The year 2023 has begun a fundamental shift in the philosophy underlying data privacy laws in the United States, moving towards a broader “rights-based” approach, as exemplified by the European Union’s General Data Protection Regulation (GDPR). Instead of the “harms-prevention-based” approach, where privacy protections sought to prevent or mitigate harms in specific sectors, individuals now have the legal right to control their personal information. California’s lead is being followed by four other states – Colorado, Connecticut, Utah, and Virginia – in enforcing new GDPR-inspired statutes in 2023. More states are expected to follow suit. This shift represents a comprehensive approach to privacy protection, applying to businesses across numerous sectors, in addition to the sector-specific laws that remain in place.