True, but if GDPR has taught us anything… smaller firms will bend over backwards to comply and the largest ones will make cutouts, bend the rules and treat fines like fees to play. I think having the law in the US would be the best way to protect US citizens. In addition, I think it would be able to have more teeth being the country where a lot of these companies were founded and most importantly where they bank.