Supreme Court Justice Louis Brandeis called privacy the “right to be let alone.” Perhaps Congress should give states trying to protect consumer data the same right.

For years, a gridlocked Congress ignored privacy, apart from occasionally scolding companies such as Equifax and Marriott after their major data breaches. In its absence,...