Does your company meet any of the following requirements? If so, you have a legal obligation to comply:
Gross annual revenue of $25m.
Buy, receive, or sell the personal information of 50,000 or more California residents, households, or devices.
Derive 50% or more of annual revenue from "selling" California residents' personal information.
If your company operations meet any of the above thresholds then you have a legal obligation to take action and comply with the requirements of most US Privacy laws.
Failure to comply could result in EACH customer bringing a lawsuit with damages up to $750/customer + legal fees. The California Attorney General can also bring legal action against your business.