To be safe you should try to comply with the laws of all 50 states. There are also specific laws for certain industries. Users must be given a choice of whether they would like their information collected.
Additional requirements may include notifying users where the site service is located, notifying users of certain data protection laws may vary by country. The standard for websites is to use “commercially reasonable measures” to secure user information.
One other thing to worry about is if minors use your website. The Children’s Online Privacy Protection Act applies to websites or operators directed to children under 13, or those who know they collect information from children under 13.