Under the online privacy law new rules, public and private companies that process personal information will have to reduce data collection and obtain user consent.