Nationally, not many. There are a few laws like the Children's Online Privacy Protection Act, and the FTC (theoretically) has a lot of power to enforce whatever privacy statements companies make to their customers (this isn't just limited to enforcing fine print, either), but it's hard to figure out what private companies are doing in the first place and enforcement actions to date have been minimal. There was a $5 billion FTC fine levied against Facebook a few years ago (and that was the largest privacy-related fine anywhere in the world by an order of magnitude), but that happened after almost a decade of wrist-slap enforcement, and a year or so after paying the fine Facebook reported $62 billion in cash reserves.
California has some stricter laws that are new enough that we don't have a great read on how they'll be applied, so there's at least some positive movement in one major state.
Nationally, not many. There are a few laws like the Children's Online Privacy Protection Act, and the FTC (theoretically) has a lot of power to enforce whatever privacy statements companies make to their customers (this isn't just limited to enforcing fine print, either), but it's hard to figure out what private companies are doing in the first place and enforcement actions to date have been minimal. There was a $5 billion FTC fine levied against Facebook a few years ago (and that was the largest privacy-related fine anywhere in the world by an order of magnitude), but that happened after almost a decade of wrist-slap enforcement, and a year or so after paying the fine Facebook reported $62 billion in cash reserves.
California has some stricter laws that are new enough that we don't have a great read on how they'll be applied, so there's at least some positive movement in one major state.