Applies to businesses meeting revenue or data volume thresholds that handle California residents' data.
Organizations must obtain meaningful consent and are accountable for personal information transferred to third parties.
Any US-incorporated provider or subsidiary may be compelled to disclose data regardless of where it is stored.
Cross-border transfers to non-adequate countries require SCCs, BCRs, or other safeguards.
US providers may be subject to surveillance orders targeting non-US persons, creating risk for EU data subjects.