Source: https://cppa.ca.gov/                                                                                  
1. Overview

The California Consumer Privacy Act (CCPA) is a comprehensive data privacy law that grants privacy rights and consumer protection for residents of California, United States.

It was enacted in 2018 and became enforceable on January 1, 2020, with later amendments introduced through the California Privacy Rights Act (CPRA), which expanded and strengthened the original law starting in 2023.

CCPA is one of the most influential U.S. privacy laws and is often compared to the EU’s GDPR.

2. Where CCPA Applies

CCPA applies specifically to businesses that collect personal data from California residents, regardless of where the business is located.

Geographic Scope

• Applies to California residents only

• Applies to businesses inside or outside the United States if they process California residents’ personal data

Businesses Covered by CCPA

A business is generally subject to CCPA if it meets at least one of the following thresholds:

• Has annual gross revenue over $25 million, or

• Buys, sells, or shares personal information of 100,000 or more California consumers or households per year, or

• Derives 50% or more of annual revenue from selling or sharing personal information

Service Providers and Third Parties

CCPA also applies to:

• Service providers (companies processing data on behalf of a business)

• Third parties receiving or selling personal data

3. What Data Does CCPA Protect?

CCPA protects “personal information”, which includes any data that identifies, relates to, or could reasonably be linked to a California resident or household.

Examples include:

• Name, email address, phone number

• IP address and device identifiers

• Browsing history and online activity

• Location data

• Purchase history

• Biometric data

• Inferences drawn from personal data (e.g., profiles or preferences)

4. How CCPA Works

CCPA is built around consumer rights, transparency obligations, and restrictions on the sale of personal data.

4.1 Core Consumer Rights

California residents are granted several rights under CCPA:

• Right to Know:
  Consumers can request what personal data a business collects, uses, and shares.

• Right to Delete:
  Consumers can request deletion of personal information collected from them (with some exceptions).

• Right to Opt-Out of Sale or Sharing:
  Consumers can stop businesses from selling or sharing their personal data.
  (This is often implemented via a “Do Not Sell or Share My Personal Information” link.)

• Right to Correct:
  Consumers can request correction of inaccurate personal information (introduced by CPRA).

• Right to Limit Use of Sensitive Personal Information:
  Consumers can restrict how sensitive data is used (e.g., precise geolocation, financial data).

• Right to Non-Discrimination:
  Businesses cannot discriminate against users for exercising their privacy rights (e.g., denying services or charging different prices unfairly).

4.2 Business Obligations

Businesses subject to CCPA must:

• Provide a clear privacy policy disclosure

• Inform users about data collection practices

• Offer at least two methods for submitting privacy requests (e.g., website form, toll-free number)

• Respond to verified consumer requests within 45 days

• Implement “Do Not Sell or Share” mechanisms where applicable

• Maintain reasonable security practices to protect personal data

5. Data Sharing and “Sale” of Data

CCPA has a broad definition of “sale,” which includes:

• Selling data for money

• Sharing data for valuable consideration (including targeted advertising)

This means even advertising trackers or data exchanges may fall under CCPA regulation.

6. Enforcement and Penalties

CCPA is enforced by the California Privacy Protection Agency (CPPA) and the California Attorney General.

Penalties include:

• Up to $2,500 per violation (unintentional)

• Up to $7,500 per violation (intentional violations or involving minors)

• Additional penalties for failure to cure violations within required timeframes (where applicable)

Consumers may also bring private lawsuits in cases of certain data breaches involving sensitive personal information.

7. CCPA vs GDPR (Quick Comparison)

8. Summary

The CCPA is a U.S. state-level privacy law that protects California residents by giving them control over their personal data. It applies to businesses worldwide that meet certain thresholds and collect data from California consumers.

It focuses on:

• Transparency in data collection

• Consumer control over data use

• Restrictions on selling/sharing personal information

• Strong enforcement and penalties for non-compliance