American Water maintains several documents that function as privacy policies across its various web properties. The primary policy is titled 'Privacy Policy' and a more detailed 'Customer Privacy Policy' is also available. These policies state that the company collects personally identifiable information (PII) such as name, email, address, and phone number when users register, subscribe, or fill out a form. The stated purpose for data collection includes responding to inquiries, sending information, and securing their services. The company explicitly states it does not sell, trade, or otherwise transfer PII to outside parties, except to trusted third parties who assist in business operations under confidentiality agreements. However, the policy allows for the sharing of non-personally identifiable visitor information for marketing or advertising. For California residents, the company notes compliance with the California Online Privacy Protection Act and states it will not distribute personal information to outside parties without consent. The policy lacks specific details required by the CCPA/CPRA, such as enumerating the specific rights of California consumers (e.g., right to know, delete, correct) and providing a clear 'Do Not Sell or Share My Personal Information' link. The existence of multiple policies (including one for a 'Brand Store' which appears to be managed by a third party) could create confusion for users trying to understand their rights.

American Water provides 'Terms of Use' that govern its website (amwater.com) and related services. The terms are accessible, though not prominently linked from the main landing page. They define the relationship between the company and the user, stating that by accessing the site, the user agrees to be bound by the terms. Key provisions include a disclaimer of warranties, providing the site and its content on an 'AS IS' and 'AS AVAILABLE' basis. It also includes limitations on liability and establishes the jurisdiction for any legal disputes in the State of New Jersey. The document addresses hyperlinks to third-party sites, disclaiming all liability for their content or services. While comprehensive for website usage, these terms do not seem to cover the specifics of the utility-customer service relationship (e.g., service disconnection, billing disputes), which are likely governed by state-level public utility commission regulations and separate customer agreements.

The website uses a cookie consent banner upon the initial visit. Analysis of the privacy policies reveals that the company and its third-party service providers use automated technologies like cookies and pixels to collect data about user activity. This includes IP addresses, browser type, pages viewed, and time spent on pages to analyze trends and understand online activity. The policy for a separate entity, the 'American Water Brand Store', mentions using cookies for targeted advertising and provides a general opt-out statement, noting it doesn't stop generic ads. The main site's consent mechanism needs to be evaluated for compliance with 'opt-in' standards required in some jurisdictions (though not universally in the U.S.). For states like California, the mechanism must be clear about the user's right to opt-out of the 'sharing' of data for cross-context behavioral advertising. The current implementation appears to be a basic 'accept' banner, which may not provide the granular control over cookie categories (e.g., functional, advertising) that is becoming a best practice.

As a regulated water utility, American Water handles a significant amount of sensitive customer data, including contact information, account details, and payment information. Their privacy policy outlines measures to protect this information, stating they take 'commercially reasonable measures as it deems appropriate to secure and protect information'. The 'Privacy & Security' page for their Brand Store mentions that transactions are protected with up to 256-bit Secure Sockets Layer (SSL) encryption. Given their operations in California, American Water is subject to the CCPA, as amended by the CPRA. These laws grant consumers specific rights regarding their personal information, including the right to know what data is collected, the right to delete it, and the right to opt-out of its sale or sharing. The company's current privacy policy acknowledges the California Online Privacy Protection Act but lacks the detailed disclosures and dedicated mechanisms required by the CCPA/CPRA, representing a significant compliance gap. The company's legal framework must also account for rules from various state Public Utility Commissions (PUCs) which often have specific regulations regarding the privacy and security of customer data.

A direct search for an 'Accessibility Statement' on amwater.com did not yield a dedicated page. This is a notable omission for a large public utility. Public utilities are generally considered 'public accommodations' under Title III of the Americans with Disabilities Act (ADA), legally requiring them to ensure their services, including digital properties like websites and portals, are accessible to people with disabilities. Standard practice involves aiming for compliance with the Web Content Accessibility Guidelines (WCAG) 2.1 AA standards. Without a formal statement or visible accessibility features (like an accessibility widget), the company's commitment to digital accessibility is unclear. This poses a significant legal risk and can alienate a substantial portion of the customer base, as an estimated one in four adults in the U.S. has a disability.

As the largest regulated water and wastewater utility in the U.S., American Water operates in a highly regulated environment. The primary federal law is the Safe Drinking Water Act (SDWA), enforced by the U.S. Environmental Protection Agency (EPA), which sets national standards for drinking water quality. The company is required to regularly test water quality and provide annual Consumer Confidence Reports (CCRs) to customers. At the state level, operations are overseen by Public Utility Commissions (PUCs) or equivalent bodies in each of the 14 states where they have regulated operations. These PUCs regulate rates, service quality, and infrastructure investments. Furthermore, PUCs often have stringent rules governing customer data privacy, dictating how utilities can collect, use, and share customer information, particularly in the context of energy efficiency programs or third-party service providers. Compliance with this complex web of federal and state regulations is fundamental to the company's license to operate.

As the largest publicly traded water and wastewater utility in the United States, American Water's legal positioning is paramount for maintaining market access, regulatory approval, and customer trust. The company operates within a complex regulatory landscape, governed by the EPA's Safe Drinking Water Act at the federal level and various Public Utility Commissions at the state level. While the company's core operational compliance appears robust, its digital legal posture shows significant gaps that create strategic risks. The most pressing issues are the lack of a clear digital accessibility framework (posing a high risk of ADA litigation) and an outdated privacy policy that fails to meet the specific requirements of modern data privacy laws like the California CCPA/CPRA. These shortcomings undermine customer trust and expose the company to regulatory enforcement actions and private lawsuits. Strengthening the digital compliance framework by addressing accessibility, modernizing the privacy policy for CCPA/CPRA, and improving the transparency and accessibility of all legal notices is not merely a legal-box-checking exercise; it is a strategic imperative to protect the company's brand, manage risk, and demonstrate its commitment to serving all members of the communities it operates in.