But no one who cared about privacy thought this California bill was anyway a giant triumph. Everyone knows it's not equivalent to GDPR, for one because it's just in one state. This was just the result of a handful of people taking advantage of a quirk of California's legislative process to a put a gun to lawmakers's heads. If not for the ballot proposition process, California would be the last place I'd expect to pass strong EU-style privacy laws, because it's home to the surveillance capitalism industry.
What that California bill did do was show some tangible movement can be made in the US, to the point where the internet companies are now mobilizing to make a federal law (in the hope that this current Congress and Administration will not pass anything close to what's on the books in EU) [2]. What they didn't expect is that it's not just the left that is gunning for Facebook, Google, and Twitter anymore, it's the right as well. You might believe both aisles of the political spectrum are motivated by partisan reasons, but it doesn't matter. The bipartisan environment required for strong regulation to happen is here.
Privacy activists should seize on the opportunity to pass a federal law that's equivalent to the EU's. And if there's no movement on that, force the issue by creating a patchwork of laws in state legislatures. They should also seek out the backing of Apple, Salesforce, IBM, Oracle, or anyone else in the tech industry that has the straightforward business model of selling a product or service for money to a customer. It's critical to make clear to legislators that there's no united front from the "tech industry" on this.
[1] The real answer is antitrust enforcement, which is also gaining political support.
[2] https://www.nytimes.com/2018/08/26/technology/tech-industry-...