Now that the US federal government doesn’t care about internet privacy, states are stepping in