California became the first state to enact a consumer privacy law. Set to take effect on January 1, 2020, it requires businesses (those in California and those to sell to Californians) to tell consumers whether it will share or sell their personal information collected, or how they’ll use it. Small businesses ($25 million or less in revenue or information on fewer than 50,000 people) are exempt, but not if half their revenue comes from selling personal information. Will other states follow suit?