The amendment was adopted almost as an afterthought, near the end of exhausting negotiations about legislation to overhaul the nation's financial services industry. Until the bill's approval yesterday by the House and Senate, it remained a largely unheralded handful of lines in a historic 400-page document.

But that late change, permitting states to override the bill's controversial privacy provisions, means the banking, insurance and securities industries--which spent hundreds of millions of dollars lobbying for the bill--now face the likelihood of new battles in states across the nation over a key element of their victory on Capitol Hill: The right to share customer information with few restrictions.

The Senate voted 90 to 8 in favor of the law last night. The House passed it 362 to 57 a few hours later.

When President Clinton signs the bill into law, companies will be able to merge more easily than ever and, without getting permission from individuals, share a wealth of information about their accounts, transactions, stockholdings and so forth. In some cases, banks also would be able to give information to telemarketers, as long as the marketers agreed not to pass it along. Companies say they would use such data, along with sophisticated computer systems, to create and market new consumer products and services.

But the amendment, pushed by Sen. Paul S. Sarbanes (D-Md.), has inspired attorneys general and consumer activists in several states to begin plotting ways to trump the federal law and restrict the use of private information by financial firms.

Minnesota Attorney General Mike Hatch has already pledged to push for a stronger state law. Hatch filed a lawsuit in June against U.S. Bancorp for allegedly sharing customer account information with a telemarketing firm in exchange for $4 million. The bank settled, agreeing to change some of its practices.

Hatch's suit spurred a group of officials in the offices of about 20 attorneys general around the country to begin collectively examining the information and marketing practices of banks. Their aim will be to crack down on the use of personal data that violates existing state laws.

Julie Brill, an assistant attorney general in Vermont who is helping to coordinate the multi-state inquiry, said her counterparts in the states are already considering ways to counteract the perceived inadequacies of the federal law.

"We're taking a broad look at it," Brill said. "People feel that their lives are out of control. . . . This stuff is supposed to be secret and they don't want people to know how much money they have or what they buy."

Other states likely to follow up with legislation soon are California, Washington and New York, where the attorney general is examining the activities of Citibank and other financial institutions.

Neither side is willing to predict the outcome, in part because no one knows whether the financial services industry's traditional influence in the state legislatures can hold up to growing consumer anxiety about privacy. They do agree there are plenty of fights ahead.

"You're going to see an extraordinary amount of activity on this at the state level because Congress didn't do its job. . . . And you're going to see some successes," said Travis Plunkett, legislative director at the Consumer Federation of America. "If the banks and financial services companies think this is going away they're sadly mistaken."

"We are concerned that what will develop is a patchwork of varying privacy standards in the states," said Dan Zielinski, spokesman for the American Insurance Association. "The industry will certainly work to fight against overly burdensome privacy regulations."

The industry, in fact, may have a secret weapon. An untested 1996 provision of the Fair Credit Reporting Act--which governs credit bureaus and their use of information--could limit the ability of states to answer the federal law with their own.

With some exceptions, the broadly written provision says "no requirement or prohibition may be imposed under the laws of any State . . . with respect to the exchange of information among persons affiliated by common ownership or common corporate control."

Knowledgeable Hill staffers have reviewed the language and don't think it will be a problem. But others aren't so sure. "This is an obscure provision and it has never been applied yet," said David Medine, the associate director for financial practices at the Federal Trade Commission. "But it could well impede states' ability to legislate in this area."

Like an explosive brush fire, the privacy issue has flashed into prominence as one of the central sources of contention in Washington--and in the states. An unusual coalition of civil liberties activists, social conservatives and Internet libertarians has made the issue a cause celebre by pressing for restrictions on personal data that is routinely swept up by computers for marketing or cost cutting.

"All you have to do is put it on the table and you get support from everyone except the banks," said Phyllis Schlafly, president of the Eagle Forum, a conservative grass-roots group. "People are just shocked."

On Capitol Hill, it was in debates over the financial services bill where advocates seemed to gain the most sway in recent months. They persuaded Democrats and a handful of Republicans to weigh in for consumers' rights to stop the sharing of names, Social Security numbers, account transactions and other details. For a time, it almost looked as though that right was going to become federal law.

In the end, however, after fierce lobbying, industry officials fended off the most pressing demands for federal restrictions. Congressional leaders decided consumers would not have the ability to "opt out" of sharing among affiliated companies, citing the fear that such a right would undermine the promise of the legislation and the benefits of the information age.

If consumers didn't like their bank's information policy, legislators and industry officials said, they could follow the dictates of market economics and take their business elsewhere.

That's when Sarbanes weighed in with his amendment.

"It's quite simple--a fundamental right of privacy should be accorded every American who entrusts his or her highly sensitive and confidential information to a financial institution," Sarbanes said. "My amendment enables each individual state to go beyond the limited scope of the privacy provisions in the federal legislation and enact their own rules and regulations guaranteeing these fundamental privacy rights."

Nevertheless, both sides agree that it doesn't make much sense to address such a potentially incendiary issue on a state-by-state basis.

"It's a horrible way to do public policy," said John Byrne, senior counsel at the American Bankers Association. "I think we can probably dissuade some state action by showing we can handle these new requirements.

CAPTION: House Banking Committee head Rep. Jim Leach, foreground, talks to lobbyists, lawmakers and federal regulators at a party on Capitol Hill yesterday in observance of the banking bill's long legislative history.