A complete practitioner's treatment of United States consumer data privacy law for in-house counsel, privacy officers, litigators, and advisors to companies that collect personal data at scale. Parts I through IV cover the architecture of American privacy regulation, applicability and the exemptions that decide whether a company is covered at all, the definitions that determine most compliance questions, and the notice obligations. Parts V through VIII cover consumer rights and the response machinery they require, the opt-out stack including universal opt-out signals and the dark pattern rules that govern choice architecture, sensitive data and consent, and the substantive minimization, purpose limitation, and retention duties that no disclosure can satisfy. Parts IX through XII cover controller and processor contracting as the compliance perimeter, risk assessments and automated decisionmaking, the biometric and consumer health statutes that carry private rights of action, and children's privacy under COPPA and the state design codes. Parts XIII and XIV cover the sectoral overlays and private litigation theories including GLBA, HIPAA, FCRA, the Video Privacy Protection Act, and wiretap and pixel claims, then FTC Section 5 enforcement, state attorney general practice, and cross-border transfer basics. Part XV is a verification list. Tables throughout compare the state regimes on the points where they actually diverge.