At the state level, data privacy laws in the United States have primarily taken a reactive approach. As of 2018, all 50 states (as well as Washington, D.C., Puerto Rico and the U.S. Virgin Islands) have implemented data breach laws requiring notification to individuals for unauthorized access to personal information. Only certain states, however, regulate