California’s privacy statute regulates companies, but not against out-of-state plaintiffs: a recent decision, two takeaways