It’s been just over four years since the first state data privacy laws went into effect in the U.S., and attorneys general across the country have already brought hundreds of millions worth of enforcement actions against companies with unlawful data collection practices.

At least 10 more state laws will come into effect over the next two years against the backdrop of fast-evolving technological developments, which will ultimately shape what attorneys general scrutinize.