You are correct, and that's the main reason why some tech companies lobby in favor of Federal privacy legislation.

This also brings up an important issue: Local Pre-emption. A federal law may, if Congress chooses, say that "states cannot make local laws on this topic." But it also may not, and states could still choose to implement stricter laws.[1] This aspect, along with Private Right of Action, are considered by the privacy community to be at least as important as what tracking is actually allowed.

[1] This is already the case for e.g. wiretapping laws: Federal law requires at least one party consent to recording a phone conversation. Some states have stricter requirements and require all parties consent.