CCPA: The Complete Guide
The California Consumer Privacy Act was the first comprehensive consumer privacy law in the United States. Signed into law in 2018 and effective January 1, 2020, the CCPA grants California residents significant control over how businesses collect, use, and sell their personal information.
What the CCPA Covers
The CCPA defines personal information broadly, encompassing identifiers, commercial information, biometric data, internet activity, geolocation data, professional information, and inferences drawn from any of this data. It establishes four core consumer rights: the right to know, the right to delete, the right to opt out of the sale of personal information, and the right to non-discrimination.
Businesses must provide clear notice at or before the point of data collection and maintain an updated privacy policy that discloses categories of information collected, purposes, and third-party sharing practices.
Who Needs to Comply
The CCPA applies to for-profit businesses that collect personal information from California residents and meet at least one of three thresholds: annual gross revenue exceeding $25 million, buying, selling, or sharing the personal information of 100,000 or more consumers or households annually, or deriving 50% or more of annual revenue from selling consumers' personal information.
Service providers and contractors that process personal information on behalf of covered businesses must also comply with specific CCPA obligations through contractual provisions.
Enforcement and Penalties
The California Attorney General enforces the CCPA. Civil penalties reach $2,500 per unintentional violation and $7,500 per intentional violation. The law also provides a private right of action for data breaches resulting from a business's failure to maintain reasonable security, with statutory damages between $100 and $750 per consumer per incident.
Practical Compliance Steps
- Assess applicability — Determine whether your business meets CCPA thresholds
- Data inventory — Map personal information collection, use, and sharing practices
- Update privacy policy — Disclose required categories and consumer rights
- Implement opt-out — Provide a "Do Not Sell My Personal Information" link
- Consumer request processes — Build intake and verification procedures for rights requests
- Vendor contracts — Update agreements with service providers and contractors
- Employee training — Train consumer-facing staff on handling privacy requests
Note that the CPRA, effective January 1, 2023, significantly amends and expands the CCPA. Organizations should evaluate compliance against both the original CCPA and CPRA amendments.