American privacy law is not one law. It is a patchwork built industry by industry over fifty years, now overlaid with state comprehensive statutes that vary in every important detail. This article explains how that patchwork actually works: which federal statute covers which kind of information, why your medical records at a hospital are protected and the same information in a fitness app usually is not, and why the most sensitive data in your life is frequently held by companies subject to no privacy statute at all. It covers the rights the state laws create — access, correction, deletion, portability, and opting out of sale and targeted advertising — and the sharp limits on enforcing them. It explains breach notification, what triggers it, and what a notice letter actually means for the person who receives it. It closes with what an individual can realistically do, and what a business must do.