The California Consumer Privacy Act, as amended by the California Privacy Rights Act, is the strongest consumer privacy regime in the United States. It applies to for profit businesses that serve California residents and cross defined revenue or data volume thresholds, wherever the business is located, which brings foreign companies into scope through nothing more than the Californians in their user base.
The regime is operational in character. Rights to know, delete, correct, and opt out of the sale or sharing of personal information only work if the business runs request workflows on the 45 day statutory clock and places working opt out mechanics, including the do not sell or share link, in front of consumers.
