State privacy laws set a national floor
Twenty states now have comprehensive statutes in force, and companies operating across them have stopped building to any single one.
Karson via UnsplashCongress has not passed a comprehensive privacy law. Twenty states have, and for any company operating across state lines the practical effect is close to the same thing. The obligations arrived on staggered schedules rather than in a single act, but they arrived.
Three new statutes took effect on the first day of this year. Indiana, Kentucky and Rhode Island joined a list that now runs to twenty states, with further obligations landing on July 1 in Connecticut, Arkansas and Utah, and expanded California data broker registration requirements on August 1.
The reason a floor forms is architectural rather than legal. Consent flows, deletion workflows and data inventories get built once and deployed everywhere. Segmenting them by state requires knowing a user's location before the first request, which is precisely the category of data these statutes govern.
Compliance teams describe the outcome as building to the ceiling and calling it the floor. Where two statutes differ in strictness rather than in kind, the stricter one wins by default, because maintaining two code paths costs more over a product's life than complying with the harder rule once.
The change this year is that enactment stopped being the story. Attorneys following the statutes describe enforcement moving to the center, with regulators in several states past the advisory-letter stage and into penalties large enough to be budgeted for rather than absorbed.
That shift changes who inside a company cares. A statute with no enforcement history is a legal memo. A statute with a published penalty is a line item, and it moves privacy from the general counsel's office into the same quarterly review as security and financial controls.
Universal opt-out signals are the clearest example of the floor in practice. Once a handful of states required honoring a browser-level preference, honoring it everywhere became simpler than detecting which visitors were legally entitled to it.
Divergence survives in places the floor cannot smooth over. Definitions of sensitive data still differ, obligations toward minors differ more, and the practice of collecting biometric identifiers carries different consequences depending on where the person sat when it happened.
The cost lands unevenly. Large platforms absorbed this work years ago and treat it as maintenance. The burden falls hardest on mid-market companies that hold real consumer data, operate in a dozen states, and have no dedicated privacy staff to read twenty statutes.
A federal preemption bill would resolve the patchwork, and one has been introduced in some form in every recent session. The obstacle is not drafting. Any preemptive standard has to be stricter than the strictest state law or it takes protections away from the residents of that state, and no version has yet survived that arithmetic.
The national privacy law already exists in every practical sense. It was assembled by legislatures that never coordinated with one another, it is enforced by whichever attorney general moves first, and its terms change whenever the next state's session opens.