I worked on a compliance effort for a large-ish American tech company. Imagine a lot of boxes and arrows diagrams and plausible deniability. I was told we had to "balance risk", which in practice meant all data was available to everyone with no governance strategy. It was impossible to enumerate all the places data might be collected and stored, let alone find the appropriate person to handle the deletion request. We ended up basically handling the "happy path" and pretended the known unknowns didn't exist. This gave everyone enough plausible deniability to say "well the policy is X" with no means, technical or otherwise, of checking compliance.

California is currently getting a similar regulation. And what California does will have lasting effect in the rest of the US as well.

CCPA isn't as strong as GDPR[0]. Also, not sure if you're referring to Prop 24, but it's terrible[1] for various reasons, including that it can't be updated by the legislature.

[0] - https://iapp.org/media/pdf/resource_center/CCPA_GDPR_Chart_P...

[1] - https://www.theleaguesf.org/#Prop24

GDPR enforcement is severely lacking despite there being enough evidence of breaches.

Agreed. I work in information security (risk, compliance, and governance) for a EU-based company and we have a ton of “our lawyers said X” and “we interpret GDPR as Y” kind of policies because there have not been enough court cases to really understand what GDPR actually means.

From a security and privacy standpoint I think it’s got great potential but there are too many open questions about enforcement and it muddies actual compliance.