It's messier than that. This works if all NY, OR, <whatever state> gets its traffic distributed through a guaranteed hub in those locations. Specifically when you know the end point of the user. Let's just take the simple case and say a Google employee sitting in a CA office is working with a Microsoft employee sitting in a WA office and assume OR has a throttling service. The hubs along the way are Seattle, Vancoover, Portland, Eugene, Redding, SF. Do the Portland and Eugene servers throttle? To do this they'd need to know: 1) the source destination, 2) the final destination, 3) the type of traffic, 4) the type of service, and so on. Are they going to have that? Probably not. And then it'd be trivial to get around if you start using encrypted traffic and encrypted DNS services. The ISPs just can't do that wish such granularity that they don't risk being sued by CA.
> Also just to make a note on GDPR, one of the screwy things about it is that covers EU citizens.
A note on the CA thing, the DOJ and several ISP lobby groups tried to get CA's law overturned at a federal level immediately after it was passed. It's been upheld. So they kinda already looked at a solution that strongly implies what the parent implied about other states likely implementing similar laws were the ISPs to start such fuckery.
CA here isn't just acting as a filter in that they do a thing and so having to work around them is more cost than its worth. They are _also_ an example, where they tried to get the laws overturned and failed. So they don't want to get any more similar laws in other states because that will have even more of an effect and tighten what they can do even further.