While GDPR is the overarching privacy law in Europe, the nature of American federalism has led to as many as 15 states pushing their own privacy regulations, adding to the complexity of US companies’ compliance efforts. How do US companies comply with all the privacy regulations in an overwhelmingly complex legislative landscape?