By: Hunter Carr
Introduction
Without a comprehensive federal consumer data privacy regulation scheme, states have had to fill the gaps. So far, twenty-four states have enacted comprehensive consumer data privacy statutes.[1] As one would imagine, approaches vary widely. State experimentation in consumer data privacy regulation produces meaningful consumer protections that the federal level lacks. However, the resulting patchwork of regulatory schemes creates inconsistent consumer protections and significant compliance challenges for businesses.
The Federal Gap
The federal approach to consumer data privacy is piecemeal, not comprehensive. Congress has chosen to regulate specific sectors’ use of consumer data rather than regulating consumer data privacy broadly. Some of the key federal consumer data privacy statutes are the Video Privacy Protection Act (VPPA),[2] the Federal Communications Act,[3] the Cable Communications Policy Act (CCPA),[4] the Children’s Online Privacy Protection Act (COPPA),[5] the Electronic Communications Privacy Act (ECPA),[6] the Family Educational Rights and Privacy Act (FERPA),[7] the Health Insurance Portability and Accountability Act (HIPAA),[8] and the Computer Fraud and Abuse Act (CFAA).[9]
As the titles of these laws alone demonstrate, they create consumer data privacy protections in discrete areas rather than across the board. As a result, there are gaps in protection where certain data processors and collectors that deal with consumer data are not governed by a particular statute. Conversely, certain types of consumer data are not covered by any federal statute.
State Experimentation
Noticing the gaps left by the fragmented federal approach, states have stepped in to provide comprehensive consumer data privacy protections for their citizens. California led the charge in 2018 by passing the California Consumer Privacy Act.[10] This law provides California residents with a wide range of consumer data rights, including the right to know what information a business has about them, the right to delete personal information, the right to opt out of the sale or sharing of personal information, the right to correct inaccurate information, and the right to limit use and disclosure of sensitive personal information.[11]
Since the passage of the California Consumer Privacy Act, twenty-three other states have enacted comprehensive consumer data privacy statutes.[12] Although protection levels vary, many of these laws follow the same basic structure. First, they apply to entities outside the state’s borders, so long as those entities do business in the state or collect data about its residents.[13] Most of the laws provide similar rights to those in the California Consumer Privacy Act, including the right to know, right to access, right to correct, and right to delete.[14] These laws often require data processors to process responsibly through requirements like notice, data minimization, data security, privacy impact assessments, data processing agreements, and prohibitions on discrimination.[15]
Louisiana, Oklahoma, Alabama, and Vermont passed consumer data privacy laws this year.[16] These laws largely include the protections outlined above. Some key unique areas in these most recent laws include Vermont’s focus on stricter standards for artificial intelligence and other automated decision-making, Louisiana’s specific notice requirement for the sale of sensitive information or biometric data, and Oklahoma’s treatment of pseudonymous data as personal data when it can be linked to an identifiable person.[17] Because these states had not yet enacted consumer data privacy laws, they could identify gaps in other states’ law and address specific areas of concern.
How Inconsistency Between States Impacts Consumers
Different state approaches to consumer data privacy mean consumers have different privacy rights based on where they live. While many of these state laws apply broadly to businesses that hold or process data of that state’s residents,[18] entities may not consistently fall under each state’s statute even when they hold or process data from residents of multiple states because of the different thresholds under each state’s law.[19] For example, to fall under the New Hampshire Privacy Act, a business must either control or process personal data of at least 35,000 consumers or 10,000 unique consumers and derive more than 25% of its gross revenue from the sale of personal data.[20] This is a relatively low standard compared to some other states. To fall under the Tennessee Information Protection Act, on the other hand, one of two things must happen. First, entities must control or process the personal information of at least 175,000 Tennessee consumers during a year. Alternatively, the entity falls under the statute if it controls or processes the personal information of 25,000 consumers and derive more than 50% of gross revenue from the sale of such personal information.[21] This assortment of thresholds means that a certain data processor must comply with one state’s consumer data privacy laws while being exempt from another state’s.
Additionally, while the basic provisions of many of these state statutes are materially similar, several states have unique provisions or define terms differently, resulting in jurisdictional inconsistencies. For instance, one extremely common provision is opt-in requirements for disclosure of “sensitive” information.[22] However, states vary widely o n what information is considered “sensitive.” All states with consumer data laws protect biometric data, race, ethnicity, and religious beliefs as sensitive information.[23] Only California protects information about philosophical beliefs as sensitive information, and very few protect an individual’s transgender or non-binary identity.[24] Based on these various definitions, consumers in different states have rights that vary widely based on the same type of information. Thus, a person’s zip code can determine whether certain actions with their data are permissible.
Conclusion
States have responded to the federal law gap by enacting comprehensive consumer data privacy laws. However, because of different applicability thresholds and protections, consumers across different states have very different privacy rights against different groups of entities. This variance raises the question as to whether a comprehensive federal solution would be more desirable.
But what should that solution look like? Should Congress enact a federal “floor” and allow states to maintain stronger protections, or should it establish a robust standard that preempts existing state law? In theory, a strong national standard that preempts state law would be desirable; businesses would no longer need to track consumer data privacy developments across the country to ensure. However, as existing state consumer data privacy laws show, states have enacted robust and creative protections, so it may be best to let them decide how robust those protections should be.
[1] See Comprehensive State and Consumer Health Data Privacy Laws, Bass, Berry & Sims, https://bassberry.com/data-privacy-laws/#details-anchor (on file with the Tennessee Law Review) (last visited Sep. 24, 2026).
[2] 18 U.S.C. § 2710.
[3] 47 U.S.C. §§ 151 et seq.
[4] 47 U.S.C. § 551.
[5] 15 U.S.C. §§ 6501 et seq.
[6] 18 U.S.C. §§ 2510 et seq.
[7] 20 U.S.C. § 1232g.
[8] 42 U.S.C. §§ 1320d et seq.
[9] 18 U.S.C. § 1030.
[10] California Consumer Privacy Act (CCPA), California Dep’t of Just., Office of the Attorney General, https://www.oag.ca.gov/privacy/ccpa (on file with the Tennessee Law Review) (last updated Aug. 28, 2026).
[11] Id.
[12] See Comprehensive State and Consumer Health Data Privacy Laws, supra note 1.
[13] Daniel Solove, Understanding the Patchwork of U.S. State Consumer Privacy Laws, TeachPrivacy (Aug. 23, 2026), https://teachprivacy.com/understanding-the-patchwork-of-u-s-state-consumer-privacy-laws/ (on file with the Tennessee Law Review) (last visited Sep. 24, 2026).
[14] Id.
[15] Id.
[16] Michael A. Signorelli et al., 2026 Mid-Year State Privacy Law Update: New Consumer Privacy Laws and Key Deadlines, Venable LLP (July 30, 2026), https://www.venable.com/insights/publications/2026/07/2026-mid-year-state-privacy-law-update (on file with the Tennessee Law Review) (last visited Sep. 24, 2026).
[17] Id.
[18] Solove, supra note 13.
[19] See U.S. State Comprehensive Consumer Data Privacy Law Comparison, Foley & Lardner LLP (Jan. 15, 2026), https://www.foley.com/wp-content/uploads/2026/01/U.S.-State-Comprehensive-Consumer-Privacy-Law-Comparison-Chart_V16.pdf (on file with the Tennessee Law Review) (last visited Sep. 24, 2026).
[20] N.H. Rev. Stat. Ann. § 507-H:2.
[21] Tenn. Code Ann. § 47-18-3303.
[22] See Solove, supra note 13.
[23] See U.S. State Comprehensive Consumer Data Privacy Law Comparison, supra note 19.
[24] Id.
