Generally when a seller in state X in the US sells to a buyer in a different state Y the consumer protection laws of state Y apply.
Even if the seller in X does not have a presence in Y, and so you might think Y has no jurisdiction, purposefully conducting business within a state is sufficient to allow Y to assert jurisdiction in regards to that business.
No, you've found the person who (1) remembers Civil Procedure from the first year of law school [0], particularly the case of International Shoe Co. v. Washington, 326 U.S. 310 (1945) [1], (2) did some checking to make sure that between then and now nothing significant has changed (it hasn't--International Shoe is still the foundational case in this area), (3) remembers several large non-California companies California has successfully enforced its consumer protection and privacy laws against and several non-Illinois companies Illinois has enforced its similar laws against.
"Minimum contacts" is a good term to include in searches if you want to learn more on this.
[0] Note: I am not a lawyer. Near the end of law school I decided I'd rather be a programmer with a decent knowledge of law than a lawyer with a decent knowledge of programming.
Even if the seller in X does not have a presence in Y, and so you might think Y has no jurisdiction, purposefully conducting business within a state is sufficient to allow Y to assert jurisdiction in regards to that business.