The word "all" doesn't appear in the version of the question in the story I see. It just says this: "The U.S. does not have a national privacy law addressing

The word "all" doesn't appear in the version of the question in the story I see. It just says this: "The U.S. does not have a national privacy law addressing how companies can use the data they collect" Even still, "all" wouldn't falsify the statement. There are some laws enumerating illegal things you could use data for. Anything not prohibited by law is legal. That's how the US legal system works. "Common standards" also doesn't exist in the version of the question in the article. However, setting common standards would prevent states from pass stronger restrictions, with the effect of actually weakening privacy law. [edit: Flipping some negations around, I think your version of the question is logically equivalent to "In the US, state and local governments do not have the authority to pass any laws addressing how companies can use any of the data they collect."]