There is absolutely no reason they can’t pass a federal law and then still allow states to have a more restrictive law. It is stupid to add a preemption barring more stringent laws.
But really no laws are strict enough against data harvesting companies.