California’s privacy law raises risks of legal action and fines over data collection