Legislation codifying consumer-data protections and reporting has passed in three states and is underway in 20 others. All