Chapter 7: State Data Breach Notification, Data Security, and Data Destruction Laws

Notification: Free Credit Monitoring

When SSNs are exposed, the FTC suggests offering at least a year of free credit monitoring. Three states - California, Delaware, and Massachusetts - require it for at least 12 months when SSNs or similar data are exposed. California was first (2015).

How this supports CIPP/US study

Use this lesson to compare state-law scope, rights, exceptions and enforcement before choosing an answer. Continue with the CIPP/US practice exam.

When Social Security numbers are compromised, the FTC suggests companies offer at least a year of free credit monitoring or identity-theft protection. Three states require it for at least 12 months when SSNs or similar data are exposed: California (first, 2015), Delaware, and Massachusetts.

Suggested vs required

The FTC's year of credit monitoring is a suggestion. Only California, Delaware, and Massachusetts make at least 12 months mandatory. Do not treat the FTC suggestion as a binding national rule.

Key terms - quick answers

What is “Credit monitoring requirement”?
A mandate in California, Delaware, and Massachusetts to provide affected individuals free credit monitoring for at least 12 months when SSNs or similar data are exposed.

Sources and study method

This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.