Skip to main content

California Consumer Privacy Act (CCPA)

The California Consumer Privacy Act (CCPA) is a landmark privacy law that was enacted in California and took effect on January 1, 2020. It is designed to enhance privacy rights and consumer protection for residents of California. The law grants several important rights to California residents (referred to as “consumers”) and imposes certain obligations on businesses that collect, store, and process personal data.

Key Features of the CCPA:

  1. Right to Know: Consumers have the right to request information about the personal data that businesses collect about them. This includes details about the categories of data collected, the sources of the data, the purpose for which the data is used, and whether the data is sold or shared with third parties.
  2. Right to Delete: Consumers can request that businesses delete their personal data, subject to certain exceptions (e.g., if the data is necessary for business operations like fulfilling contracts).
  3. Right to Opt-Out: Consumers can opt out of the sale of their personal data. Businesses must provide a clear mechanism for consumers to exercise this right.
  4. Right to Non-Discrimination: Consumers are protected from being discriminated against for exercising their CCPA rights. For example, businesses cannot deny services or charge different prices to consumers who choose to opt out of data sales.
  5. Right to Correct: Consumers can request that businesses correct inaccurate personal data.
  6. Data Access and Portability: Consumers can request a copy of their personal data in a usable format, allowing them to transfer it to other services if desired.

Applicability:

The CCPA applies to businesses that:

  • Collect personal data of California residents
  • Have annual gross revenues of $25 million or more
  • Handle personal data of 50,000 or more consumers, households, or devices
  • Derive a significant portion of their revenue from selling personal data

Enforcement and Penalties:

  • The California Attorney General has the authority to enforce the CCPA. Violations can result in fines of up to $2,500 per violation (or up to $7,500 for intentional violations).
  • Consumers have a right to seek civil penalties for certain violations, and businesses must provide consumers with the ability to file complaints about their rights being violated.

Amendments and Expansion (CPRA):

In November 2020, California voters passed the California Privacy Rights Act (CPRA), which amends and expands the CCPA. The CPRA, which came into effect on January 1, 2023, introduced new concepts, including:

  • The creation of the California Privacy Protection Agency (CPPA) to oversee enforcement.
  • Additional consumer rights, such as the right to limit the use of sensitive personal information (e.g., health data, financial information).
  • The concept of “sharing” data in addition to selling it, with additional rights for consumers to control how their data is shared.

The CCPA and CPRA together form a comprehensive privacy framework that gives consumers in California significant control over their personal information while imposing strict compliance requirements on businesses.