In an op-ed with the Center for Democracy and Technology, CDT co-Director of the Privacy and Data Project Eric Null said U.S. state privacy laws that do not include data minimization are missing an important element of data protection. "Data minimization requirements place the privacy-protecting burden primarily on companies that collect and exploit the data, rather than on the already overburdened consumer," Null said.