Good breakdown, and excellent clarification. That said, I see some of those "legitimate business purposes" as things the CCPA was explicitly intending to redef

Good breakdown, and excellent clarification. That said, I see some of those "legitimate business purposes" as things the CCPA was explicitly intending to redefine as illegitimate. In particular, while it says it would still limit third-party data collection for marketing, it would no longer limit when the company itself (e.g. Facebook) does that data collection for itself. Additionally the "analytics services" is standard speak for "all data that can be hoovered up for cross-site tracking", and is specifically exempted as well. On the face there is certainly clarification that' needed, and some of the exemptions are needed (E.g. security features), but the current bill clearly includes extras that effectively completely revoke everything the CCPA tries to do.