In the absence of a federal statute, many states have implemented their own data privacy laws, prompting Rep. Debbie Lesko, R-Arizona, to cite concerns that a federal law would need strong preemption language.