What does California’s new privacy law actually do?