The era of "checking the box" on privacy is over. California regulators have moved past simple policy audits and are now "pen-testing" the ...