IANAL, but if the data is being shared with “3rd parties” and/or “service providers” they definitely would. Sadly, I doubt it will actually be enforced by the California AG anytime soon.