States Ready Face-Off Against Congress, ‘Tech Bros’ on Privacy

State attorneys general are preparing to resist a House Republican privacy proposal, saying it would undercut their ability to police emerging harms tied to artificial intelligence, social media, and data collection.

National Association of Attorneys General President William Tong said in an interview that the attorney general community will “deploy all of our resources to try to protect data privacy laws in our states and to protect data that belongs to citizens in our states and the people in our states.”

Any effort to block states from acting would amount to “a giant, wet kiss to the tech industry and the tech bros,” said Tong, who is Connecticut’s attorney general.

Attorneys general from both parties have spent years enforcing a slew of privacy protections in their states. The SECURE Data Act (H.R. 8413), a national privacy framework introduced by House Republicans last month, would preempt state provisions that go beyond it.

The legislation includes baseline protections already found in many state laws. But residents in states with stronger privacy protections, such as Connecticut, would have fewer protections in areas like universal opt-out rights, consumer rights to sue over violations, and safeguards that overlap with AI and social media regulation.

Driving Policy

State attorneys general play an important part in advising legislatures on bills that grant them enforcement authority, which is how the majority of state privacy laws are written. They seek provisions in enforcement reports and testimony before legislatures. In some cases, they even submit draft legislation. They also lobby for federal changes, including, most recently, calls for Congress to regulate AI chatbots.

“We have a huge role to play in the policy conversation,” Tong said.

“In the absence of strong congressional action, that responsibility falls to us in the states, and in particular to attorneys general,” he said.

They’ve taken up that call when it comes to privacy. Twenty-one states have enacted comprehensive privacy laws as of this month. It is largely up to attorneys general to enforce most of them.

“What we really have seen is that the federal legislature has not been able to come to decisions about what privacy compliance has looked like, so the states have moved forward with that,” said Daniel Goldberg, a partner at Frankfurt Kurnit Klein & Selz PC.

Now, as Congress takes its latest swing at federal privacy standards, the attorneys general are mobilizing to protect their years’ worth of work.

“This would be a disaster for Connecticut,” Tong said. “It purports to preempt and utterly gut state laws like the ones passed by Connecticut. And ours are robust, and we’re seeking to make them even more robust.”

Tong said Connecticut’s law gives consumers stronger tools than the federal proposal, including a universal opt-out mechanism. By contrast, he said, the federal bill “barely scratches the surface.”

New Mexico’s attorney general, who has pushed for child safety legislation and is preparing to propose data privacy measures to state lawmakers in the upcoming session, also rebuked the federal proposal.

“States have long served as laboratories for consumer protection, and New Mexicans should not be denied stronger protections because Congress chose the lowest common denominator,” New Mexico Attorney General Raúl Torrez wrote in an email to Bloomberg Law.

California’s privacy agency raised similar concerns. The California Privacy Protection Agency, which enforces that state’s privacy law, is urging Congress to reconsider any preemptive federal bill, and agency officials are expected in Washington this month to lobby against it.

Federalism in Limbo

The federal bill, while still far from becoming law, adds to tension between the federal government and the states over who reigns supreme when it comes to regulating emerging technologies. Connecticut defied warnings from Washington not to regulate predictive markets when it’s Department of Consumer Protection Gaming Division sent cease and desist letters to several predictive markets in April. That enforcement action resulted in a lawsuit from the Commodity Futures Trading Commission.

Connecticut lawmakers also moved ahead this week by sending what supporters called the nation’s most comprehensive AI legislation to the governor’s desk, in defiance of a warning from President Donald Trump against states regulating the technology.

Goldberg said state privacy laws that are touted by lawmakers as models for the federal legislation already go beyond the ceiling the GOP framework would set. The question before federal lawmakers is how to take those state laws—and the attorneys general who enforce them—into account.

“It would substantially weaken privacy enforcement around the United States. The question is, should we weaken it?” he said.