I don't see how this is enforceable across state lines. What is stopping a data harvesting company in Nevada from just harvesting everything from people in California and selling it?