Lawyers say after the California Consumer Privacy Act went into effect on Jan. 1, a new privacy-first approach in the U.S. was born. "The whole argument was you can't have a privacy law on the state level," said Husch Blackwell partner David Stauss. "That argument is gone."

Indeed, Stauss and other Legalweek panelists on at the "Understanding CCPA & U.S. State Privacy Regimes" session at Legalweek 2020 in New York discussed how the CCPA could lead to a patchwork of varying privacy laws in the U.S. Plus, even if some states don't enact privacy laws, the CCPA could still fuel corporations to enact similar privacy protocols for all U.S. citizens, the panel said.

In the wake of the CCPA, some large tech and social media companies have announced their desire for a federal data privacy law. Specifically, those companies want a federal data privacy law that preempts state law and doesn't include a private action penalty, Stauss noted.

For the time being, many companies that fall under the CCPA's scope, like Microsoft, may decide to extend CCPA-similar privacy rights to non-Californians to improve security protocols and branding.

"Optically it looks bad if you are only giving privacy rights to a subset of people," noted panelist and Venable partner Shannon Yavorsky.

Suffice to say, the adoption of widespread data privacy practices is greatly motivated by governmental regulation, and lawyers say it's more likely additional states will enact a data privacy law before the federal government. Noting all states' data breach notification laws; Illinois', Washington state's and Texas' biometric laws; the CCPA; and New York State Department of Financial Services' cybersecurity requirement, Stauss said states are taking the initiative in regulating data privacy.

"There is a power to be addressed. If the federal government continues to do nothing, the states will act on this."

The panel highlighted over eight states that have introduced data privacy legislation recently. The states' proposed laws vary, from Washington state's General Data Protection Regulation-lite approach to other states' moves to mirror the CCPA and those with proposals are a GDPR and CCPA mix.

Though the bills vary, they all share a common theme, the panel said. Notably, all the proposed laws provide residents with a "right to opt-out of sales," with the definition of sale differing per proposed legislation, Stauss explained.