Although few measures have actually made it all the way to the governor's desk at this writing, many states are considering bills to allow consumers to freeze their credit files and bills requiring notices to be sent to affected parties in the event of a data breach. In some states, a new hybrid has emerged where these measures are being combined into "omnibus" identity theft and fraud bills addressing these and other issues. These include, for example, restrictions on the use and transmission of social security numbers and, in at least one case, also criminalizing the trafficking of cellphone usage records.

Among the key issues relating to the file freeze legislation (152 bills in 36 States) are: limiting the freeze only to victims of identity theft; providing temporary "unfreeze" options for instant credit applicants; allowing an automatic "unfreeze" after a certain time period; providing lender access to frozen files for marketing purposes; clarifying the treatment of credit applications as "incomplete" by lenders when the applicant's file is frozen; and providing disclosures to ensure the consumer is aware of the effect a freeze will have on their access to credit. The Utah act (SB 71 from 2006) is widely viewed by the industry as workable.

The key data breach issues (136 bills in 37 States) include: the definition of covered persons and information; a distinction between encrypted and unencrypted data; the method and timing of notices; requirements that notices be sent to the credit bureaus prior to customer notification; a waiver of notice requirements if there is no reasonable likelihood of harm to customers, including government entities such as universities and motor vehicles in the statute; and a safe harbor for lending entities already in compliance with federal law. The Delaware law (HB 116 from 2005) is widely viewed by industry as workable.