I think the CA law might have more teeth to allow for individual action? e.g. if they don't respond to data deletion requests.