CCPA (California Consumer Privacy Act)

What is CCPA (California Consumer Privacy Act)?

The California Consumer Privacy Act (CCPA), effective January 1, 2020, is a comprehensive privacy law that gives California residents significant rights over their personal information. It applies to for-profit businesses that collect California residents' personal information and meet thresholds: annual revenue over $25M, data on 50,000+ consumers/households/devices, or 50%+ revenue from selling personal information.

CCPA grants consumers four key rights: the right to know what personal information is collected and how it's used, the right to delete personal information held by businesses, the right to opt-out of the sale of personal information, and the right to non-discrimination for exercising their privacy rights. Businesses must provide clear notice of collection, honor consumer requests within 45 days, and implement reasonable security measures.

The CPRA (California Privacy Rights Act), which took effect January 2023, significantly expands CCPA with additional rights including data correction, limitation of sensitive personal information use, and automated decision-making opt-out. Violations can result in statutory damages of $100-$750 per consumer per incident, or actual damages, whichever is greater, plus civil penalties up to $7,500 per intentional violation.