It's been just over four years since the first state data privacy laws went into effect in the U.S., and attorneys general across the country have already brought hundreds of millions worth of enforcement actions against companies with unlawful data collection practices.