6 states now have PII, data privacy laws; 7 more considering