Giant tech companies are being exposed almost weekly for data breaches (at worst) and creepy-but-novel ways to monetize consumer data (at best). We expect Congress will react in 2019. They’ll have no choice. Consumers, complacent in the past, aren’t anymore. They suddenly care about how brands cash-in on their digital lives. This shift in the zeitgeist is already motivating legislators. The big question isn’t what new privacy regs will mean for Silicon Valley, but how they’ll impact thousands of American companies whose primary business isn’t advertising or social media. Companies that sell stuff, non-profits that mobilize people, and service-economy organizations all depend on data. Data collection and use are essential to their existence. Organizations need to start preparing now for the coming shift in how an individual’s data is captured, stored, used, protected and erased. Those that take an early lead on plainspoken policies, strong user protections, and transparency about how an individual’s data is used will earn goodwill from consumers, investors and policy makers.