Which Government Agencies Protect Your Data Online?

When people ask who protects their data online, they usually expect a single answer: an agency, a law, a hotline. The reality in the United States is less tidy. Protection is spread across federal agencies with narrow mandates, state laws that vary by address and industry rules that apply only to certain businesses. That patchwork produces real protections and real gaps. This guide maps who does what, explains what each agency can and cannot do for you, shows how to file complaints and describes the steps you should take on your own because the system is incomplete. For the rights angle, see our article on giving away privacy rights for good.

1. Why there is no single protector

The United States has no single comprehensive federal consumer privacy law that covers all personal data. Instead, privacy rules attach to particular kinds of information or particular industries: health records, credit reports, children’s data, financial institutions, education records and telecommunications. Everything outside those categories is mostly governed by general consumer protection law and, increasingly, state statutes. That is why a people-search site can legally publish information that a hospital could not.

Understanding this structure helps you aim your complaint, your rights request and your own protective steps in the right direction.

2. The federal agencies that matter

Federal Trade Commission

The Federal Trade Commission is the primary federal privacy and data security enforcer for most commercial businesses. Its main tool is the prohibition on unfair or deceptive acts or practices. If a company promises to protect your data and then fails to, or collects data in a way that causes substantial harm, the FTC can investigate and bring actions. It also enforces specific rules, including the Children’s Online Privacy Protection Act and parts of the Fair Credit Reporting Act. The agency received about 3 million fraud reports in 2025, with roughly $15.9 billion in reported losses. You can report scams and privacy problems at ReportFraud.ftc.gov and find consumer education at consumer.ftc.gov.

Notable actions include a $5 billion penalty against Facebook in 2019 and a 2023 Alexa settlement involving children’s voice data that included a $25 million civil penalty and deletion requirements. These cases show what enforcement can look like, but they are not routine outcomes for every violation. We explore this in do big fines prevent data leaks.

Consumer Financial Protection Bureau

The Consumer Financial Protection Bureau oversees many consumer financial products and companies, including parts of the credit reporting system. It accepts complaints about credit reports, debt collection, bank accounts and loans, and it publishes guidance on freezes, disputes and fraud alerts.

Department of Health and Human Services

The HHS Office for Civil Rights enforces HIPAA’s Privacy, Security and Breach Notification Rules against covered entities and their business associates. You can file a complaint if you believe a provider or health plan mishandled your information. Many consumer health apps and wearables fall outside HIPAA, which is a gap many people do not realize exists.

Federal Bureau of Investigation

The FBI’s Internet Crime Complaint Center collects reports of internet-enabled crime. In 2025 it received 1,008,597 complaints with $20.877 billion in reported losses, including 31,675 identity theft complaints and 67,456 personal data breach complaints. Filing helps investigators see patterns, even when it does not lead to an individual resolution.

Other federal bodies

The Federal Communications Commission handles some telecommunications and robocall issues. The Department of Education addresses student records. The Department of Labor regulates parts of employee benefit privacy. The Federal Aviation Administration has rules relevant to drones that capture imagery. Each is narrow, and none is a general data protector.

Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.

3. State governments are filling the gap

States have become the main source of new privacy rights. Many have enacted comprehensive consumer privacy laws that give residents the right to know what data is collected, request deletion, correct inaccuracies and opt out of certain sales or targeted advertising. Others regulate data brokers through registration.

California leads on enforcement infrastructure. The California Privacy Protection Agency enforces the state’s privacy law and operates the Delete Request and Opt-out Platform, or DROP, at privacy.ca.gov/drop. Residents can submit a single deletion request to all registered data brokers. DROP opened to residents on January 1, 2026, and registered brokers began processing requests on August 1, 2026, repeating every 45 days. State attorneys general in many states also enforce privacy and consumer protection laws and accept complaints.

The limits are clear. State rights depend on where you live, thresholds exclude some businesses, and brokers that are not registered may not be covered. For a deeper look at why selling continues, read why we cannot simply stop data brokers.

4. What government agencies generally cannot do

Remove your information from every website on request.
Investigate every individual complaint.
Prevent breaches before they happen.
Compel unregistered or offshore brokers to comply.
Restore stolen data once it has been sold.

Even government itself is part of the ecosystem. Agencies and law enforcement sometimes purchase data commercially, a topic covered in our article on whether the government buys data from brokers. Public records held by government offices, including property and court records, are often public by law, which is one reason brokers can republish them.

5. How to use government resources

File the right complaint

Start with the agency that matches the problem. Use the FTC for scams, deceptive practices and identity theft. Use the CFPB for financial products and credit reports. Use HHS for health privacy. Use your state attorney general for local consumer issues.

Report identity theft at IdentityTheft.gov

IdentityTheft.gov creates a personalized recovery plan. See our walkthrough on how to report identity theft.

Use your state rights

If your state gives you rights to know, delete and opt out, use them. California residents can use DROP. Others can submit direct requests to companies.

Register for the Do Not Call list

The FTC’s registry at donotcall.gov limits legitimate telemarketing calls.

Freeze your credit

Federal law gives you the right to freeze credit for free. Learn the steps at consumer.ftc.gov.

Opt out of prescreened offers

Call 1-888-5-OPT-OUT to stop prescreened credit and insurance offers.

6. Doing what the system does not

Because gaps are large, your own protective layers matter. Remove people-search listings through official pages such as Spokeo, PeopleConnect and That’s Them. Use unique passwords and two-factor authentication. Limit what you share. Our guide to deleting your data from the internet walks you through the process. Government protection and personal protection work best together.

7. What to expect from the future

Federal privacy legislation has been debated for years without passing as a comprehensive law. State activity continues to grow, and enforcement agencies are building tools like DROP. Expect more rights, more registration requirements and more tools, but also a continuing need for individuals to act. Check your state’s current law, because rules change.

8. Timeline: using the system effectively

When	Action
Day 1	Freeze credit, register on donotcall.gov
Week 1	Submit rights requests to companies you use
Week 2	Use DROP if you live in California; start broker opt-outs
Month 1	File complaints for unresolved problems
Quarterly	Recheck listings and rights

9. How international rules relate

Some companies that serve US customers also follow rules from other places, most famously Europe’s General Data Protection Regulation. That regulation does not protect people who live in the United States directly, although global companies sometimes extend similar options to everyone. Our explainer on what GDPR is and whether it will protect you walks through the differences. The practical takeaway is to read the privacy controls offered by the services you use. You may find rights that are not required by US law but are available anyway.

10. Three scenarios and what to do

Scenario 1: A company ignores your deletion request. Document the request and complain to your state attorney general or privacy regulator.

Scenario 2: A hospital mishandles your records. File a complaint with the HHS Office for Civil Rights.

Scenario 3: A credit bureau will not correct an error. Dispute in writing and complain to the CFPB.

11. Myths and facts

Myth	Fact
One agency covers my data	Coverage is split by sector and state
Complaints always lead to action	They inform enforcement, but results vary
HIPAA covers all health data	It covers specific entities
Government records are private	Many are public by law
Laws remove me from broker sites automatically	You usually have to ask

12. Common mistakes

Filing with the wrong agency.
Not keeping records of requests.
Assuming a law protects data that it does not cover.
Waiting for regulation instead of acting.
Ignoring state rights.
Never following up on requests.

13. Questions to ask yourself

Which laws apply to me given my state and the data in question? Have I used the rights I have? Which exposures are outside any protection? Cover those gaps yourself.

14. How Wiperts fits

Where the law leaves gaps, Wiperts closes them in practice. It scans more than 100 data brokers and people-search sites, submits removal requests, removes personal results from Google and Bing, blurs your home on maps and monitors for returning profiles. The free diagnosis shows what is currently public.

100% Free Diagnosis: Check Your Exposure

Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:

First Name
Last Name
Select State
Email Address
Website

Scan Databases Now — no payment is needed to see your exposure report.

15. Key takeaways

No single agency protects all data; protection is a patchwork.
Match your complaint to the right agency.
Use state rights and tools like DROP where available.
Fill the gaps with your own protections.

Pick the Wiperts plan that fits your household

Plan	Covers	One-time deep scrub	Then
Individual	1 person	$89	$14/month
Couples (most popular)	2 people	$149	$24/month
Family	Up to 4 people	$199	$39/month

Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal

16. Frequently Asked Questions

Is there one federal agency that protects all my data?

No. The United States relies on a patchwork of sector-specific federal laws and agencies, plus state laws, rather than a single comprehensive privacy law and regulator.

What does the Federal Trade Commission do about privacy?

The FTC enforces laws against unfair or deceptive practices, including misleading privacy promises and weak data security, and it accepts consumer reports at reportfraud.ftc.gov.

Who protects health information?

The HHS Office for Civil Rights enforces HIPAA, which applies to covered entities such as providers, health plans and their business associates.

Who protects financial data?

The Consumer Financial Protection Bureau and other financial regulators oversee consumer financial products, and the Fair Credit Reporting Act governs credit reporting.

What can state governments do?

States can pass privacy laws, regulate data brokers and enforce through attorneys general or dedicated agencies, such as the California Privacy Protection Agency.

Where should I file a complaint?

Start with the FTC for general privacy and scam issues, then the CFPB for financial products, HHS for health privacy and your state attorney general.

Sources

Ready to erase your footprint?

Stop letting data brokers profit from your personal life. Start your removal today.

Start Removing