They're subject to California law, so yeah.

https://oag.ca.gov/privacy/databreach/reporting