Since the introduction of the European Union's (EU's) General Data Protection Regulation (GDPR), which has an expansive reach, U.S. businesses have faced comprehensive and unprecedented data protection and privacy considerations. When the GDPR became law, there were no such laws (federal or state) in the United States, and U.S. businesses questioned the GDPR's applicability. Since then, U.S. states have taken it upon themselves to bring a wave of new data protection legislation, forcing U.S. businesses to consider the topic yet again—and this time it's in their backyard.

Over the past five years, 12 new comprehensive U.S. state privacy laws have passed. And more are in the pipeline. Consider, for example, the influx of bills introduced recently—in 2018, only two bills on this topic were introduced, compared with the 59 introduced in 2023.