We analyze how the adoption of the California Consumer Privacy Act (CCPA), which limits the acquisition, processing, and trade of consumer personal data, heterogeneously affects firms with and without previously gathered customer data. Exploiting a novel and hand-collected data set of 11,436 conversational-AI firms with rich personal information on U.S. consumers, we find that the CCPA gives a strong protection and advantage to firms with previously accumulated (in-house) data. First, products of these firms generate more customer feedback and exhibit higher product ratings after the adoption of the CCPA. Second, publicly traded firms with in-house data exhibit higher valuations, profitability, asset utilization, and they invest more after the adoption of the CCPA. Third, earnings of such firms can be more accurately predicted by analysts. To rationalize these empirical findings, we build a general equilibrium model where firms produce intermediate goods using labor and data in the form of intangible capital. Data can be traded with other firms subject to a cost representing regulatory and technical challenges. Firms differ in their ability to collect data internally, driven by their business models and/or the size of their customer base, and reliance on data. When the introduction of the CCPA increases the cost of trading data, firms with a low ability to collect in-house data and high reliance on data suffer the most as they cannot adequately substitute the previously externally purchased data.