The way I read it the act applies to businesses in California that collect data from people. Yes, it supposedly grants rights that would be valid under the 10th Amendment but what it really DOES is it regulates businesses that collect and sell data about individuals.
This follows Becerra’s efforts to prohibit employers from cooperating with DHS and ICE so I am thinking there’s more to it than face value.