For advertisers, privacy is stuck in purgatory—at least on the federal side.

Lina Khan, an advocate for consumer privacy, is no longer leading the Federal Trade Commission. And even though some federal privacy legislation has made its way through Congress, legislators on the Hill have yet to pass any such bill.

What’s an advertiser to do? At Marketing Brew’s Tactical MarTech event last month, a trio of privacy advocates told us to continue looking at the states, where the patchwork quilt of privacy legislation continues to grow ever more complex in the absence of any significant movement on the federal side.

“You have a lot of states that are trying to assert dominance,” Richy Glassberg, co-founder and CEO of SafeGuard Privacy, said during a panel discussion.

What’s coming

Since 2018, at least 19 states from California to Delaware have passed comprehensive privacy legislation, according to the IAPP’s State Privacy Legislation Tracker. Last year, at least six states signed privacy bills into law. At least a dozen states are considering privacy legislation, including Oklahoma, Pennsylvania, and Illinois.

Though much of the draft legislation contains similarities, they all have their own peculiarities, meaning there are plenty of state-specific details that might not cross state lines. One of the newer laws is the Maryland Online Data Privacy Act, which is slated to go into effect in October. It’s considered to be one of the strictest in the country because of its emphasis on data minimization, which requires that companies only collect data that is “reasonably necessary and proportionate to provide or maintain a specific product or service,” instead of sucking up everything. More specifically, the law will require companies to only collect data to “provide or maintain a specific product or service requested by the consumer.”

Rowena Lam, senior director of privacy and data at the IAB Tech Lab, said that the requirement will pose some challenges for advertisers.

“That is the piece that’s different from other state laws that kind of has us scratching our heads a little bit…Are [customers] ever requesting that you show them ads?” Lam said.

Other privacy laws aim to curb the collection of health-related data, which took on added urgency after the Supreme Court overturned Roe v. Wade in June 2022. In 2023, Washington State passed the My Health, My Data Act (MHMD), which aimed to fill the gaps left by the Health Insurance Portability and Accountability Act (HIPAA), a federal law that protects data collected by “covered entities” like doctors and dentists, but not by search engines or mobile apps.

There are still questions about how MHMD may affect marketers, since advertisers can be in the habit of making inferences about consumer behavior based on available consumer data, Lam said.

“It’s really murky as to what can be considered an inference of sensitive health information, according to Washington’s My Health, My Data Act,” she said. “If a consumer is shopping for a running shoe, can I make the leap to say that maybe they’re trying to lose weight? That’s all very unclear today.”

In January, New York passed the New York Health Information Privacy Act. Though not a clone of MHMD, the bill has a broad definition of “health information,” including “any information that is reasonably linkable to an individual, or a device, and is collected or processed in connection with the physical or mental health of an individual,” as well as inferences or assumptions made about consumers.

On the Hill

As states continue to pass their own laws, federal efforts have stalled out. It’s unclear what will happen to the FTC’s attempts to regulate sensitive health data or how much of a priority consumer data will ultimately be under the Trump administration.

And Congress has repeatedly failed to pass either the Kids Online Safety Act or an update to the Children and Teens’ Online Privacy Protection Act, both of which aim to curb how advertisers and tech companies interact with minors.

Zoom out

Maybe all hope is not lost? In January, Sen. Ron Wyden called privacy an “urgent” bipartisan issue while attending the IAB’s Annual Leadership Meeting, tying the lack of legislation to national security concerns.

“We want to protect people’s healthcare data, people’s education data and people’s job data,” he said at the time.