Microsoft announced this week that it would extend the consumer rights currently given to California consumers through the California Consumer Privacy Act to all consumers—no matter where they reside.

I applaud this move (especially because I don’t reside in CA). But why should my personal information be protected differently than those who live in California?

Many global companies are making the same choice, deciding to treat everyone’s personal information the same. It appears many states will follow California in affording similar privacy rights to consumers, and it sometimes is easier to implement the same policies and procedures for all consumers than for just those in specific states. And it does not appear that we will have a national privacy law any time soon. So what is a business to do?

For global companies, a one-size-fits-all solution makes sense from an efficiency and operational point of view. For others, baby steps make sense.

The point with CCPA compliance is that it is not one-size-fits-all. Each business needs to determine what makes sense for it in terms of risk and the cost and efficiency of operations. For some, it makes sense to extend the technological and compliance obligations to all consumers. But for others, the cost of doing so, as well as the number of people it affects, is prohibitive.

Businesses have to determine what makes sense for them for CCPA compliance.  They need to determine whether CCPA applies, how it applies, and how they will comply. It might make sense to implement a global compliance program or a baby step one. Either way, compliance is required by January 1, 2020, so now is the time to figure out which way to go.