After a long lead-up period, the California Consumer Privacy Act (CCPA) officially went into effect Jan. 1. While businesses and other organizations have had almost a year to adapt to the expectations placed on them by the most robust state privacy regulation in America, their work may just be getting started. For starters, the CCPA has continued to evolved over the course of the last year, perhaps most notably with the passage of the California Privacy Rights Act of 2020 (CPRA). The new law promises to not only introduce a data enforcement authority, but sets several additional benchmarks for compliance around consumer data protections. Still, even without the new wrinkles, the CCPA continues to present enough ongoing challenges for businesses all on its own. Vagaries such as the definition of "reasonable" security measures or the true value of consumer data will likely keep companies on their toes well into 2021, especially with COVID-19 drawing attention to new data sources that are sure to come under regulatory scrutiny.