22 Association of Research Libraries Research Library Issues 297 — 2019 specific laws aimed at protecting the privacy of minors.8 Many states, including Arizona, California, Delaware, and Missouri have specific laws governing e-reader privacy, which vary from protecting library patron records to more generally applying to all e-book browsing, including from commercial bookstores.9 Several states, including California, Connecticut, Delaware, Minnesota, Nevada, and Oregon, also address privacy policies for websites or for personal information held by internet service providers. All states now have some form of data breach notification laws, and some states have amended these rules in recent months. While these states have addressed important issues related to online privacy, with the exception of California’s recently enacted privacy legislation, these laws do not comprehensively address consumer data collected during the everyday course of using online services, platforms, and applications. More recently, attention to comprehensive consumer privacy has increased as a result of the European Union’s General Data Protection Regulation (GDPR) (discussed in greater detail below). Soon after GDPR went into force, California quickly enacted the California Consumer Privacy Act of 2018 (CCPA).10 This bill, scheduled to go into effect in 2020, purports to follow GDPR in many respects, but is narrower in scope than its EU counterpart and has come under a wave of criticism from nearly all stakeholders involved. CCPA focuses on the collection of data and—in contrast to GDPR—limits its application only to certain companies: those with gross revenue exceeding $25 million, or that sell data on more than 50,000 consumers each year, or derive 50% or more of their revenue from selling personal data. Ultimately, many criticized the rush to enact the legislation, with virtually no time for close analysis or meaningful debate. While states each have their own privacy laws, these laws are often older, do not address the swaths of data that exist in the digital age, or are limited in scope.