When the EU’s General Data Protection Regulation (GDPR) went into effect in 2018, many organizations were left scrambling to comply with one of the strictest data privacy regimes yet. U.S.-based news outlets like The Chicago Tribune and LA Times even had to temporarily block access for EU users or risk steep penalties.

Data privacy laws are now traversing the Atlantic—and creating new compliance concerns. Data privacy regulations are set to go into effect in five different states this year, with at least 25 other states also considering comprehensive data privacy legislation in 2023.