CCPA
The California Consumer Privacy Act (CCPA) is a state-level data privacy law that grants California residents specific rights regarding their personal information and imposes obligations on businesses that collect, process, or sell that data.
Enacted in 2018 and effective from January 1, 2020, the CCPA was one of the first comprehensive consumer privacy laws in the United States. It was later amended and expanded by the California Privacy Rights Act (CPRA), which took effect on January 1, 2023, creating the California Privacy Protection Agency (CPPA) to enforce the regulations.
The CCPA applies to for-profit businesses that do business in California and meet at least one of the following thresholds: annual gross revenue exceeding $25 million, buying, selling, or sharing the personal information of 100,000 or more consumers or households, or deriving 50% or more of annual revenue from selling or sharing consumers' personal information.
Under the CCPA, California residents have the right to know what personal information is being collected, the right to delete personal information, the right to opt out of the sale or sharing of their personal information, and the right to non-discrimination for exercising their privacy rights. The CPRA amendments added the right to correct inaccurate personal information and the right to limit the use and disclosure of sensitive personal information.
Businesses must provide clear privacy notices at or before the point of data collection and include a conspicuous "Do Not Sell or Share My Personal Information" link on their websites. Violations can result in civil penalties of up to $2,500 per unintentional violation and $7,500 per intentional violation, enforced by the California Attorney General and the CPPA.