Data Portability (USA)

Definition

According to the Cambridge Dictionary, portability refers to “the ability to be used for a different purpose or on a different system”. Data portability (DP) can essentially boil down to an individual’s ability to move personal data from one service to another or to themselves. On top of DP conferring control to individuals over their data and depending on the context and platform, it can also nurture competition between service providers by clearing paths for dynamic of choice whilst lowering barriers for new providers.

In this analysis, we will address the way in which DP is regulated in the United States, both at a federal and state level. Subsequently, we will analyse some of the main effects of its regulation (or lack thereof), to finalise with a comparison with its counterparty in the EU.

US Overview

The extent to which data portability is recognised varies considerably in the US. At one level, the right may simply entitle individuals to receive their data in a format that meets specific requirements, such as a portable and readily usable format. A second level goes a step further by imposing an obligation of direct transfer on the service provider; this obligation has not been comprehensively legislated at federal level in the US.

Instead, the underlying legal framework of DP is a patchwork of state statuses and sector-specific regulations. Health Insurance Portability and Accountability Act, 1996 (HIPAA) is an example of the latter. Initially, the Privacy Rule 2000 provided only for the access to data with no element of portability attached. The HITECH Act 2009 then augmented HIPPA with a portability aspect: under §13405(e), and codified at 42 U.S.C. §17935(e), fulfilling a data request in a given format became a right for the individual and an obligation on the provider. More recently the Cures Act 2016 introduced an infrastructure-layer requirement to enable true data portability and enforcement avenue with information blocking ban aspect.

The finance industry attempted making similar strides by way of Dodd-Frank Act, Pub. L. 111-203 as codified under 12 U.S.C. §5533. However, this has been stalled with an injunction due to contention on who exactly this right is conferred to and who should bear the cost. Federally, other sectoral statutes grant individuals a right of access to data held about them. The Fair Credit Reporting Act is one example: it obliges consumer reporting agencies to disclose “all information in the consumer’s file”, but only “in writing” by default, with electronic disclosure made available where a consumer authorises it and the agency offers it. It imposes no specific format requirement and grants no right of direct transfer to third parties.

Despite the lack of a comprehensive federal privacy that encompasses DP, several states have adopted general data protection and privacy laws, including: California, Virginia, Colorado, Connecticut, Utah. For the purpose of this, we will be focusing on the regulation of California and Utah.

We have chosen California as:

• It emerged as a “dark horse contender” in the race to set privacy and data protection norms in light of EU’s Europe’s General Data Protection Regulation (GDPR), paving the way for other states;
  
• It is the home of many of the main hyperscalers that provide cloud services at a global level. Consequently, the laws enforced here have a significant effect even beyond the territory of the state as per the ‘‘California effect’’.

As for Utah, its selection stems from the contrast it presents:

• Its Consumer Privacy Act 2022 (UCPA) is widely regarded as one of the most business-friendly state privacy laws, scoring 6/100 in the EPIC and U.S. PIRG State of Privacy report in comparison to California’s leading score of 69/100;
  
• Its portability right is correspondingly narrow, limited to data the consumer provided and qualified by “technically feasible” and “practicable”;
  
• Yet, through the Digital Choice Act 2025 (DCA), it became the first US state to require social media platforms to provide interoperability through open protocols.

California

California Consumer Privacy Act (CCPA) is a regulation that modified California’s Civil Code, incorporating several data protection provisions in the context of consumer relations.

To begin with, section § 1798.110(b) states that “a business that collects personal information about a consumer shall disclose to the consumer, pursuant to subparagraph (B) of paragraph (3) of subdivision (a) of Section 1798.130, the information specified in subdivision (a) upon receipt of a verifiable consumer request from the consumer”. To comply with this obligation, section §1798.130(a)(3)(B)(iii) adds that the business shall “Provide the specific pieces of personal information obtained from the consumer in a format that is easily understandable to the average consumer, and to the extent technically feasible, in a structured, commonly used, machine-readable format that may also be transmitted to another entity at the consumer’s request without hindrance. “Specific pieces of information” do not include data generated to help ensure security and integrity or as prescribed by regulation. Personal information is not considered to have been disclosed by a business when a consumer instructs a business to transfer the consumer’s personal information from one business to another in the context of switching services”.

It is worth mentioning that, under the CCPA, data portability is mainly considered as a format requirement of the business obligation if consumers exercise their access rights pursuant to section § 1798.110(b). This has direct effects for reporting obligations. As stated in Section § 7102, businesses that process personal information of 10,000,000 or more consumers in a calendar year shall compile the metrics on the number of “requests to know” that the business received, complied with in whole or in part, and denied.

Thus, while businesses are indeed required to disclose metrics on the amount of access request received during the year, they are not obliged to disclose the format in which these were delivered, nor if the consumer is required to port the data to a different business. Out of several business reports from 2025, we were only able to identify that Cisco voluntarily provided information on data portability, indicating that they received “21 extra requests” (which include types of Port Data, Subprocessor Disclosures, and Restrict Auto Decision). This starkly contrasts with the total of 731 requests to know during the same year, which could signal an underuse of data portability rights.

Utah

UCPA entered into effect in December, 2023. Consumers are conferred portability rights via §13-61-201(3), it provides: A consumer has the right to obtain a copy of the consumer’s personal data, that the consumer previously provided to the controller, in a format that:
(a) to the extent technically feasible, is portable;
(b) to the extent practicable, is readily usable; and
(c) allows the consumer to transmit the data to another controller without impediment, where the processing is carried out by automated means.

There has not been much effort to further define technologically natural ‘Readily usable’, ‘to the extent practicable’ and ‘without impediment’ under UCPA. Similar to GDPR the lack of specificity here results in a wide array of inconsistent results.

Utah initially tracked the Virginia model but diverged by limiting coverage to businesses making more than $25 million a year as per §13-61-102(1), lines 257–266 that meet the following: control or process the personal data of 100,000 or more consumers during a calendar year, or derive over 50% of their revenue from the sale of personal data and control or process personal data of 25,000 or more consumers. The Attorney General of Utah (AGU) has exclusive authority to enforce the stipulations of the UCPA under Utah Code §13-61-402(4).

Utah lead the charge introducing the first-of-a-kind legislation amongst states requiring social media platforms to provide interoperability through open protocols under the Utah Digital Choice Act (UDCA), enacted in 2025, and whose section §13-81-201 outlines that “If a consumer requests a copy of the consumer’s personal data under Section 13-61-201, a social media service shall provide the personal data, including the user’s social graph, in a format that:
(1) is portable, to the extent technically feasible;
(2) is readily usable, to the extent practicable; and
(3) allows the consumer to transmit the data to another controller without impediment if the controller processes the data by automated means”.

Utah has no relevant metrics as to the exercise of data portability rights. The AGU mandated evaluation of UCPA deemed it to be ineffective with proposals on improvement of which do not touch on portability rights. Industry proxy data suggest limited use with overwhelming exercise of deletion and opt-out rights rather than access rights which includes data portability.

Landscape Impact

The World Wide Web movement sought to allow free flow and access to data to all, built on liberalist ideologies. Contrarily, the last two decades saw the big corporations (social media, Internet Service Providers, Government) “walling off information” gathered from their users - creating a new power dynamic with data. The Right to Data Portability (RTDP) was established by the GDPR as a solution to empower individuals to attain data sovereignty and regulate competition in the market, ultimately resulting in innovation and platform dependency. However, the concept lacks economic incentive to the service providers who would then incur loss of consumer base and high infrastructural costs, potentially increasing security risks; creating the “Privacy-Innovation Paradox”.

“RTDP stems from technical codification and trust governance rather than legal codification”.

• Dependence and the lack of appropriate infrastructures
  
• Need for sector-specific standardisation
  
• ever-changing nature of the regulatory subject in a digital world;

makes it hard to implement data portability efficiently.

Case study: Vehicle Data Access

The United States faced challenges with the 2020 Massachusetts Vehicle Data Access Law (Right to Repair) which was enacted to allow access to data from vehicle manufactures - older car models could access data on demand through On-Board Diagnostics (OBD) ports, whereas modern cars remotely transmitted data. In this case a secure open platform would be technically unfeasible. The National Highway Traffic Safety Administration (NHTSA), warned against early compliance with the law and to not allow remote access as it could lead to vulnerabilities and possibly hacking (access to the steering and brake systems); with reference to the federal Safety Act.

Influence of hyperscaler in the United States:

When we discuss personal data transfer in a digital space, cloud computing stands as critical infrastructure. The GDPR prescribes for the “free of charge” rules (Article 12(5) for access requests, Article 20 for portability) for transfer of personal data. However, its limited application extends to the controller in relation to the data subject, exempting cloud vendors. Currently, the US hyperscalers - namely Amazon (AWS), Microsoft (Azure), and Alphabet (Google Cloud) hold majority market shares in the cloud computing space and have also well integrated themselves into multiple layers of the AI stack, serving several core functions through their subsidiaries. Due to the scale of investment required and the high barriers of entry, a non-competitive market is created making it hard for meaningful participation and innovations from new entrants.

Data portability is recommended as a solution to break such monopolistic tendencies, however, does not address issues regarding code architectural differences, security and the high switching costs. Apart from the technical barriers, company practices and interest play a major role in their product design. While some hyperscalers do allow portability services, there are direct and indirect monetary consequences - “egress fees” to transfer data out of their systems or in the case of Microsoft increasing licensing cost if data is transferred out of Azure, and well as material flaws: Microsoft applications running slower on other cloud systems.

EU Comparison

The modern US data portability framework has been influenced, though not determined, by the EU’s GDPR: state privacy laws have borrowed its terminology with some tweaks, yet the US has neither adopted a comprehensive framework comparable to the GDPR nor abandoned its sectoral approach, under which portability rights in telecommunications, health and other industries have existed for some time. A chart with a comparison between each jurisdiction can be found below:

	EU	California	Utah
Data elements	Data provided to the controller	Data obtained from the consumer	Data provided to the controller
Format	Structured, commonly used and machine-readable	Understandable, structured, commonly used and machine-readable	Portable and readily usable
Costs	Free unless manifestly unfounded or excessive	Free unless manifestly unfounded or excessive	Free for the first request in a 12-month period
Transfer	Data subject or controller if technically feasible upon request	Consumer or business if technically feasible upon request	Consumer, if DP is processed through automated means
Deadlines	1 month	45 days	45 days

We have mainly explored data portability via the lens of consumers and personal data. The EU has taken note of this and addressed it via Data Act 2023/2854. The US lacks an equivalent to the Data Act’s switching provisions. US businesses have nonetheless benefited indirectly, as AWS, Microsoft and Google waived exit egress fees globally in 2024 ahead of the Data Act’s obligations, exemplifying the Brussels effect.

Finally, Utah has illustrated that there’s scope to go beyond GDPR. By extending portability to the social graph and requiring interoperability through open protocols, the DCA targets the network effects that make switching platforms costly, an issue Article 20 GDPR does not reach.

Conclusion

Data portability does not tackle code architectural differences, security, or high switching costs. Beyond these technical barriers, company practices and commercial interests play a major role in product design. Together, these factors reinforce the established status quo in which portable data is not, in practice, very portable. This analysis has shown that, although the US defines the right to portability less comprehensively and less broadly than the EU, its use remains minimal on both sides.