Google, Facebook, Twitter, Amazon, Square, GoDaddy, Tesco, Sainsbury's, H&M, and many more are updating their policies to give consumers more control over their personal data.

Those updates and changes are thanks to a new law governing data privacy called the General Data Protection Regulation, or GDPR.

The catch is, GDPR only applies to people who live in the European Union.. but its adoption is largely expected to have Americans asking “Why don't we have that?”

Here's how data collection currently works -- when you sign up for, let's say Facebook, you have to click a box agreeing to the companies terms.

Those terms give Facebook the right to track your online activities, even if you're not actively browsing facebook.

Facebook can let third parties access it in order to sell ads and services.

GDPR is changing that.

Consumers will have the right to ask for copies of anything as basic as messages sent to them, or by them…

That's Bloomberg Tech Editor Nate Lanxon.

...up to entire archives of all the content they've generated on a service.

Come May 25 companies with more than 250 employees and that hold data on European citizens will have to get "unambiguous" consent from users to collect their data, instead of just burying an OK inside fine print.

It will also make it much easier to revoke consent users had previously given.

For consumers that opt in, they have a right to know what's being done with their data and instead of being charged to obtain it, can request a free copy.

For companies like Google and Facebook, they've been making data available for download and deletion upon request for quite some time.

Consumers also have the "right to be forgotten," which lets citizens request that organizations delete their data.

Data Portability will give consumers the right to retrieve their data and sell it to other companies.

So, for example, you may be able to trade something like a gift certificate from Zara in exchange for your shopping history at J Crew.

If a firm has a data breach, companies must notify the authorities within 72 hours.

And any failure to comply with this new law will be costly.

Penalty fines can abe as high as 4 percent of a company's global annual revenue.

Europe expects companies to try and act within the spirit of the law, and not just try to follow it to the letter.

This mean there will be disputes and legal precedence to be set over the coming years.

So while the US is still reeling over Facebook and the Cambridge Analytica scandal -- The EU is moving ahead with tough new rules.

Many will ask if the US should be next.