State legislatures are making their mark with new consumer protection legislation, most notably in Vermont, where the state enacted the first law regulating data brokers, and in Colorado, where lawmakers passed a new privacy and cybersecurity measure.