Earlier quoted context omitted.
They can't, but if you make CA mad and they decide to sue you, you'll be out much more than it would've cost to just copy and paste a boilerplate privacy policy. A great deal of legal mechanics work this way -- sure, someone can't technically make that kind of mandate, but since it costs a lot of money and time to have a court case where that kind of thing gets proven, you're better off just making sure no one even t…
Bad idea: Giving legal advice without a license. Worse idea: giving incorrect legal advice without a license. Jurisdiction is complex. With the Internet, you do not need to have a physical location somewhere to do business there.
>With the Internet, you do not need to have a physical location somewhere to do business there.
Although this is true, the rule of thumb has generally been that sites are governed by the rules of the principality where their servers reside, because it's the only effective or practical way to determine jurisdiction in a worldwide network. (It's likely that most websites have something hosted in CA, by the way).
I agree that this issue can become complex, but it's really only a side note to the intent of the post, which is that under our current legal structure, people are regularly bullied by plaintiffs that make exercising legal rights and obtaining justice much more costly than just complying with their original demands. The privacy policy thing is just one example of this.