State Privacy Enforcers: AG Offices in Constant Contact About Investigations

California Supervising Deputy Attorney General Stacey Schesser, Colorado First Assistant Attorney General Stevie DeGroff and Texas Privacy and Tech Enforcement Director Tyler Bridegan spoke during a Federal Communications Bar Association webinar.

“We all talk to each other all the time,” said Schesser. “If one of us [takes] an action, we’re going to talk to the other states about it and sort of understand more about their thinking.”

She said to expect a steady volume of enforcement from states with privacy laws taking effect in 2025. New comprehensive laws have gone into effect or will take effect this year in Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota and Maryland. The consortium includes AGs from California, Colorado, Connecticut, Delaware, Indiana, New Jersey and Oregon.

AGs with new privacy laws are likely “wrapping up investigations, or they’re starting to see a potential enforcement action that they’re going to file, so it’s going to remain pretty active in this space amongst the states,” said Schesser: Compliance attorneys should pay close attention to all AG action and communication.

If one state has a privacy law that carries stronger authority in a particular case, that state will take the lead on multi-state investigations, said DeGroff. “It should be no surprise to anyone that we collaborate,” she said. “There’s a long tradition of state AG offices collaborating, whether it’s in a formal multi-state investigation or settlement or as a brain trust.” The bipartisan consortium formalized the work “we’re already doing,” she said, noting many states not included in the formal announcement are regularly part of the conversation.

There’s no shortage of in-depth, “nerdy discussions” between AG offices, said Bridegan. When Texas is interpreting its privacy law for enforcement, “we need to consider what’s going on in other states as well. We try to stay true to that.”

Schesser said to expect more work on age-assurance and age-verification, which could be the “next frontier” in legislation and regulation: “We’re all starting to get frustrated with how kids’ data is not being handled appropriately.” There’s a lot of thought going into keeping a balance between privacy and safety, she said.

States closely monitor decisions or enforcement coming from the FTC, she added. “Having a strong federal partner that’s doing this work is really critical."

FTC Consumer Protection Bureau Deputy Director Monica Vaca appeared separately, saying kids’ data privacy will remain a focus for the commission under Chairman Andrew Ferguson. Mass data collection and indefinite data storage increase risks for fraud and reputation harm, she said.

Vaca also reiterated a key change to the agency’s Children’s Online Privacy Protection Act rules that Ferguson highlighted last week (see 2506040067). Ferguson discussed a requirement for companies to get additional parental opt-in consent before sharing a child’s personal information.

Schesser and Bridegan downplayed the compliance burdens associated with a patchwork of state privacy laws. The small nuances from one law to the other are likely more frustrating for enforcers than companies, said Schesser.

Any friction between states comes from states without comprehensive privacy laws, said Bridegan: “They can’t be invited to all our fun group calls.”

These differences in state privacy law may seem minor, but they’re costly for companies having to change their approaches across states, said CTIA Connected Life Director Avonne Bell on a separate panel: “If we end up with 50 different versions, this can be really burdensome and costly.”

Added Wiley Rein privacy attorney Duane Pozza,“Companies can want to do the right thing but still just really run up the bill trying to understand” varying state requirements.