Five states—California, Colorado, Connecticut, Utah and Virginia—have enacted comprehensive consumer data privacy laws