Many businesses assume their California privacy exposure is fully addressed through compliance with the California Consumer Privacy Act (CCPA). But that assumption can leave important gaps. We are seeing a rise in inquiries and pre-litigation letters invoking California’s “Shine the Light” law. These requests may appear routine but mishandling them can create real statutory and litigation risk.

Disney is one of the most recognizable brands in the world, but even Mickey isn’t safe from the California Consumer Privacy Act (CCPA). In a landmark enforcement action, the California Attorney General yesterday announced a $2.75 million settlement with The Walt Disney Company, the largest settlement to date under the CCPA.

Imagine wiping your personal information from hundreds of data brokers with one action. No endless opt-outs. No searching for hidden links. No guessing who has your data. Beginning January 1, 2026, California’s Delete Request and Opt-Out Platform (DROP) will make that possible.