But there is no CCPA strategy. CCPA is so weak that compliance is easy: offer data exports and stop selling data on behalf of the handful people who request it. No need to encrypt stored data, or restrict what you collect, or how you collect it.