Web companies doing business with Californians are beholden to a new state law protecting consumer privacy, and industry executives believe many sites have yet to comply. As of July 1, California companies operating a commercial Web site must post a conspicuous privacy policy on their Web sites and disclose the kinds of personally identifiable data that they collect and share with third parties, according to the California Online Privacy Protection Act of 2003.