On the state level, debates between business and consumer advocates have coalesced over whether to include a private right to action in data privacy legislation. For a federal privacy law, proposed litigation faces an additional hurdle: whether a federal law should preempt state laws.