Each state's breach notification law may have different requirements for what triggers the notification. Which of the following is not true of notification triggers?

Group of answer choices

Under California law, an attacker accessing unencrypted personal information is enough to trigger notification requirements.

Some states require a showing of harm before notification is required.

Some states' laws trigger a notification if data is acquired and the potential for future harm exists, such as identity theft.

Some states' laws trigger a notification if an attacker was proven to have considered accessing, copying, or changing data.