California's new consumer privacy law isn't as sweeping as you might think

Supporters of the California Consumer Privacy Act say it dramatically expands your power to control the information tech companies collect about you. Starting in 2020, you'll be able to ask businesses to delete your personal information and prevent the sale of it. Companies must also disclose the categories of information they collect, as well as the kinds of third parties that buy it. For kids under 16, companies will need to have their consent before their data can be sold. If there is an unauthorized breach of your non-encrypted personal information, you can sue companies for up to $750. The state's next attorney general will also have the authority to levy additional fines against those companies. \

On the surface, it will force tech leaders like Facebook and Google to be more transparent. But despite the hype, many questions remain as to whether it will actually protect consumer privacy. It outlines several items companies must provide to consumers upon request. But besides the required opt-in from minors, there is little detail on how companies should collect information in the first place.  "It looks like it will put some restrictions on the sale of personal information, but there doesn't seem to be anything there limiting the collection of any kind," said Jennifer King, director of consumer privacy at the Center for Internet and Society at the Stanford Law School. "In some ways, we're still in the status quo with a little more power that our data not be sold." The information the public can obtain is also fairly limited. The law repeatedly references "categories of personal information," suggesting companies could fall well short of providing specific information they have about individual consumers.