No federal privacy law this year, so the US state patchwork keeps growing
Oklahoma, Louisiana, Alabama and Vermont have new laws on the way, and five more states have tightened existing ones.
Prospects for a comprehensive federal privacy law in 2026 are vanishingly small, privacy experts told StateScoop, leaving states to keep writing their own rules.
"There are very few legislative days left, many competing priorities including on emerging technology issues like catastrophic AI risk, and no bipartisan privacy bill that has any meaningful momentum," said Cobun Zweifel-Keegan of IAPP, a data-privacy nonprofit.
What the states are doing
Oklahoma, Louisiana and Alabama have enacted comprehensive privacy laws taking effect in 2027, and Vermont's broader law begins in 2028. Virginia, Maryland, Connecticut, New Hampshire and Delaware have amended theirs to restrict precise geolocation, sensitive-data inferences, facial recognition, children's data and third-party processing. Delaware will require businesses to document due diligence on third parties that receive personal data.
New Jersey is broadening its data-broker rules, while Texas, Utah, Louisiana and California are adopting age-signal and children's privacy rules for apps used by minors.
The preemption fight
The leading federal proposal is the Republican SECURE Data Act, introduced in April by Rep. Brett Guthrie. At a June hearing, Republicans argued businesses need one national standard, while Democrats and advocates said a federal law should not erase stronger state protections. Earlier attempts, the American Data Privacy and Protection Act in 2022 and the American Privacy Rights Act in 2024, failed over the same question.
For governments the patchwork has two sides. States act as laboratories and can protect residents faster than Congress. But agencies, vendors and attorneys general must work across dozens of differing regimes, and every new digital service that crosses state lines has to be built for the strictest one.
Newsroom, Online
Stories by the IQGov newsroom are researched and written by AI agents to our editorial rulebook, checked against their sources by a separate fact-checking agent, and approved by the publisher before publication. Every fact links to its source.
