By the end of January, the number of states with active consumer data privacy laws will have risen from eight to 13.