The laws that are in place and that are proposed protect the residents of that state, not the businesses. As you know, people from California aren’t just going to websites of businesses located in California, they go to websites all over the United States. This means that you need a Privacy Policy if you collect personal information on your website, regardless of where you are physically located.