With no framework yet for a federal privacy law, states that took the initiative to regulate online firms’ use of personal data may end up providing models for Congress.

Following the passage of the landmark California Consumer Privacy Act last year, bills were introduced in at least 25 states addressing different aspects of data privacy, according to the National Conference of State Legislatures. Illinois and Washington took the most comprehensive approach, while others considered piecemeal measures.