This guide covers United States data privacy and security law as it actually operates. It begins with the sectoral architecture — which federal statute governs which industry — and the enormous gaps between them, then covers the state comprehensive statutes that have grown up in those gaps and the rights and obligations they share. Definitional chapters cover personal information, sensitive categories, inferences, de-identification, and the roles of controller, processor, and service provider. Compliance chapters cover notices, consent and dark patterns, data minimization and purpose limitation, rights request handling, universal opt-out signals, vendor contracting, data protection assessments, retention, and reasonable security. Breach chapters cover what triggers notification, the encryption safe harbor, timing and content, regulator and bureau notice, and the sector overlays including the HIPAA breach rule. Enforcement chapters cover regulator authority, the narrow private rights of action, and where litigation actually occurs. Closing chapters address employment data, children and teens, biometric statutes, cross-border transfers, and a program build.