Excited to see where this goes - both California's law and Europe's GDPR. In the US what I've seen in my studies are attempts to enact soft standards (ex. FIPS) with no enforcement. GDPR changes that. Should be a very interesting next few years to see how all this plays out.