Many businesses assume their California privacy exposure is fully addressed through compliance with the California Consumer Privacy Act (CCPA). But that assumption can leave important gaps. We are seeing a rise in inquiries and pre-litigation letters invoking California’s “Shine the Light” law. These requests may appear routine but mishandling them can create real statutory and litigation risk.