consumer privacy statute