What the CCPA is
The California Consumer Privacy Act (CCPA) was signed in June 2018 and took effect on 1 January 2020. It was the first comprehensive consumer privacy law in the United States. It gives California residents, called consumers in the law, direct rights over the personal information businesses hold about them. An office in California is not required: a business is covered if it does business in the state and meets a threshold.
In November 2020, California voters approved the California Privacy Rights Act (CPRA), which amended and expanded the CCPA. It added new rights, a category of sensitive personal information, stricter rules for service providers and contractors, and data minimization and retention limits. The CPRA also created the California Privacy Protection Agency (CPPA), the first US regulator dedicated to privacy. The CPPA writes the implementing regulations and enforces the law together with the California Attorney General.
Who must comply
The CCPA applies to a for-profit business that does business in California and meets at least one of three thresholds. Entities that control or are controlled by such a business and share its brand are covered too.
| Threshold | Condition |
|---|---|
| Revenue | Annual gross revenue above USD 25 million in the preceding calendar year; the figure is adjusted for inflation |
| Data volume | Buys, sells or shares the personal information of 100,000 or more consumers or households a year |
| Data revenue | Earns 50% or more of annual revenue from selling or sharing personal information |
Consumer rights
The CCPA gives consumers seven rights. The CPRA added two of them: the right to correct and the right to limit.
| Right | What it means |
|---|---|
| Know | Learn what personal information is collected, for what purposes and whether it is sold or shared; get the specific pieces held |
| Delete | Have personal information deleted by the business and its service providers, subject to legal exceptions |
| Correct | Have inaccurate personal information corrected |
| Opt out | Stop the sale of personal information and its sharing for cross-context behavioral advertising; browser opt-out signals must be honored |
| Limit | Restrict the use and disclosure of sensitive personal information to the purposes the regulations allow |
| Data portability | Receive data collected by automated means in a usable, transferable format |
| Non-discrimination | No denial of service or different prices for exercising a right |
How requests are handled
Requests follow a fixed procedure with legal deadlines. The clock starts on the day the business receives the request.
- 1
Receive the request
Consumers can submit requests through at least two designated methods.
- 2
Verify the requester
The business confirms the requester's identity before it discloses, deletes or corrects data.
- 3
Respond within 45 days
The business answers within 45 days of receiving the request.
- 4
Extend once if needed
Where reasonably necessary, the deadline can be extended once by another 45 days. The consumer must be told within the first 45 days.
Business obligations
A covered business must give a notice at collection, publish a privacy policy and sign written contracts that limit how service providers and contractors use personal information. CPPA regulations are phasing in further duties: risk assessments and cybersecurity audits for higher-risk processing, and notices about automated decision-making.
A business that sells or shares personal information must, as a rule, place a clear link on its homepage with the wording set by the law:
Do Not Sell or Share My Personal Information
California Civil Code § 1798.135Enforcement and penalties
The CPPA and the California Attorney General enforce the law. Each affected consumer can count as a separate violation, so totals grow fast in large incidents. The amounts below are set in the statute and adjusted for inflation.
| Case | Who acts | Amount |
|---|---|---|
| Violation | CPPA or Attorney General | Up to USD 2,500 per violation |
| Intentional violation, or data of consumers under 16 | CPPA or Attorney General | Up to USD 7,500 per violation |
| Breach of unencrypted data caused by a lack of reasonable security | The affected consumer, in court | USD 100 to 750 per consumer per incident, or actual damages if higher |
CCPA vs GDPR
Multinational organizations often run the CCPA and the EU General Data Protection Regulation (GDPR) as one program. The two laws, however, rest on different models.
Further reading: How do i keep my Personal Data safe?; Use Anexet Ultimate DLP system for GDPR compliance.
| Aspect | CCPA | GDPR |
|---|---|---|
| Who is covered | For-profit businesses that meet California thresholds | Organizations of any size established in the EU/EEA or targeting people there |
| Core model | Opt-out: processing is allowed until the consumer opts out of sale or sharing | Lawful basis: a legal ground such as consent is required before processing |
| Key roles | Business, service provider, contractor | Controller, processor |
| Regulator | California Attorney General and the CPPA | National supervisory authorities in each member state |
| Penalties | Fines per violation, up to USD 7,500 | Up to EUR 20 million or 4% of global annual revenue |