Thankfully California was so much smarter with their qualifications than the EU was - it only affects companies with (a) annual gross revenues of $25 million; (b) obtains personal information of 50,000 or more California residents, households or devices annually; or (c) 50 percent or more annual revenue from selling California residents’ personal information. Way easier for small companies like us to deal with.
There should be an added caveat... if you post your junk on Facebook or Twiiter, we get to sell your junk. 😉
How about, "Nothing is free. If you aren't paying for it, you're not the customer... You're the product being sold"?