Every October, Cybersecurity Awareness Month reminds Americans of the simple habits that keep us safe online: strong passwords, multi-factor authentication, and a healthy suspicion of unfamiliar links. This year, as our nation celebrates its 250th birthday, CISA chose the theme “Securing the Next 250”, a call to build a secure digital future for the next generation of Americans.
America’s innovators have done their part, building the tools that let families safely bank, learn, shop, and stay connected from anywhere in the country. But one piece of that secure future can’t be downloaded or switched on in a settings menu. It has to come from Congress. A single, nationwide data privacy and security standard that protects every American the same way, no matter which side of a state line they call home.
Record Breaches, Uneven Protections
The threats keep growing. The Identity Theft Resource Center (IDRC) tracked a record 3,322 data compromises in 2025, a 79% jump over five years. The harm reaches everyday Americans with 80% of consumers surveyed by the ITRC having received a breach notice in the past year, and 88% of them suffering at least one negative consequence, from a wave of phishing attempts to attempted account takeovers.
Main Street is feeling it, too. The ITRC found 81% of small businesses reported a cyberattack, a data breach, or both last year, and nearly 40% of them raised prices as a result to help cover recovery costs. Those costs land directly on American families, who are already struggling with inflation and the cost of living.
When the rules governing data change at every state border, so do the protections and the answers Americans get when something goes wrong.
Our Kids Are in the Crosshairs
Few targets are more vulnerable than our children. The Center for Internet Security found that 82% of K-12 schools experienced a cyber incident between July 2023 and December 2024. A December 2024 attack on education software provider PowerSchool alone compromised the personal data of 62.4 million students.
Children are also the number one targets for identity theft, with 25% expected to experience it before they turn 18. Their clean credit histories make them valuable to criminals, and the damage often goes unnoticed until they apply for their first job or student loans.
A student’s data deserves the same protection whether they go to school in Ohio or Oregon. Today that simply isn’t the case.
A Patchwork Is Not an Effective Security Plan
Without federal leadership, states have filled the void. Twenty states now have comprehensive privacy laws in effect, and Oklahoma and Alabama join them in 2027. Some states, like Texas, have struck a sensible balance between protecting consumers and promoting innovation. Others, most notably California, have created a standalone privacy agency whose broad, clumsy definitions hit small businesses hardest while doing little to improve consumer privacy.
This patchwork of state laws is a lawyer’s dream and a small business owner’s nightmare. Every dollar spent untangling conflicting rules is a dollar not spent on security teams, better products, or lower prices. And because data crosses state lines every second, the gaps between state rules become seams that hackers and bad actors can exploit. State lines should not be fault lines for American data privacy.
What a National Standard Should Do
Congress has clear constitutional authority to regulate interstate commerce, and that includes data.
Lawmakers have made real progress this year. In April, House Energy and Commerce Republicans introduced the SECURE Data Act, shaped by a working group that gathered more than 250 written submissions, and the bill received a subcommittee hearing in June. But it has not yet been scheduled for a markup.
A national standard that works for Americans and their businesses should include:
- True preemption: A national standard must be exactly that. Carving out individual states would only create a patchwork within a patchwork.
- Security first: Businesses and service providers should be required to protect the confidentiality and integrity of the data they hold.
- A right to cure: Compliance, not punishment, should be the goal. Businesses deserve a chance to fix honest mistakes or alleged violations before facing litigation.
- No litigation target on Main Street: Frivolous lawsuits and heavy red tape would drain the resources small businesses should be directing to consumers through security protections and quality products, and would only enrich the trial bar.
- Preserving positive data use and ensuring consumers can still benefit from it: Consumers benefit every day from company use of data, through things like discounts, relevant recommendations, and enhanced product development.
Cybersecurity Awareness Month asks every American to do their part. When lawmakers return after the midterms, they should do their part by making a single national privacy and security standard a top priority, one that protects every family, every student, and every small business. Securing the next 250 years starts with making sure Americans’ privacy rights aren’t determined by a zip code.