The US still has no federal privacy law. But recent enforcement actions against data brokers may offer some new protections for Americans’ personal information.