The patchwork of state privacy laws in the United States is expanding rapidly, with 21 states now enforcing consumer data privacy laws and over 41 states actively considering new legislation in early 2025. During a panel discussion hosted by Venable, privacy law attorneys emphasized the increasing role of states in shaping privacy requirements, as federal lawmakers have not yet passed a comprehensive national standard.
“In the absence of a federal law, states have really moved in to fill the vacuum,” said Mike Signorelli, a co-chair of Venable’s Technology and Innovation Group. While the state-led approach provides consumer protections, it also risks fragmentation, with varying definitions and enforcement mechanisms. Some states, such as Minnesota and Oregon, are now requiring businesses to disclose specific lists of third parties with which they share consumer data. Others, like Maryland, have introduced stringent data minimization rules that could significantly alter how companies can innovate and reach new customers with their product and service offerings.
Julia Tama, a co-chair of the firm’s Privacy and Data Security Group, noted that while the differences in regulation could lead to confusion for businesses and consumers alike, the examples set by the states are helping to shape the legislative conversations nationwide. “There’s a lot that can be learned from what has happened in the states—what has been effective and what is creating confusion, particularly among the business community,” she said.
Renewed Energy for National Privacy Legislation
Despite growing momentum at the state level, federal privacy legislation remains the goal of industry participants to prevent the patchwork from growing. The panelists reflected on the failure of last year’s American Privacy Rights Act (APRA) to pass into law, which would have imposed strict limits on data collection and advertising. Partner Rob Hartwell highlighted concerns that APRA’s rigid data restrictions could have unintended economic consequences.
With a Republican-controlled Congress and White House and new leadership on the relevant committees, lawmakers have restarted discussions. Hartwell noted that “The Energy and Commerce Committee is devoting resources, which shows commitment to the effort. They’re starting from a blank sheet of paper,” which gives both Congress and stakeholders the opportunity to take a fresh approach to what a federal privacy standard would include. While Congress appears open to borrowing from state privacy models, the details of any proposal will be key to negotiations. Meanwhile, bipartisan efforts to strengthen child and teen privacy protections, such as COPPA 2.0 and the Kids Online Safety Act, are expected to move through the legislative process on their own track.
FTC Chair Signals Shift in Privacy Enforcement Priorities
On the federal enforcement front, the Federal Trade Commission (FTC) is expected to take a different approach under its new leadership. Andrew Ferguson, recently appointed FTC chair by President Trump, has voiced skepticism about the agency’s past enforcement actions, calling some cases “novel or legally dubious.” In particular, his prior statements indicate that the agency under his leadership may depart from the previous FTC’s stances on AI regulation and targeted advertising.
However, the agency remains committed to privacy enforcement, particularly regarding data brokers and children’s privacy. Meanwhile, state attorneys general continue to pursue privacy violations, with California leading the charge against companies that fail to comply with state data broker registration and consumer opt-out requirements.
As states push forward with new regulations and federal lawmakers attempt to unify the landscape, businesses must navigate an increasingly complex privacy environment. With new proposals emerging in Congress and across the states, 2025 is shaping up to be another pivotal year for privacy law in the United States.
To learn more about upcoming webinars or watch past recordings from our series, Transition Outlook: What to Expect from the Second Trump Administration, click here. The weekly webinar series runs through March 2025.