The Absence of a US Federal AI Privacy Law

The absence of a US federal AI privacy law is not simply a delay in regulating a new technology. It reflects unresolved disputes over who sets privacy standards and who can enforce them. Those disputes have left state laws as the operative system, making privacy built into the design of systems a more rational response than waiting for Congress to simplify the rules.

Why the US has no federal AI privacy law, and why that is unlikely to change soon

IAPP's September 2026 tracker counts 49 distinct federal privacy proposals in the 119th Congress, but only two have become law. The TAKE IT DOWN Act, signed May 19, 2025, prohibits non-consensual intimate imagery, including AI-generated deepfakes. The Homebuyers Privacy Protection Act, signed September 5, 2025, is also narrow and sector-specific. Neither supplies a comprehensive framework governing AI or the privacy of the data it processes. The lack of a broad law cannot be blamed on too few proposals, especially when the disputes blocking agreement show no sign of easing.

How three rival federal bills expose the two fault lines that keep killing comprehensive legislation

Three comprehensive privacy proposals introduced in spring 2026 show how substantial agreement on rights can coexist with deadlock over legislation. All three provide access, correction, deletion, data minimization, sensitive-data rules, and security obligations. Yet they stalled on two questions, namely whether federal law should displace stronger state protections and whether individuals should be able to sue companies directly. These questions determine which protections survive and who has the power to enforce them.

Rep. Zoe Lofgren's Online Privacy Act of 2026 (H.R. 8014), introduced March 19, 2026, preserves state privacy laws and includes a private right of action. Sen. Jerry Moran's Consumer Data Privacy and Security Act of 2026 (S. 4211), introduced March 25, 2026, takes the opposite approach, preempting covered state laws and excluding a private right of action. The June 2026 SECURE Data Act hearing exposed the political divide behind those choices. Republicans argued for one national standard, while Democrats and privacy advocates argued that federal law should keep the stronger protections states already have.

A shared set of obligations does not settle whether federal protection should be a floor or a ceiling. Nor does it settle whether people should be able to bring their own claims to enforce the law. No committee markup is scheduled for any of the three proposals. IAPP managing director Cobun Zweifel-Keegan has said there is “no bipartisan privacy bill that has any meaningful momentum” and called passage before year-end “vanishingly small”. These same two disputes have killed every prior attempt at comprehensive legislation.

Why the preemption fight is especially hard to resolve — and who is actually driving it

Preemption is especially difficult because the conflict does not divide neatly into industry on one side and government on the other. Industry wants federal preemption to escape the state patchwork, but it has repeatedly opposed comprehensive federal bills that would have delivered it. That opposition leaves states to fill the void, which then strengthens industry's demand for a single standard. The resulting loop sustains the very fragmentation that preemption is supposed to solve.

State officials have a different concern, which is the loss of protections already in force. California regulators and a coalition of state attorneys general have argued that bills such as the SECURE Data Act would displace stronger state safeguards. They include Illinois' Biometric Information Privacy Act and Washington's My Health My Data Act. From this perspective, the value of national uniformity depends on what the national rule preserves.

Congress has also rejected the White House's plans for state AI rules. A 99-1 Senate vote stripped a 10-year freeze on state AI laws from the “One Big Beautiful Bill Act”, following other failed attempts at a federal moratorium. The Republican coalition itself is divided, with lawmakers across many states concerned about overriding state authority. Republican-led Florida and Texas have advanced their own AI governance frameworks and are not uniformly willing to surrender that role. Neither a preemption bill nor a state-preserving bill can currently assemble a majority because each coalition faces internal defections.

How the Trump administration's deregulatory posture removed the federal baseline without replacing it

The legislative impasse is compounded by a change in executive policy. Trump's January 2025 executive order, “Removing Barriers to American Leadership in Artificial Intelligence” (EO 14179), revoked the Biden administration's AI safety framework and prioritized deregulation and innovation. The July 2025 AI Action Plan followed that change in direction. The March 2026 National Policy Framework for Artificial Intelligence offered legislative recommendations. The sequence removed the prior federal baseline without building a comprehensive legal framework in its place.

The March 2026 recommendations call for Congress to preempt state AI laws that impose undue burdens. They also preserve proposed carve-outs for child protection, fraud prevention, consumer protection, zoning, and state AI procurement. But the recommendations are non-binding and create no immediate compliance obligations.

Congress has neither passed this framework into law nor settled its disagreements through a comprehensive law. Its rejection of a state-law freeze shows resistance to one proposed route, but does not establish an alternative federal floor. The structural consequence is a governance vacuum at the comprehensive federal level. Executive orders, the agencies that already enforce rules, and state efforts still play a role. Nevertheless, the most consequential AI privacy rules are now being made at the state level, without a coherent federal structure connecting them.

What states have built in the federal vacuum — and why it is not a substitute for federal law

As of March 2026, a large majority of US states have comprehensive privacy laws, and 44 states have at least one AI law on the books. Over 2,182 AI-related bills had been introduced across the country as of May 2026. Indiana, Kentucky, and Rhode Island laws took effect in 2026, adding assessment, notice, and transparency obligations. That scale makes state regulation consequential, but the number of laws does not make them a national framework.

Different regimes can impose different duties on the same tool at the same time. An organization can face mandatory bias audits in one state, developer safety reporting in another, and no specific obligations in a third. Compliance is therefore not just a matter of meeting a common standard with local variations. It requires identifying which kinds of duties attach in each jurisdiction. The distinction matters because obligations to assess, report, disclose, and provide rights are not interchangeable.

Colorado illustrates how the target can also shift within a single state. Organizations built their compliance programs to meet SB 24-205's duty-of-care standards and its requirements for risk management documentation, impact assessment workflows, and attorney general notification procedures. The replacement law, SB 26-189, stripped those obligations and substituted a transparency-and-rights framework centered on disclosure, post-adverse-outcome explanations, correction rights, and meaningful human review. Much of what those programs had been built to do was therefore out of date.

Litigation adds another source of uncertainty. xAI LLC filed suit on April 9, 2026, against Colorado's Attorney General, challenging SB 24-205 on First Amendment, Commerce Clause, due process, and equal protection grounds. The suit is among the most far-reaching legal challenges yet to state-level AI governance, though a challenge is not itself a ruling. Meanwhile, Oklahoma and Louisiana have enacted comprehensive privacy laws taking effect January 1, 2027, and Alabama's takes effect May 1, 2027. Vermont's more expansive law begins in 2028, extending the planning horizon without resolving the lack of national coherence.

How inconsistent state definitions and compliance burdens fall hardest on organizations without legal armies

The burden of this fragmentation is uneven. A company can spend hundreds of thousands of dollars a year on AI compliance, with more costs for the first rounds of audits and for monitoring across the whole business. Smaller and mid-market organizations pay those costs without the resources that large technology companies have. The US Chamber of Commerce has argued that conflicting state and local AI laws create a broader economic drag, with a majority of small businesses nationwide concerned about rising litigation and compliance costs.

Differences in legal scope compound that asymmetry. Organizations covered by California's SB 53 or Connecticut's SB 5 have to keep meeting substantial requirements that do not apply to competitors working only in states with fewer rules. At the same time, the absence of common definitions for “AI system”, “high-risk”, and “consequential decision” forces organizations to run parallel compliance analyses. The first task is establishing how different laws classify the same system or decision, with no shared baseline for assessing whether a system meets a rule.

Because AI systems process personal data, these gaps in how laws classify systems and what they require also put privacy at risk. Which protections apply depends on the state law that covers the activity, with no common federal floor. Systems built with data minimization and user control from the start are better positioned to meet multiple state regimes without redesigning for each one. Those properties reduce reliance on expensive retrofits by making privacy part of the system's underlying design.

Children's privacy as the one narrow area where federal consensus is forming

Children's online privacy is the clearest exception to the broader stalemate, but its boundaries reinforce the larger argument. On August 5, 2026, the Senate Commerce Committee advanced a slate of children's online safety bills to the full Senate. The Youth AI Privacy Act (S. 4199) would require AI chatbot deployers that know a user is a minor to disclose that the user is talking to an AI. It would also bar profiling, advertising, and training on minors' data, and direct the FTC to write rules against compulsive-use features.

The bill's status also limits what can be inferred from its progress. The Commerce Committee ordered it reported with a substitute on August 5, 2026, but the substitute text has not yet been published, and the bill has not passed either chamber. The GUARD Act, advanced earlier by the Senate Judiciary Committee, supplies further evidence of movement on children's AI safety. IAPP's tracker shows that children's and educational privacy account for a disproportionately large share of federal proposals. Congress is effectively treating this area as a distinct technology-policy field.

Children's privacy draws support for action from both parties in a way that general consumer privacy has not. Even this narrower alignment has not yet turned these proposals into enacted law. Nor would the carve-out supply a comprehensive federal framework for adult privacy, employment AI, or AI in consequential decisions. Federal action is possible when political conditions align, but this exception shows how limited that alignment remains.

What the crisis-forcing scenario actually looks like, and why waiting for it is not a policy

A crisis could change the political conditions, but that possibility is not a dependable route to comprehensive protection. The crisis-forcing scenario assumes that an incident becomes serious enough to overcome the disputes that ordinary legislative bargaining cannot resolve. It does not establish that those disputes disappear. Lawmakers could instead agree on a narrow response to the incident while leaving preemption and private enforcement unsettled.

Meanwhile, state amendments are adding rules for precision geolocation, facial recognition, and children's data to existing frameworks. Organizations must plan to satisfy the operative patchwork while remaining adaptable if a federal standard eventually arrives. Treating fragmentation as a temporary inconvenience obscures that task. Instability may produce more legal change without producing national consistency.

Systems built to collect less data and honor user control serve the aims of many state laws, even when the details of those laws differ. This provides a more resilient foundation for meeting applicable legal requirements across fragmented and evolving regimes. The patchwork is the system organizations must work within, and waiting for federal law is not a strategy for protecting the data they process today.