I think the person meant that if you don't comply there may be civil or criminal consequences, so if you want to knowingly provide a non compliant website or app, you should host it on tor to prevent your person from being the subject of the state.

I know the CA law is civil only, so I don't think there is much CA can do if you publish an OS and don't make money from CA folks, but other implementations may decide to impose criminal penalties.

Thank you. That makes sense.