Three years in, the promise of the California Consumer Privacy Act (CCPA) remains unfulfilled.

The law expected to rein in the questionable data protection practices of Silicon Valley tech giants has resulted in a fine against a company just once, when cosmetics retailer Sephora was penalized $1.2 million in August for failing to comply with customer data sale notification and opt-out request requirements. Not quite the bite people were expecting.

And yet, the expanding U.S. data privacy legislation landscape is better for this approach. When four additional states—Colorado, Connecticut, Utah, and Virginia—begin enforcing their respective privacy laws this year, they have a blueprint to follow for what these kind of bills should prioritize: compliance.