Twenty-two states have enacted comprehensive consumer privacy laws that create new rights for consumers, impose obligations on businesses that handle consumers’ personal data, and create new mechanisms to enforce those laws. Twenty-one of those states adopt the same basic structural model to protect consumer privacy. Some of those states have added greater substantive protections to that basic structural model while other states have adapted the same model to create narrower substantive protections, as reflected in the chart below. In contrast, California adopted a legislative model that creates a new state privacy agency charged with issuing regulations on more than 20 topics, including on issues addressed by statute in other states.