The past few months have seen regulators from various offices jump into the nascent, if chaotic, landscape of data privacy laws—oftentimes adding more questions than answers.

But the latest enforcement action from the California Attorney General’s office has offered the most concrete insight yet.