voiceprints, fingerprints, or similar identifiers, yes. The Illinois Biometric Information Privacy Act (BIPA) requires notice, consent, and a written retention/destruction policy—and, critically, it carries a private right of action with statutory damages, which has produced very large settlements. Texas and Washington have biometric laws too, and other states are following. Voice AI, face recognition, and even some authentication features can trigger these.

It can. The GDPR reaches companies that offer goods or services to, or monitor, people in the EU—regardless of where the company sits. The EU AI Act similarly reaches providers and deployers placing AI systems on the EU market. If you sell into or track users in the EU, we assess which obligations attach and on what timeline—and through our strategic partnership with Nor Law in the Netherlands, we coordinate EU and U.S. compliance under one roof.

The work overlaps; the framing differs. This practice focuses on privacy and data protection across your product and marketing. Our AI governance practice covers the broader AI risk and contracting picture, and our Fractional GC program embeds all of it on a predictable monthly plan. If you are not sure which fits, the fit call will tell you.

Book a 20-minute fit call or e-mail info@ambartlaw.com. We will learn about your product, your data flows, and your risk, and then recommend a plan to move forward—or tell you if we are not the right fit.