Yes, and in contrast with OP’s assertion some states are actively regulating privacy (i.e. California) and there are plenty of statehouses that would likely be amenable to regulating this issue.
It’s a mistake to think about US regulations as purely federal.
It’s a mistake to think about US regulations as purely federal.