On June 28, 2018, the California Privacy Act of 2018 was signed into law by Governor Jerry Brown. The law was approved by the California legislature only hours before and was fast-tracked through the legislative process in order to meet the deadline to withdraw a state-wide ballot initiative slated to appear on the November ballot that contained far more onerous provisions.

The new law, which will go into effect January 1, 2020, will be among the strongest consumer privacy laws in the United States, and may become the model for other states as they fill the void left by the absence of comprehensive federal legislation. Here is what you need to know about the new law:

1.   It gives consumers the right to ask a business to identify what personal information it has related to the consumer, the source of that information, the business purpose behind the collection, selling or sharing of this information and the identity of any third parties to which the information was sold or shared;

2.  It gives consumers the right to request that a business delete any personal information it has regarding the consumer and “opt-out” from the future selling of the consumer’s personal data to third parties.

3.  It prohibits a business from discriminating against a consumer for exercising his or her “opt-out” rights, which would include charging the “opt-out” consumer a different price or providing the consumer a different quality of goods or services.

4.  It prohibits the sale of the personal information of consumers under the age of sixteen unless the consumer (or presumably a parent or guardian) affirmatively “opts-in” to the sale of that information.

5.  In addition to being enforceable by the California Attorney General, the law creates a private right of action in connection with certain unauthorized access and exfiltration, theft or disclosure (e.g. as a result of a data breach or hacking) of a consumer’s personal information.

The California Privacy Act of 2018 is posed to shake-up the way businesses of all sizes operate and the interface with their customers. Major tech companies are already gearing up to fight back against portions of the new law even before it goes into effect. Companies that do business in California and interact with California consumers need to be aware of the implications of this new law and start preparing for its implementation. However, given the formidable opposition lining up to challenge various portions, business would be wise to closely monitor developments and modifications made in advance of January 1, 2020.