What does the new privacy law do, exactly?

The law gives Californians new rights and businesses new responsibilities. It does not apply to journalistic coverage and nonprofit organizations. Businesses must comply if their revenues exceed $25 million a year, if they get at least half their annual revenue from selling consumers’ personal information, or if they buy or sell personal data of at least 50,000 households a year. That means as many as 500,000 companies are likely to have to follow the law.