Danielle Keats Citron of Maryland, Yale and Stanford has written Privacy Enforcement Pioneers: The Role of State Attorneys General in the Development of Privacy Law, Forthcoming in the Notre Dame Law Review, Here's the abstract:
Accounts of privacy law have focused on legislation, federal agencies, and the self-regulation of privacy professionals. Crucial agents of regulatory change, however, have been ignored: the state attorneys general. This article is the first in-depth study of the privacy norm entrepreneurship of state attorneys general. Because so little has been written about this phenomenon, I engaged with primary sources — first interviewing state attorneys general and current and former career staff, and then examining documentary evidence received through FOIA requests submitted to AG offices around the country.