When we talk about data sovereignty, the European side gets the attention. Schrems III is loading. The Cyber Resilience Act lands in five weeks. The EU Tech Sovereignty Package puts "autonomy across the cloud stack" into policy. These are real, they matter, and we've covered them.

But the United States is building its own case for sovereign infrastructure, and it's doing it through fragmentation.

The Numbers

As of August 2026, approximately 19 US states have comprehensive consumer privacy laws in effect. The count varies by source because Florida's Digital Bill of Rights is categorized differently depending on who's counting. Call it 19 or 20. Either way, that's 19 or 20 separate compliance regimes with overlapping but non-identical requirements.

Three new laws took effect January 1, 2026:

  • Indiana Consumer Data Protection Act — access, deletion, correction, portability, opt-out for targeted advertising and data sales. Virginia-style model.
  • Kentucky Consumer Data Protection Act — same rights set, plus a new Office of Data Privacy with enforcement authority under the Kentucky Attorney General.
  • Rhode Island Data Transparency and Privacy Protection Act — access, deletion, portability, opt-out, transparency obligations.

Arkansas joined July 1, 2026, with its own Consumer Data Protection Act.

Existing laws are amending. California's Delete Act created a centralized deletion system for data brokers beginning August 1, 2026 — eight days ago. Connecticut expanded consumer access rights and strengthened minors' protections effective July 1. Oregon mandated recognition of universal opt-out signals and prohibited selling precise geolocation data and personal data of consumers under 16, effective January 1. Utah added a right to correct inaccurate personal data, effective July 1.

There is no federal privacy law. Despite multiple legislative proposals over the past several sessions, none has passed. There is no indication one will pass soon.

Why the Patchwork Is the Point

The conventional framing is that the state patchwork is a problem — a transitional state that a federal law will eventually resolve. That framing is wrong. The patchwork is not transitional. It is the operating environment.

Here's why: the states are diverging, not converging. Early privacy laws followed the Virginia model closely. The 2026 amendments are causing the laws to pull apart. California requires risk assessments and cybersecurity audits. Oregon mandates universal opt-out signal recognition. Connecticut restricts automated decision-making. Each state is adding its own requirements on top of the common baseline. A federal law that preempted all of these would have to be weaker than the strongest state law to pass — which means it would reduce protections in California and Oregon to satisfy the political constraints of national legislation. The states with strong laws have no incentive to support that.

This means organizations operating across state lines — which includes any community with members or users in multiple states — face ongoing, evolving, state-specific compliance requirements. Not a one-time legal review. Continuous governance.

What This Means for Community Infrastructure

A fire hall serving a rural county in Oregon has different legal obligations than one serving a county in Indiana. A community organization with members in California, Connecticut, and Utah has to satisfy three overlapping but non-identical privacy regimes simultaneously. A small business with an online presence reaches users in every state with a privacy law, whether it knows it or not.

For organizations running their infrastructure on Google Workspace, Microsoft 365, or AWS — the compliance surface is whatever those providers decide it is. You trust their data handling, their retention policies, their deletion processes. When a user in Oregon exercises their right to opt out of targeted advertising, you're relying on the cloud provider to actually implement that. When a user in California requests deletion from a data broker, you're relying on the broker to comply. You have no direct control and limited auditability.

For organizations running their own infrastructure — Proxmox, Nextcloud, Matrix, Keycloak — the compliance surface is the infrastructure itself. You know where the data is. You know who has access. You control retention. You implement deletion. You can produce an audit trail on demand because the logs are yours.

This is not an abstract sovereignty argument. It's a practical one. The privacy patchwork makes data governance a continuous obligation. Continuous obligation requires direct control. You cannot continuously govern what you cannot inspect.

The Specific Provisions That Matter

The 2026 amendments cluster around several themes that directly affect infrastructure decisions:

Universal opt-out signals. Oregon now mandates recognition of universal opt-out mechanisms (like GPC — Global Privacy Control). If your web infrastructure doesn't honor opt-out signals, you're non-compliant in Oregon. This is a server-side configuration, not a policy document. Nextcloud and Matrix don't do targeted advertising, so this is mostly irrelevant for a community deployment. But if you're running any analytics or advertising on a public-facing site, this is a technical requirement.

Minors' data. Oregon prohibits selling personal data of consumers under 16. Connecticut strengthened minors' protections. California has separate minors' data provisions. If your community infrastructure serves users under 16 — a youth program, a community center, a school-related organization — you need age-gating and data segregation. This is an architecture decision, not a compliance checkbox.

Data broker transparency. California's Delete Act, live August 1, created a centralized system for consumers to request deletion from data brokers. If your organization is classified as a data broker under California law — which depends on revenue thresholds and the nature of data collection — you have registration and deletion obligations. Most community organizations won't qualify as data brokers. But the existence of the system normalizes the expectation that consumers can demand deletion from entities that hold their data. That expectation will reach community organizations through user behavior, if not through direct legal obligation.

Automated decision-making. Connecticut added limitations on profiling and automated decision-making. California and Illinois are addressing AI regulation intersecting with privacy. If you're running AI tools on community infrastructure — local LLMs, retrieval pipelines, automated content moderation — the profiling restrictions may apply. Using personally identifiable information to train AI models conflicts with purpose limitation and data minimization principles. Once PII is in a training set, deletion is effectively impossible — the data is distributed throughout the model weights.

The Auditability Argument

The thread connecting all of this is auditability. The patchwork makes privacy compliance a continuous, state-specific, evolving obligation. Meeting that obligation requires knowing what data you hold, where it is, who accesses it, how long you keep it, and what happens when someone asks for it to be deleted or corrected.

Cloud providers offer compliance certifications and data processing agreements. What they don't offer is direct, real-time access to the data layer. You can't audit Google's retention implementation. You can't inspect Microsoft's deletion process. You can read their compliance documents and trust them.

Self-hosted infrastructure gives you the audit trail directly. Nextcloud's file access logs are in your database. Matrix's message retention policies are in your config. Keycloak's authentication events are in your logs. Proxmox's access records are on your host. When a user exercises a privacy right, you can trace the request through your systems because the systems are yours.

This is the argument that the US privacy patchwork makes better than any philosophical case for sovereignty: compliance requires auditability, and auditability requires control. You cannot continuously comply with 19 evolving state privacy regimes through trust agreements with third-party providers. You can comply through direct control of the infrastructure that holds the data.

Practical Steps

For communities operating across US states:

  1. Inventory your data. What personal data do you collect, where is it stored, who has access, how long do you keep it. If you're on Nextcloud, this is a database query. If you're on Google Workspace, this is a request to a provider who may or may not give you a complete answer.

  2. Map your users' states. You need to know which state privacy laws apply to which users. A simple "state of residence" field in Keycloak gives you this. If you don't know where your users are, you can't know which laws apply.

  3. Implement deletion workflows. Every state law includes a right to deletion. In Nextcloud, this means deleting the user account and associated files. In Matrix, it means deactivating the account and purging message history. In Keycloak, it means removing the user identity. If these are manual processes, document them. If you can automate them, do.

  4. Disable what you don't need. If you're not doing targeted advertising, disable the analytics that feed it. If you're not selling data, document that you don't. The simplest compliance posture is one where the regulated activity doesn't occur. Self-hosted infrastructure defaults to this — Nextcloud doesn't advertise, Matrix doesn't sell data, Keycloak doesn't broker identities.

  5. Log access. When someone exercises a privacy right, you need to demonstrate you responded. Access logs in your infrastructure are your evidence. Access logs in a cloud provider's infrastructure are their evidence, shared with you on their terms.

The Bottom Line

The US privacy landscape is a patchwork of 19+ state laws with no federal unification on the horizon. The laws are diverging, not converging. Compliance is continuous, not one-time. The states with the strongest laws are adding requirements the others don't have, and a federal law weak enough to pass would reduce those protections.

For community infrastructure, this is not a burden. It's an argument. The patchwork makes the case that data sovereignty is not a philosophical position — it's a practical compliance strategy. You cannot audit what you don't control. You cannot continuously comply with evolving state-specific requirements through trust agreements. You can comply through direct ownership of the systems that hold the data.

The tools are the same ones we've been deploying: Proxmox for virtualization, Nextcloud for collaboration, Matrix for communication, Keycloak for identity. The US privacy patchwork just gave them another job — being the auditable, controllable, inspectable foundation that continuous compliance requires.

The EU makes the sovereignty argument through policy. The US is making it through fragmentation. Both arrive at the same place: own the stack, or trust someone else to handle your compliance for you.