For company legal departments, data-privacy compliance is about to get a lot more complicated.

New consumer data-privacy laws that will go into effect in California, Colorado and Virginia in 2023 are shifting the legal landscape nationally, raising the potential that other states will follow suit.