On June 28, the California Legislature hastily passed the California Consumer Privacy Act of 2018 (CCPA). The law, which takes effect in less than 1 ½ years, Jan. 1, 2020, ushers in a GDPR-light approach here in the United States. No more buffer. No more distant regulators unable or unwilling to reach US companies on their home turf. If they haven’t already done so, the time for ad tech companies to change the way they store and process data is fast approaching.