On June 28, 2018, Governor Jerry Brown signed into law the California Consumer Privacy Act (CCPA), which at the time was the strongest protection for non-sensitive personal information in the country. Taking a cue from the European Union’s General Data Protection Regulation (GDPR), the CCPA requires thousands of California businesses to consider the implications of their data collection and sharing in ways they likely had not considered.

It’s frankly hard to believe that a law that puts such strict restrictions on companies’ collection of consumer data could pass in California, particularly in this day and age where Silicon Valley tech companies are willing to offer free services in exchange for no-holds-barred access to user data. After all, as the old adage says, if you’re not paying for the product, YOU are the product.