(Bloomberg)—Public officials in California have spent the last two years wrangling over a law that addresses sweeping concerns about privacy in the internet age. On Jan. 1, the law—the California Consumer Privacy Act—officially took effect. But that is hardly the end of it. The legislation could very well be back on the ballot in the state in 2020, an illustration of how little has been settled when it comes to rules about privacy, either in California or nationally.

One of the key players in California remains Alastair Mactaggart, a real estate developer who has emerged as one of the most peculiar forces for consumer privacy in America. Mactaggart began advocating for the ballot initiative that evolved into the CCPA in 2018 after an alarming dinner-party conversation about online data collection. He has largely funded the effort himself. It developed into the most prominent attempt to create privacy rules to govern advertising behemoths like Google and Facebook, as well as the hundreds of lesser-known businesses collecting and trading information about American consumers.

California’s law gives people the right to learn what personal data companies have collected and for them to request those companies refrain from selling that information. It will effectively become the new standard for privacy in the U.S., given California’s importance as a market. But even as the CCPA goes into effect, Mactaggart remains concerned that the technology industry will chip away at its protections. He’s promoting a ballot initiative that would both strengthen the law and require any future changes to weaken its protections be put to voters. “If we get this passed it will be much more difficult to amend it in a negative way in the future,” Mactaggart said in a phone interview.

Consumer advocacy groups like the Electronic Frontier Foundation and Common Sense Media have yet to get behind Mactaggart’s approach. He is already facing skepticism from some legislators and corporate interests. The Internet Association, a trade group representing technology companies, argues the law has practical flaws that Mactaggart’s advocacy will make harder to address. “The initiative is throwing a monkey wrench in the process,” said Kevin McKinley, the group’s director of government affairs for California.

Technology companies would prefer not to have activists from California serve as the driving force for privacy policy. McKinley is worried that parallel debates could emerge in other statehouses. “Everybody is interested in a federal solution,” he said. “We’re hoping we can get a national law that gives everyone in the U.S. the same rights.”

At first glance, privacy seems like a logical topic for bipartisan cooperation. There’s widespread concern about the issue at a time of growing suspicion towards companies like Facebook Inc., Amazon.com Inc., and Alphabet Inc.’s Google. But hostility towards the tech industry hasn’t translated into productive political alliances, mostly because the broad agreement about the existence of a problem hasn’t extended to consensus about how to address it.

Republicans led by Senate Commerce Chairman Roger Wicker have insisted on national preemption—a federal law that would overrule state laws or ballot initiatives on privacy. Democrats in Congress have also worked to develop federal privacy legislation but have generally opposed pre-emption. The parties are also split on whether a national bill should give citizens the power to sue companies for privacy violations. Democrats worry that a federal bill without this so-called private right to action would leave the Federal Trade Commission to defend citizens’ privacy rights, which they are convinced would lead to weak enforcement. Republicans, who tend to prioritize the restriction of frivolous lawsuits, are reluctant to introduce a new litigation target.

Wicker acknowledged the lack of progress in an interview in late December. “Well, I will announce to you right now that I’ve abandoned Jan. 1 as a timeline,” he joked. But he argued there’s still hope for 2020. “I think there’s overwhelming support for a national standard, a good strong federal bill that protects consumers and gives people certainty about what compliance is and isn’t,” he said.

Whether anything happens in Congress could depend on how things develop in California. Privacy advocate are also watching state legislatures in New York, Washington and Illinois, which they expect to be the most likely states to advance legislation in 2020. The more movement at the state level, the more pressure on Republicans in Congress to support a bipartisan federal privacy bill. But as the potential for state legislation increases, Democrats in Congress also have a stronger incentive to hold out for more in negotiations.

Many privacy advocates remain skeptical of the prospects for a federal privacy law. “We do not believe there will be comprehensive federal legislation in 2020,” said Jim Steyer, the founder of Common Sense Media. “We never thought it would pass because Congress is so dysfunctional and the executive branch is missing in action.”

Privacy advocates also express less urgency about a single standard on privacy, and some believe there’s much to be gained from experimentation around the country. “States are taking the lead,” Hayley Tsukayama, a legislative activist for the Electronic Frontier Foundation in California, “and companies hate it.”