For twenty-five years American privacy law rested on a single idea: tell people what you collect, give them a choice, and the law is satisfied. That regime is over, and the state comprehensive privacy laws are the reason. This article explains what actually replaced notice and choice, which is a set of substantive obligations that bind a company regardless of what its privacy policy says or what the consumer clicked through, including data minimization untethered from disclosure, opt-in consent for sensitive data, a duty to honor a machine-readable browser signal the company never negotiated, contract terms that are the only thing standing between an ordinary vendor disclosure and a statutory sale, and documented risk assessments that a regulator can demand. It walks through the consumer rights and the operational machinery they require, the appeal right that exists in every state but California, and the definitional fights over sale, sharing, targeted advertising, and sensitive data that decide most compliance questions. It then covers the overlays that generate the actual litigation, including biometric statutes with private rights of action, consumer health data laws, the video privacy and wiretap theories driving the pixel cases, and children's privacy after the amended COPPA Rule. It closes with what four years of state enforcement actually show about where companies fail.