You may be wondering how this applies to your cannabis business. The fact is that there are numerous ways in which even seemingly passive websites collect protected information from and about users. Even if your website does not sell any products, it may include “Contact Us” or mailing list subscription portals which collect protected information. If your website sells or ships any sort of product, it may collect at least some protected information. Even if your business has not collected information about any California residents in the past but simply could do so, the mere possibility may mean it needs to comply.