Data privacy compliance is often focused on outputs: privacy notices, data processing agreements, cookie consent banners, and the like. It's common for smaller orgs to do a big push to get information together to put these public artifacts in place, without much thought to how they'll
Twenty-five US states have passed consumer data privacy laws – twenty-one are in force today and four more take effect between now and Jan. 1, 2028. Most of these are comprehensive, regulating consumer data privacy protection across (nearly) every industry – they don't only apply to online services.
If your product or service is subject to the GDPR, then GDPR Chapter V regulates any transfers you make of EU personal data to "third countries," meaning any country outside the European Economic Area (EEA) where GDPR applies. The basic thrust of these restrictions (as interpreted by the
California's pioneering consumer data privacy law, the California Online Privacy Protection Act (CalOPPA), was once the de facto data privacy law nationwide: if you had users in California (and you did), you needed to comply with CalOPPA -- whether your business was located in California, Delaware, or South Dakota.