20 states now have comprehensive data privacy laws as Congress fails to act

By February 2026, 20 states had enacted comprehensive consumer data privacy laws including California, Colorado, Connecticut, Virginia, and newly added Indiana, Kentucky, and Rhode Island, creating a patchwork of conflicting standards. Congress repeatedly failed to pass the American Privacy Rights Act, which would have established a single federal standard. The state-by-state approach left consumers in 30 states without comprehensive protections and created compliance costs hardest on small businesses.