California has some of the strictest privacy legislation on the books, and it began with the California Online Privacy Protection Act of 2003 (CalOPPA), a broad law that requires privacy policies to address what personally identifiable information is being tracked, with whom the information is being stored, and whether there is a process for reviewing and requesting changes to that data.