In states where it was illegal it may not even be ex-post-facto for them to prosecute for events that took place prior to last year's supreme court ruling.
Anyway, the real takeaway should be that businesses should not be collecting this kind of data in the first place. If they don't collect it, then they have nothing to turn over.
