The United States now has more than a dozen active state consumer privacy laws, each with its own definitions, requirements, rights mechanisms, and enforcement apparatus. California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Indiana, Tennessee, and Florida have all passed comprehensive privacy legislation. Several more are in active enforcement or late-stage implementation. The map is not converging — it is fragmenting further every legislative cycle.

For mid-market brands managing digital advertising campaigns across a national customer base, this patchwork has crossed from “compliance complexity” into operational unmanageability. The case for a federal privacy framework — one that preempts the state patchwork and establishes a single national standard — is now a practical business argument, not just a regulatory preferences argument.

The Texas TDPSA and What Enforcement Looks Like in Practice

Texas’s Data Privacy and Security Act went into effect July 1, 2024. Enforcement by the Texas Attorney General has been active, and the TDPSA’s provisions — particularly around sensitive data processing, opt-out requirements for targeted advertising, and universal opt-out mechanism recognition — are substantively different from California’s CCPA/CPRA framework in ways that require separate compliance implementation.

Texas specifically requires businesses to recognize opt-out signals transmitted through universal opt-out mechanisms. This provision, also present in Colorado and Connecticut but implemented differently, means that a brand’s consent management platform needs to be configured to recognize multiple opt-out signal types (GPC signals, browser-level opt-outs, platform-specific mechanisms) and map them correctly to each state’s requirements.

The Texas Attorney General’s enforcement actions have focused particularly on AI-driven targeted advertising where sensitive inferences are drawn from behavioral data. AI-generated ad creative that uses behavioral signals to construct audience profiles is a priority enforcement area — which matters enormously given that AI-generated creative now represents an estimated 30% of digital display inventory.

The AI creative intersection with privacy law is underappreciated. When an AI system generates personalized creative variants based on inferred audience characteristics — income bracket, health interest signals, family status — it may be drawing sensitive inferences that trigger disclosure and consent requirements under multiple state laws. The creative generation layer is now a privacy compliance surface.

The Oregon Consumer Privacy Act: One More Different Standard

Oregon’s Consumer Privacy Act became effective July 1, 2024. Oregon’s law includes provisions that are meaningfully different from California and Texas in several respects: the definition of “sensitive data” is broader in some categories, the data minimization requirements are more specific, and Oregon’s requirement for data protection assessments extends to a wider range of processing activities than comparable provisions in other states.

For brands running national campaigns with Oregon addressable audiences, these distinctions are not academic. An Oregon data protection assessment requirement for behavioral advertising means documented analysis of the processing activity’s necessity, proportionality, and risk to data subjects — substantially more formal than California’s privacy risk assessment framework.

The compounding compliance problem is this: a brand advertising in California, Texas, and Oregon needs three different compliance analyses for the same campaign, because the definitions of “sensitive data,” the scope of data protection assessment requirements, and the opt-out mechanism specifications are materially different across those three jurisdictions. A legal and compliance team that was adequate for a CCPA-only world is not adequate for this world.

The Mid-Market Compliance Gap

Large enterprises — Fortune 500 brands, major holding company agency clients — have the resources to maintain state-by-state compliance matrices, retain specialized privacy counsel, and fund the CMP (Consent Management Platform) configuration complexity that multi-state compliance requires.

Mid-market brands — companies with $50M to $500M in annual revenue running national advertising campaigns — face a compliance gap that is causing real business problems. The specific manifestation: CMPs configured for California compliance may not correctly implement Texas opt-out signal recognition. Data processing agreements with DSP and publisher partners may not include Oregon data protection assessment language. AI-generated creative workflows may not have human review stages that document the basis for audience inference.

The cost of remediating these gaps is not trivial. A mid-market brand bringing its advertising data practices into multi-state compliance — auditing data flows, reconfiguring CMPs, updating partner agreements, implementing assessment processes — faces a significant investment that diverts resources from the marketing programs the investment is theoretically protecting.

The practical consequence is that many mid-market brands are operating in a state of partial compliance — meeting California requirements because the CCPA enforcement history makes non-compliance expensive, and hoping that Texas and Oregon enforcement doesn’t reach their scale of operation before the regulatory environment clarifies.

AI-Generated Creative as a Privacy Compliance Surface

The most underappreciated privacy compliance challenge in digital advertising in 2026 is AI-generated ad creative. Thirty percent of digital display inventory — a figure cited by multiple industry tracking sources and consistent with platform data from Meta, Google, and programmatic networks — is now AI-generated or AI-assisted.

AI creative generation systems that use audience behavioral signals as inputs to creative personalization are, in a meaningful legal sense, processing personal data for the purpose of generating targeted advertising. The specific process — behavioral signals in, personalized creative out — involves data processing that may constitute “profiling” under some state definitions, “targeted advertising” under others, and potentially “automated decision-making” under the most expansive state frameworks.

The IAB’s guidance on AI in advertising has not yet produced clear compliance standards for AI creative generation at the intersection of multiple state privacy laws. Legal teams at ad tech companies and brands are navigating this largely through conservative interpretations — documenting the basis for AI creative decisions, limiting sensitive data use in creative generation inputs, and building human review stages for creative targeting campaigns.

This is not a sustainable long-term approach. The volume of AI-generated creative is increasing, the personalization depth is increasing, and the legal clarity is lagging significantly.

The Federal Preemption Argument

The American Privacy Rights Act (APRA) has been in Congressional discussion for multiple sessions. Its most recent version includes provisions that would create a national consumer privacy standard with federal preemption of state laws — meaning companies complying with APRA would not face separate state law requirements.

The industry consensus in favor of federal preemption is broader than it has ever been, precisely because the state patchwork has become operationally unmanageable. The Chamber of Commerce, digital advertising industry groups, and major technology platforms have all moved toward supporting federal preemption as the practical solution to multi-state compliance fragmentation.

The complication is that federal preemption is politically contested. State privacy advocates argue that a federal standard risks preempting stronger state protections — particularly California’s CPRA, which has provisions that exceed what any currently proposed federal bill would require. The debate between “floor” preemption (federal law sets minimum standard, states can be stricter) and “ceiling” preemption (federal law is the maximum, states cannot require more) is the fundamental political obstacle to passage.

From a pure compliance-manageability standpoint, ceiling preemption solves the patchwork problem. Floor preemption with California retained at a higher standard still produces a two-tier compliance environment. The political path to a bill that passes both chambers is, as of this month, uncertain.

What Brands Should Do Now

Congress may not pass APRA this year. The state patchwork will continue to grow. The practical response is infrastructure investment that handles multi-state complexity as efficiently as possible.

CMP configuration review: Audit your consent management platform against requirements for the specific states where you have significant customer data — at minimum California, Texas, Colorado, and Oregon. Signal recognition, preference center disclosures, and data retention configurations need state-specific validation.

AI creative governance documentation: Establish a documented process for how audience signals are used in AI creative generation. Document the legal basis for processing, the categories of signals used, and the review process for AI-generated campaigns targeting potentially sensitive audience segments.

Partner agreement updates: Data processing agreements with DSPs, SSPs, data enrichment vendors, and measurement partners need to reflect current multi-state privacy requirements — including data protection assessment obligations, sensitive data restrictions, and breach notification requirements.

FAQ

Q: Which state privacy laws have the most aggressive enforcement that brands should prioritize? California (CPRA, CCPA) has the most established enforcement history through the California Privacy Protection Agency and Attorney General. Texas (TDPSA) has been aggressively active in the first year of enforcement, particularly for consumer-facing digital advertising. Oregon’s enforcement infrastructure is newer but the AG has signaled priority areas including behavioral advertising and AI. These three should be the compliance baseline for any national advertiser.

Q: Does AI-generated creative specifically require consent that standard programmatic creative doesn’t? It depends on the state and the nature of the data used in the AI generation. In states with broad definitions of “automated decision-making” (such as Colorado), AI systems that generate personalized creative using behavioral inference may fall under disclosure requirements. The safest practice is treating AI creative personalization as equivalent to targeted advertising from a consent and disclosure standpoint.

Q: Will the American Privacy Rights Act pass in 2026? The political conditions are difficult. Congressional attention to AI legislation and other technology policy issues is competing for floor time. APRA’s preemption provisions remain contested between industry and consumer advocate coalitions. A bill passing in 2026 is possible but not probable based on current Congressional calendar and committee status.

Q: How should brands handle users in states with active privacy laws when targeting with third-party data segments? Implement a state-specific data use matrix that maps which data types are permissible for targeting in each jurisdiction. Restrict sensitive data inference segments (health, financial, family status) from use in states with broad sensitive data definitions. Ensure opt-out signals from state-specific mechanisms are being recognized by your CMP and communicated to data partners through your tech stack.