The term versus the law
The CCPA, the California Consumer Privacy Act, is a statute. It has been in force since January 1, 2020, was amended by the California Privacy Rights Act (CPRA), and is enforced by the Attorney General and the California Privacy Protection Agency. “CCPA compliance” is not the law itself. It is the response to the law: the ongoing work of staying within its requirements.
The law defines duties. Compliance defines the work. Regulators judge a business by its own records: the privacy policy, request logs, and vendor contracts.
The law: a statute defining covered businesses, consumer rights, and penalties, wherever the business is based. Compliance: the business-side program: inventory, request handling, disclosure, vendor management and training.
Who is in scope
The CCPA reaches far beyond California. Any for-profit business that collects personal information from California consumers is covered if it meets at least one of three thresholds.
The result is a global market frame. A company with no US office can fall under the law if its website serves California consumers at the required scale. Exemptions for employee and business-to-business data have expired, so HR records and professional contacts are covered too.
| Threshold | Test |
|---|---|
| Annual gross revenue | Above $25 million |
| Personal information | Bought, sold or shared for 100,000+ consumers or households a year |
| Revenue from data | 50 percent or more of annual revenue from selling or sharing it |
Step one: inventory and flow mapping
Nothing else works until this step is done. A business cannot honor a deletion request until it knows what personal information it holds. The inventory records each category, its source, purpose, systems, retention period, and third-party recipients.
The flow map extends the inventory to movement: how data travels between systems, processors, and channels such as email, cloud storage, and removable media. Gaps surface here. Data can leave the official system of record through a channel the inventory never described.
Searching the captured data
The console can search captured data across mail, messengers, web, and other channels, which helps check what actually moved.
Consumer request procedures
The CCPA gives consumers enforceable rights. Compliance means a documented procedure for each one.
Requests must be answered within 45 days. The period can be extended once by 45 more days, and requests must cover at least the preceding 12 months. Verification must be proportionate: strong enough to prevent fraud, without collecting more data. Businesses must accept authorized agents, and they may not penalize consumers who exercise their rights in price or service.
| Right | What it covers |
|---|---|
| Right to know | Disclosure of personal information collected, with sources, purposes, and recipients |
| Right to delete | Removal of personal information, extended to service providers, with exceptions |
| Right to correct | Correction of inaccurate personal information, added by the CPRA |
| Right to opt out | Of sale and sharing for behavioral advertising. Browser opt-out signals must be honored. |
| Right to limit | Use of sensitive personal information only for purposes the law allows |
| Right to portability | Receipt of personal information in a readily usable format |
Privacy policy, training, and vendors
The privacy policy is the public face of the program. It must list the categories of personal information collected, their sources, purposes, and retention, the third parties the data is shared with, and how to exercise each right. A business that sells or shares personal information must also carry a “Do Not Sell or Share My Personal Information” link on its website.
Internally, compliance rests on people and contracts. Staff need training to recognize and route consumer requests, because a late response is itself a violation. Vendors acting as service providers or contractors must be bound by CCPA-required clauses that restrict how they use personal information.
Enforcement
Regulators can impose the fines below, counted per consumer. Consumers also have a private right of action over certain breaches caused by unreasonable security.
| Violation | Penalty or damages |
|---|---|
| Each violation | $2,500 per violation |
| Intentional violation or one involving minors | $7,500 per violation |
| Breach caused by unreasonable security | Statutory damages of $100 to $750 |
How it looks in Anexet
These frames show how an endpoint DLP layer recognizes personal information by content, with keyword lists and digital fingerprinting.
1 / 4
The ongoing cycle
Compliance is therefore ongoing, not a project. Inventories age, vendors change, and every request is a live test. Mature programs run the CCPA as a cycle: inventory the data, map the flows, respond, disclose, and verify the vendors.
Further reading: Use Anexet Ultimate DLP system for GDPR compliance.
No tool makes a business compliant. Anexet helps with two steps: seeing where personal information flows and keeping a record of who handled it.
Anexet TeamHow Anexet handles this
No tool makes a business CCPA compliant. There is no certification to buy, and Anexet neither holds one nor grants one. An endpoint monitoring and data loss prevention layer contributes to two steps of the process above: seeing where personal information actually flows, and keeping an attributable record of who handled it.
The on-premise architecture matters here too. Records generated while observing data flows, such as captured content, audit logs, and risk history, stay inside the organization’s own infrastructure. That matches the confidentiality privacy work demands.
Visibility of data flows
Endpoint agents observe email, web, cloud storage, messaging, removable devices, printing, and the clipboard. These are the channels through which personal information leaves systems of record. The flow map then shows observed movement, not just documented systems.
Content-based detection
Security term lists, hash banks, digital fingerprint libraries, and sensitivity labels identify personal information inside transfers by its content. This surfaces copies the inventory missed.
Attributable audit trail
Every recorded event carries the user, timestamp, channel, and classification. These records reconstruct how a person’s data was handled when a request or an investigation asks.
Anexet DLP
Learn more