Is anyone else confused about which privacy law actually applies to their business now?