GDPR and PECR (CCPA is primarily aimed at preventing selling of data)