The laws also expose the lack of federal protections for everyone’s security, privacy, and freedoms online, regardless of age, says Bailey Sanchez, policy counsel at the Future of Privacy Forum, another DC-based think tank. (Current federal laws prohibit websites from collecting data on users under the age of 13.)

“Someday that 17-year-old is going to turn 18, and unless they’re in a handful of states, there is no privacy law that applies to them,” she says.