But I think this is one of the problems which requires a national solution (or for small countries an international solution). Look at the EU where many of the member countries had their own privacy laws, some of them stricter than the GDPR, but until the GDPR few cared about privacy laws, not even all government agencies in did. A unified privacy law at the EU level got a much higher rate of adoption than the previous mesh of local laws.