Does this mean Uber and Lyft will now be obliged to provide riders in California who request their personal data with a list of all the passenger ratings drivers give them after each ride? Will Amazon be required to give Prime customers detailed activity logs of their streaming video use? Will smart-mattress companies have to show sleepers moment-by-moment records of their tossing and turning?

“Yes, they have to come back with the specific pieces of personal information,” said Mary Stone Ross, a technology consultant who helped write the ballot initiative that led California to enact the law. “So if they’re collecting that, your sleep information, they have to respond with it.”

The California law’s definition of “selling” personal information includes sharing it for nonmonetary compensation. And the law requires companies “selling” personal information to give consumers the choice to opt out of having their data sold or shared for commercial gain.

Will much of the digital advertising industry, like apps that share user data in exchange for targeted ads, now be obliged to offer consumers a way to opt out?

“There are lots of information exchanges going on in the economy where people don’t pay with cash but there’s some kind of consideration for it,” Lothar Determann, a lawyer at Baker McKenzie who specializes in privacy regulation, told me. “And all of that is to some extent covered by this very overbroad law.” (Mr. Determann said he was speaking generally, not about any particular company.)

The law gives employees in the state some new rights related to the data their employers collect about them. How does this change business as usual?

Until now, Mr. Determann said, employees in the United States typically received “a notice saying that ‘you shall not have any privacy expectations at the workplace — we record and monitor everything for compliance and harassment, trade secret protection purposes,’ and so on. So they were getting antiprivacy notices.”