All five state consumer privacy laws create new rights for consumers, impose obligations on businesses that handle consumers’ personal data, and create new mechanisms to enforce those laws. Laws in Colorado, Connecticut, Utah, and Virginia also share core structural approaches to regulating privacy—even though those states adopt differing levels of substantive protections. California, in contrast, adopts a legislative model that creates a new state privacy agency charged with issuing regulations on more than 20 topics, including on issues addressed by statute in other states.