AB 375 - California Consumer Privacy Act of 2018

• Grants California consumers the right to request disclosure of what personal information businesses collect, the sources, purposes, and third parties with whom it is shared, effective January 1, 2020.

• Authorizes consumers to request deletion of their personal information and to opt out of the sale of their data; prohibits businesses from discriminating against consumers who exercise these rights.

• Requires opt-in consent (not opt-out) for sale of personal information of consumers under 16 years old, with stricter requirements for those under 13.

• Establishes private right of action for consumers whose unencrypted personal information is subject to unauthorized access or theft due to business negligence, with statutory damages of $100-$750 per consumer per incident or actual damages, whichever is greater.

• Applies to businesses with annual gross revenues exceeding $25 million, or that annually buy, sell, or share personal information of 50,000+ consumers or devices, or derive 50%+ of revenue from selling personal information; creates Consumer Privacy Fund supported by civil penalties for violations.