The law gives Californians new rights and businesses new responsibilities. It does not apply to journalistic coverage and nonprofit organizations. Businesses must comply if their revenues exceed $25 million a year, if they get at least half their annual revenue from selling consumers’ personal information, or if they buy or sell personal data of at least 50,000 households a year. That means as many as 500,000 companies are likely to have to follow the law.