What State Laws Require for Privacy Assessments