The Privacy Landscape Has Changed Fast
Two years ago, most app founders only worried about GDPR if they had European users. That's no longer the case. By mid-2026, 19 US states have comprehensive data privacy laws on the books, and several more take effect before year-end. If your app collects any personal data — and it almost certainly does — you need to understand which laws apply to you.
We've helped dozens of founders navigate compliance during the build process, and the number one mistake we see is treating privacy as a post-launch problem. It's far cheaper to build it in from the start.
The Big Federal and International Laws
GDPR (EU)
The General Data Protection Regulation still sets the global standard. If any of your users are in the EU — even a handful — GDPR applies. Key requirements:
- Explicit consent before collecting personal data
- Right to deletion — users can request all their data be erased
- Data portability — users can export their data
- 72-hour breach notification to authorities
- Fines up to 4% of global annual revenue or 20 million euros, whichever is higher
Practically, this means your app needs a consent management system, a data export function, and a documented process for handling deletion requests.
COPPA (US)
The Children's Online Privacy Protection Act applies if your app is directed at children under 13 or if you have actual knowledge that users are under 13. COPPA was updated in 2024 with stricter rules around:
- Verifiable parental consent before collecting any data from children
- Limitations on targeted advertising to minors
- New requirements for ed-tech apps used in schools
The FTC has been aggressive about enforcement — fines have ranged from $275,000 for small apps to $520 million (Epic Games, 2022). If your app could attract kids, don't ignore this.
HIPAA (US)
If your app handles protected health information (PHI), HIPAA applies regardless of state. This includes fitness apps that collect health metrics, mental health platforms, telehealth tools, and anything that integrates with healthcare providers.
HIPAA compliance isn't a checkbox — it requires:
- End-to-end encryption for PHI in transit and at rest
- Business Associate Agreements (BAAs) with every vendor that touches PHI
- Access logging and audit trails
- Regular risk assessments
Expect to spend $15,000–$50,000 on initial HIPAA compliance for a typical mobile app, depending on complexity.
The State-by-State Patchwork
This is where it gets complicated. Here's the current state of US privacy laws that matter most for app developers in 2026:
Laws Already in Effect
- California (CCPA/CPRA) — The most comprehensive. Applies to businesses with 100,000+ California consumers or $25M+ revenue. Gives users rights to know, delete, opt-out of sale, and correct their data.
- Virginia (VCDPA) — Similar to CCPA but with narrower scope. Applies to businesses processing data of 100,000+ consumers or 25,000+ consumers if 50%+ of revenue comes from data sales.
- Colorado (CPA) — Includes universal opt-out mechanism requirement.
- Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Texas, Oregon, Delaware — All have comprehensive laws in effect with varying thresholds and requirements.
Laws Taking Effect in 2026
- Maryland (October 2025, enforcement ramping in 2026) — One of the strictest. Limits data collection to what's strictly necessary.
- Minnesota, Nebraska, New Jersey, New Hampshire — Various effective dates through 2026.
- Kentucky, Rhode Island — Taking effect mid-2026.
What This Means Practically
If your app has users in multiple states — and most apps do — you have two options:
- Build to the strictest standard (California or Maryland) and apply it everywhere. This is what we recommend.
- Geo-fence compliance based on user location. This is technically possible but expensive to maintain and risky if you get it wrong.
Option one costs more upfront but saves significant legal and engineering time over the life of your product.
The Five Things Every App Needs
Regardless of which specific laws apply to you, every app launched in 2026 should have these five privacy features built in:
1. A Real Privacy Policy
Not a template you copied from another app. A privacy policy that accurately describes what data you collect, why you collect it, who you share it with, and how users can exercise their rights. Budget $2,000–$5,000 for a lawyer to draft this properly.
2. Consent Management
Users need to actively opt in to data collection beyond what's strictly necessary for the app to function. This means a consent banner or flow on first launch, with granular controls for different data categories.
3. Data Deletion Capability
Both Apple and Google now require apps to offer account and data deletion. This isn't optional — your app will be rejected from the stores without it. Build the delete function into your API from day one.
4. Data Minimization
Only collect what you actually need. This sounds obvious, but we've audited apps that were collecting GPS coordinates every 30 seconds when they only needed city-level location data. Collect less, store less, worry less.
5. Breach Response Plan
You need a documented plan for what happens if your data is compromised. Most state laws require notification within 30–72 hours. If you're scrambling to figure out your response after a breach, you've already failed.
Common Mistakes We See
Using analytics SDKs without understanding what they collect. Firebase Analytics, Mixpanel, and Amplitude all collect device identifiers and behavioral data. Under several state laws, this counts as personal data collection requiring consent.
Assuming B2B apps don't need privacy compliance. If your business app collects any data about individual users — names, emails, usage patterns — privacy laws apply. B2B is not an exemption.
Treating push notification tokens as non-personal data. Several state laws and GDPR classify push tokens as personal data because they can be linked to an individual.
Not having a Data Processing Agreement with your cloud provider. If you're running on AWS, GCP, or Azure, you need a DPA in place. The major providers offer them, but you need to actually sign and retain them.
What Compliance Actually Costs
Here's a realistic breakdown for a typical mobile app:
- Privacy policy and terms of service: $2,000–$5,000
- Consent management implementation: $3,000–$8,000
- Data deletion and export features: $5,000–$12,000
- Security audit and penetration testing: $5,000–$15,000
- Ongoing legal review (annual): $2,000–$5,000
Total first-year cost: roughly $17,000–$45,000 on top of your development budget. It's not cheap, but it's a fraction of what a single enforcement action or data breach would cost.
Build Privacy In, Don't Bolt It On
The founders who handle this best are the ones who bring privacy into the conversation during product planning, not after launch. When we scope a new app project, compliance requirements are part of the initial architecture discussion — because retrofitting privacy controls into an app that wasn't designed for them typically costs 2–3x more than building them in from the start.
Privacy law isn't going to get simpler. More states are passing laws, the FTC is expanding enforcement, and app store requirements keep tightening. The sooner you treat user data privacy as a product feature rather than a legal burden, the better positioned your app will be.