Should the US have a single GDPR-style federal privacy law?