After the American Data and Privacy Protection Act (ADPPA) didn’t pass last year, the House Energy and Commerce Committee has begun drafting a new version that they hope will advance this year on the House floor. In the meantime, individual states are taking it into their own hands to push forward on data privacy legislation in the absence of Congressional efforts. A new amendment to a California digital privacy law passed in 2018, enforceable as of July 2023, allows residents the right to limit the use and disclosure of sensitive personal information collected about them while also requiring businesses to alert consumers to their privacy practices. The law also calls for the creation of an entity dedicated to enforcing the law, where the California Privacy Protection Agency will be taking over rulemaking from the California attorney general. In Colorado, a new law requires businesses to adopt opt-in permission requests from consumers before processing their sensitive data, which is seen as a strong consent standard to process personal data. This law also expands to nonprofit organizations beyond just commercial entities. A Connecticut law also requires businesses to adopt opt-in permission requests before sharing consumers’ personal data. It goes beyond the precedent of other state laws by implementing more stringent default protections for adolescents’ data, limiting the use of facial recognition technology, and offering greater choice for consumers on how their data is handled. With the lack of federal legislation and the growing momentum of state digital privacy rules, privacy advocates and industry officials alike seek a singular national standard governing data privacy protection, attempting to avoid an environment of individual state laws that are disparate and provide uneven protections with the potential to cause costly compliance burdens and overall confusion.