State privacy officers persist despite limited resources, report finds

More than 30 states now have a chief privacy officer, according to a report released last week, but many challenges lie ahead if they want to be truly successful.

The National Association of State Chief Information Officers found that 31 states now have a CPO or an equivalent role, and that many play an important role in governing artificial intelligence, risk management and procurement. Meanwhile, states are making progress with their own privacy laws and regulations in the absence of federal action.

But they face a number of challenges, including a lack of money, as well as an ill-defined role and insufficient staff considering the complex initiatives they must lead. Despite those obstacles, NASCIO said the CPO role is an important one and will continue to grow in state government.

“One thing is clear: privacy is no longer a back-office issue,” Amy Glasscock, NASCIO’s program director for innovation and emerging issues, said in a video accompanying the report. “It's front and center in state government. Digital services are expanding. AI is becoming more embedded in how states operate. And state CPOs are playing a bigger role than ever, especially in areas like AI governance and technology procurement.”

The growth of this role comes as states have taken the lead on privacy regulations while Congress’ attempts to form a federal framework have consistently fallen short. As of this year, 29% of states reported having an established privacy program — up from 24% in 2024 — with more than half reporting that their programs are in progress.

Implementing those programs have taken a lot of work from CPOs, who reported that they did so by, among other things, developing privacy rules, statements, policies and guidelines; establishing training and points of contact in every agency; implementing data sharing agreements; and conducting training and privacy assessments.

NASCIO found that CPOs are also heavily involved in setting AI policies for their states, as well as conducting AI risk assessments, procurement review, due diligence on vendors and incident response.

Coordination with other tech leaders remains something of a challenge, although the CPOs surveyed indicated that there is progress being made. One third said there is regular coordination with defined roles between the CPO, chief information officer and chief information security officer on AI-related tasks, while 26% said that coordination is more ad hoc or informal. Just 22% said it is highly integrated with shared decision making.

As it relates to other risks to state government IT, 39% of CPOs said privacy is treated on par with cybersecurity risks, showing the importance of protecting residents’ data and ensuring it is not leaked or abused. However, 21% said it is treated as less important than most other risks to the IT enterprise, again showing there is more work to do.

Forty-six percent of CPOs said they have authority over executive agencies, but enforcement is another matter, as 36% said they can enforce privacy policies on those agencies, while 29% said those policies are not enforced and 11% said they are enforced by another entity. Other reasons that appear to undermine the CPO’s enforcement authority include a lack of policies to enforce; enforcement taking place at the agency level; their agencies only providing recommendations; and  authority only in the procurement process.

And the “real challenge,” the report said, remains having a defined budget for the state CPO. Just six states reported having a specific budget for privacy this year — up from three in 2024 — and three of those six states said their budgets have increased, while one remained the same and another decreased due to across-the-board budget cuts.

“We can see here the tough spot that privacy is in today,” the report says. “Almost half of state CPOs are given authority over the executive branch, over a third of them are tasked with enforcing privacy policies in the executive branch, but only 21 percent of them have a defined privacy budget. It’s understandable why they list lack of budget as their top challenge and funding as their top need.”

Sixty-four percent of CPOs said a lack of funding was their biggest challenge, while 54% said they still struggle with a lack of understanding about their roles among state employees. Half said the lack of authority was also a common challenge. They urged state governments to provide better funding; support from the CIO, governor or other senior leaders; more staffing; and enforcement ability.

Looking ahead, CPOs were split on what will happen in the future as AI takes hold, even as the technology was cited as the biggest force shaping privacy in the coming years. Some said AI will elevate privacy’s importance, while others were more skeptical.

“Honestly, I see AI crowding privacy out of the conversation and not much progress on privacy,” one CPO is quoted as saying in the report.