Absent a federal data privacy law, states and federal agencies have increasingly taken a more active role in issuing new regulations, updating decade-old rules and releasing enforcement actions to companies within their jurisdiction to account for emerging data privacy and security challenges.