After weeks of frantic negotiations, the California Data Privacy Protection Act officially became law in late June 2018. While the act doesn’t go into effect until January 2020, many are already wondering what the law means for companies operating in the state and their in-house legal departments. Indeed, it’s an open question how their corporate compliance efforts, and even the law itself, will shape up come 2020.

The California Data Privacy Protection Act applies to in-state companies that have over $25 million in annual revenue and buy, sell, or process the personal information of Californians, or that make over half their annual revenue from selling such personal information.