States Are ‘Laboratories of Democracy’ for Privacy Regulation as Federal Legislation Stalls

Hashed & Salted | A Privacy and Data Security Update

In the ongoing absence of comprehensive federal privacy laws, states continue to serve as the primary engines of privacy innovation, setting precedents that may influence or even outpace federal action and shaping the rules of the road for the digital economy. According to recent research from the Interactive Advertising Bureau (IAB), the digital economy now accounts for $4.9 trillion in value (18% of U.S. GDP) and supports over 28 million internet-dependent jobs. Current—and future—U.S. privacy law and policy will play a significant role in shaping the growth and health of the digital marketplace and the U.S. economy more broadly.

At the IAB Public Policy & Legal Summit last month in Washington, D.C., Loeb partner Robyn Mohr, deputy chair of the Privacy, Security & Data Innovations practice, moderated “Laboratories of Democracy: Privacy in the States,” a panel discussion with leading public policy, technology and compliance experts, exploring the state-driven evolution of privacy law in the U.S., the emerging complexity and fragmentation as states take divergent approaches, and the resulting challenges for lawmakers, regulators and companies, as well as the significant economic and political implications.

Reid Wilson, a leading state-level political and legislative analyst and founder of Pluribus News, and Andrew Kingman, president of Mariner Strategies LLC, a leading state public policy firm specializing in privacy, teed up the discussion of the political and legislative landscape, with Kingman focusing on national/industry implications and Wilson focusing on the broader political context and the role of elections. The panelists discussed key trends in state-level privacy legislation and divergences in legislative approaches, which create compliance challenges and uncertainty for businesses operating nationwide, as well as which states are most likely to consider or pass new privacy laws in 2026.

Joined by Delaware State Delegate Krista Griffith, chair of the Delaware Artificial Intelligence Commission, and New Jersey State Sen. Raj Mukherji, the panel turned to the political, economic and cultural factors driving divergence across state privacy frameworks, the political motivations and policy rationales, and the implications of these differences, including potential conflicts with federal proposals and the challenges companies face in harmonizing compliance efforts. From a legislative standpoint, the panel explored the most significant challenges lawmakers face in drafting, advancing and implementing privacy legislation.

In particular, the panel talked about the tension between the legislative and regulatory goals of protecting consumers’ personal data and privacy rights and fostering innovation, how lawmakers and regulators are attempting to navigate this balance in policy, and how these efforts are playing out in the real world on businesses, particularly small businesses.

As states continue to legislate, regulate and iterate privacy policy, companies face significant operational challenges in developing and implementing compliance models in an increasingly complex and fragmented environment. The panelists offered insights into allocating limited resources to maximize risk management for the current environment while also being prepared for new legislative and policy developments on the horizon, in particular in the states or regions that may drive the next wave of privacy lawmaking.