SACRAMENTO — For privacy advocates, these are heady days.

European leaders are weighing tough new online data protection rules—and costly penalties for violators—for their 500 million residents. The courts and Congress have placed a bullseye on U.S. National Security Agency surveillance programs. Even dictionary.com declared “privacy” the word of 2013 because this “was the year that the desire to be seen and heard was turned on its head.”