Why We Need More State Privacy Laws

A push for more federal-level protection

Key Takeaways

  • Colorado is the third state to enact data privacy laws, following in the footsteps of California and Virginia.
  • While mainly designed around how companies handle data, the laws do have a positive effect on consumers.
  • Experts say the push for more state privacy laws could eventually lead to federal-level changes, something the United States needs more than ever.
A concept images of personal data displayed on a computer screen.

Vertigo3d / Getty Images

New data privacy laws in Colorado, California, and Virginia might not seem designed to help consumers on the surface, but experts say the overall effect they have on how consumer data is handled could lead to federal-level changes.

Colorado is the most recent state in the United States to pass comprehensive data privacy laws that control how companies handle people’s sensitive data. The new legislation in Colorado forces companies to comply with requests from consumers to delete sensitive information. Additionally, it also forces companies to ask for permission to hold data like Social Security numbers and more.

While these laws only affect residents of the state, experts say the success of bills like the Colorado Privacy Act—and similar bills in California and Virginia—could lead to sweeping changes on a federal level.

"These state laws are important because they are putting increasing amounts of pressure on Congress to finally get something done in the way of a federal data privacy law while laying down the blueprint for what such legislation should look like on the federal level," Attila Tomaschek, a researcher and privacy expert with ProPrivacy, told Lifewire in an email. 

Laying Foundations

Tomaschek says the limits that we’re seeing imposed on companies by states that pass these bills will give Congress and other national ruling bodies a good idea of what is working and what should be expanded. 

"These state laws are important because they are putting increasing amounts of pressure on Congress to finally get something done in the way of a federal data privacy law..."

"In the absence of federal data privacy legislation that protects all Americans equally, it has been up to individual states to enact laws that protect their residents. Colorado is the latest, but certainly not the last state to step up and establish legislation that gives consumers more rights to control how their data is used," Tomaschek explained.

Of course, having privacy laws on a national level would prove far more valuable than state-based laws. For one, state laws don’t provide equal protection for all Americans throughout the country. Even as other states start to pass their own forms of privacy protection acts, it's possible they could pick and choose the parts they want to support.

Other issues, Tomaschek notes, could negatively affect consumer data privacy and possibly even put that data at risk.

"One major concern about having multiple individual state laws on the books and no overarching federal legislation is that businesses may run into compliance issues and confusion over their obligations under each individual, differing state law," Tomaschek said.

"This could potentially lead to certain negative effects on consumer privacy if companies end up having trouble complying appropriately with a patchwork of data privacy laws."

Keeping Up

This trend of data privacy laws comes in the wake of the EU’s General Data Protection Regulation (GDPR), pushing for stricter control over consumer data. The GDPR initially was implemented in 2018, but recent moves by big tech companies like Apple have helped highlight the need for consumers to have more control over how their data is collected and used.

Security concept image with three digital locks on a screen that also reads "protect information."

Vertigo3d / Getty Images

More and more users are learning that they don’t have to share the data that they’ve been freely giving companies for years, and it’s forcing the hands of government bodies.

Colorado may only be the third state to pass a privacy protection act, but other states like Texas and Washington state are working on their own laws. Additionally, we’ve also seen states like Nevada making changes to older laws, trying to bring them more up to date. 

While states seem to be racing to get more privacy laws in place, Tomaschek says legislators must approach things correctly. Otherwise, these new laws could effectively be “watered down” before they even go into practice. One primary way to avoid this is to operate on an opt-in basis instead of forcing consumers to opt-out.

"If a state’s legislation concerning data collection operates on an 'opt-out' basis—meaning that consumers must expressly opt-out of data collection by companies to prevent them from collecting their data on websites—the overall strength of the legislation is effectively watered down," he explained.

Was this page helpful?