Why we need a federal data privacy law – and how CCPA sets the pace