Contact Permissions outside GDPR - Individual vs Household?

Like many others I'm sure, we're using COVID downtime as an opportunity to tackle our communications tracking and make the migration to Contact Permissions ahead of v16. My specific question for the community, though, is...

I see that there's a setting in T_DEFAULTS that can control whether permissions can be set at the household level, or for individuals only (which is the GDPR requirement). Looking in the crystal ball of future data legislation that might take shape here in N. America, I'm trying to make the most informed decision now to serve us well in the future. The CCPA is the closest equivalent to the GDPR in the U.S. that I'm aware of, and some cursory Googling suggests that it's not as restrictive as GDPR in this particular area and allows people to be aggregated together as a household for purposes of data management.

Choosing to set up and migrate permissions to individuals would add a lot of clarity and granular control, and if it's something we may need to approach in 5-10 years anyway I'd rather get the jump on it instead of kicking the can down the road. It'd be a big transition and changing of old habits though, as much of our contact data presently is associated with households and people are used to that setup (myself included). I suppose you'd also need to revsiit your usual extraction criteria if tickets and contributions are still being booked to households (a whole lot of checking that 'Search Household' box!) and also figuring out how to navigate when one member of a household opts out of a contact type while another member is still opted in.

Has anyone grappled with this question and come down on either side, or want to explore it together? Also, if you've migrated to Permissions already or are doing so now, and have success or horror stories, feel free to reach out - I don't want to derail this thread from the main question, but would love to chat about this more broadly!