There is a huge difference between complying with a state’s requirements and relying on privacy violation for your business model.