'Increasingly Bad' for Consumers and Business; Lawyer Blasts Privacy Laws' 'Growing Mess'
Privacy law, particularly in the U.S., is “increasingly bad” for consumers and companies, said WilmerHale’s Kirk Nahra during a Practising Law Institute (PLI) event Wednesday.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
There’s “a growing mess in this area” with a lot of “chaos,” which affects much of what happens in the commercial environment and society as a whole, he added.
When you boil it down, privacy law is “entirely about you” because it’s “all about your data.” Despite this, it’s “a relatively new legal issue,” but is evolving as “part of the continuing development of technology.”
In the U.S., there are few federal privacy laws, but a growing patchwork of state measures covering various aspects of privacy. This means “increasing complexity,” as companies determine their obligations and requirements with “more and more and more laws dealing with particular situations.”
Though nearly half the states have comprehensive consumer privacy laws, many also have “gap-filling" measures that cover instances where federal laws like HIPAA or the Gramm-Leach-Bliley Act don’t apply.
As 2026 begins, “we're starting to see tension between different kinds of consumer goals,” such as health care versus privacy, Nahra said. What data should be protected under a health privacy law is growing more complicated. For example, geolocation data is sensitive when a patient is at an appointment at an abortion clinic, but not sensitive if they are at work. “We're having trouble drawing those lines.”
Though a national law is often touted for bringing clarity, Nahra said he would be “concerned” if a federal law added just “another standard on top of everything else.” That would bring "greater" complexity. However, he's unsure whether the preemption of state law is a good thing either.
Many privacy laws are fewer than five years old, which means “people are trying to figure out what to do with them” with minimal enforcement and guidance, Nahra said. The resulting “confusion and complexity” is a “lose-lose” for consumers and businesses. But it also means “almost every development is important,” so keeping an eye on the field is key.