The United States needs a strong, comprehensive federal privacy law that ensures consumers’ personal data is used in ways they expect.

This document focuses on what processors can (and cannot) do in helping controllers respond to consumer rights requests.

This document explains the history of the controller/processor distinction and demonstrates how widely that distinction has been adopted in global privacy laws.

Comprehensive privacy legislation must create strong obligations for all companies that handle consumer data. These obligations will only be strong enough to protect consumer privacy and instill trust, though, if they reflect how a company interacts with consumer data.