[mindslight]

> The ideal is that every sovereign entity passes their own privacy law that applies to their territory, with a private right of action, and adtech companies are forced to adopt a "50 states legal" posture. This is, deliberately, a ratchet: it's easy for any state to require a higher standard but hard to get every state to reduce it, so privacy laws cannot be walked back in secret.

You put this so well it kind of dislodged where I was coming from on my other comment you had responded to. I don't want to be disheartened and cynical. It's just hard to have seen this privacy issue openly festering for over two decades now, and think that things are ever going to change.

I think a private right of action with a two year delay would be great. And perhaps county DA's should be able to bring actions as well as the AG (legal policy adjacent actions aren't really in their wheelhouse, but it could help nudge the AG into action). I think the time period is a balance between giving the AG enough time to act (or be pressured into action), versus not making it too long so that illegal businesses can simply lobby to neuter the whole law before it actually goes into effect.