I don't get your argument.
Wouldn't adding teeth to the state laws be the right thing to do?
It would help, but it'd be better for everyone if there was just one law to worry about which covered everyone (or at least set a minimum standard) rather than having 50 different versions of the same law all over the country each with their own definitions, thresholds, penalties, etc. It'd make things a lot less complicated for both companies and consumers, especially given how often a single company's data being exposed impacts people all over the nation.
You don't like federalism much, do you?
Btw, states already coordinate voluntarily on things like traffic signs, without there being a central authority. (That's both true for states in the US, and for different countries around the world. A stop sign looks pretty much nearly the same around the world, without any central authority enforcing that.)