“Previously, one would often hear data privacy advocates urging federal and national legislation. But here we’re actually seeing those same advocates worrying that such a regime would preempt and water down the standard across the board.”