States Push Privacy Laws As Congress Faces Pressure

Data Privacy Week in January 2026 has brought renewed urgency and national debate to the question of how Americans’ personal information is protected in the digital age. As technology continues to advance at a dizzying pace, the United States remains without a unified federal data privacy law, leaving a patchwork of state regulations and, according to advocates and critics alike, exposing millions to unnecessary risk and confusion.

On January 27, 2026, Consumer Reports unveiled the State Location Privacy Act, a model piece of legislation aimed squarely at protecting the precise geolocation data of American consumers. The Act, as detailed by Consumer Reports, bans the sale of precise geolocation information and strictly limits its collection and processing to what is absolutely necessary to deliver the good or service the consumer has requested. It also requires companies—referred to as controllers—to provide clear, upfront notice about when and how they collect and use this sensitive data.

“The use of location data, such as to provide GPS directions, can be incredibly helpful for consumers in their daily lives, but this information should be treated with the utmost respect for consumer privacy. All too often, this information, which can reveal the patterns of our daily lives and visits to sensitive locations like health facilities, political rallies, and places of worship, is sold to dozens of third-parties. This practice needs to stop,” said Matt Schwartz, policy analyst at Consumer Reports, as quoted in their official release.

The State Location Privacy Act doesn’t just set out rules—it packs an enforcement punch. It includes strong provisions such as a private right of action, allowing individuals to take legal action if their privacy rights are violated. The legislation has drawn endorsements from a coalition of prominent organizations, including the Electronic Privacy Information Center (EPIC), Consumer Federation of America, Privacy Rights Clearing House, Public Knowledge, the Center for Democracy and Technology (CDT), Public Interest Research Group (PIRG), and TechEquity. These groups are united in their push for meaningful, enforceable privacy rights, and they see the Act as an important blueprint for states considering how to move forward.

To date, only Maryland and Oregon have enacted laws that ban the sale of precise geolocation information. But momentum is building. According to Consumer Reports, several other states—including California, Maine, Massachusetts, New Mexico, Vermont, Virginia, and Washington—are expected to consider similar bans in 2026, either as standalone bills or as part of broader privacy reforms.

This state-level action comes against a backdrop of mounting frustration with the absence of a nationwide standard. As NetChoice, a technology trade association, highlighted in its own Data Privacy Week article published the same day, the lack of federal leadership has created what they call “a dizzying patchwork of conflicting regulations.” According to NetChoice, this patchwork is a nightmare for small business owners and a bonanza for lawyers, as companies are forced to navigate up to 50 different sets of rules just to operate across state lines.

NetChoice argues that this regulatory confusion doesn’t just cost businesses time and money—it undermines security for everyone. Hackers and data brokers, they warn, exploit the gaps and loopholes in this fractured system. The risks are especially acute for children. The organization cites data showing that 82% of K-12 schools experienced a cyberattack over an 18-month period, and that a staggering 25% of children are expected to experience identity theft before they turn 18.

“The need for a national standard isn’t just a theoretical policy debate; it’s a matter of urgent safety for everyone, especially our most vulnerable citizens,” NetChoice wrote. The group is calling on the 119th Congress to make a federal privacy and security standard its top priority in 2026. Their vision is a law that would preempt state rules—meaning it would be the single, controlling standard nationwide—and that would require companies to protect the confidentiality and integrity of the data they hold.

NetChoice also advocates for a “right to cure,” giving businesses a chance to fix honest mistakes before facing lawsuits. The group warns against what it sees as overzealous enforcement that could enrich trial lawyers without actually improving consumer protection. And, crucially, they want any new law to preserve the positive uses of data—such as personalized recommendations, discounts, and the research and development that drives technological progress.

“We need an American standard that reflects American values: protecting privacy while fostering the free enterprise that makes our tech sector the envy of the world,” NetChoice asserted. The organization points out that data privacy is, by its very nature, an interstate issue, since data flows across state lines constantly. They argue that only Congress, with its constitutional authority over interstate commerce, can solve the problem.

Despite previous attempts, bipartisan frameworks in Congress have repeatedly stalled over two thorny issues: preemption (whether federal law should override state laws) and enforcement (how strictly the law should be applied, and by whom). But, as NetChoice notes, “almost isn’t good enough when 1.7 billion data breach notices were sent to consumers in 2024 alone.”

The stakes are high. Without a federal standard, Americans’ privacy rights can change the moment they cross a state border. Some states, like California, have adopted sweeping laws that critics say are overly broad and vague, potentially ensnaring even basic business tools like Excel spreadsheets. Others have taken a lighter touch, or none at all. The result is a system where consumers and businesses alike are left guessing—and where bad actors can thrive in the cracks.

Both Consumer Reports and NetChoice agree on one thing: the current system isn’t working. While Consumer Reports is focused on immediate, state-level protections—especially for sensitive geolocation data—NetChoice is pushing for a comprehensive, national solution that would bring clarity and consistency to the rules of the digital road.

In the meantime, both organizations encourage individuals to take charge of their own digital footprints. NetChoice, for example, urges Americans to use the privacy tools already available on digital services, including parental controls. But they also caution that individual action can only go so far in a world where data moves at the speed of light and cyber threats are ever-present.

With Congress facing mounting pressure from all sides, 2026 could finally be the year the United States moves beyond its patchwork approach and sets a clear, national standard for data privacy. Whether lawmakers can overcome the familiar obstacles remains to be seen, but the stakes for consumers, businesses, and the nation’s digital future have never been clearer.