What is the California Consumer Privacy Act of 2018 (CCPA)
Text
The California Consumer Privacy Act of 2018 (CCPA) is a state data privacy law that gives California consumers greater control over the personal information businesses collect about them. It was the first comprehensive consumer privacy law in the United States, granting residents rights to know, delete, and opt out of the sale of their personal data, while requiring covered businesses to disclose their data practices and honor these requests.
Signed into law on June 28, 2018 and effective January 1, 2020, the CCPA was later amended and expanded by the California Privacy Rights Act (CPRA), which took effect January 1, 2023.
What rights does the CCPA give California consumers?
Text
The CCPA grants California residents a set of core privacy rights over their personal information. These include the right to know what personal information a business collects, uses, shares, or sells; the right to delete personal information a business has collected; the right to opt out of the sale of their personal information; and the right to non-discrimination, meaning a business can't deny service or charge different prices for exercising these rights. Consumers also have a private right of action to sue in the event of certain data breaches. The CPRA amendments later added two more rights: the right to correct inaccurate information and the right to limit the use of sensitive personal information.
Who has to comply with the CCPA?
Text
The CCPA applies to for-profit businesses that do business in California and meet at least one of three thresholds: Gross annual revenue over roughly $26.6 million (originally $25 million, adjusted for inflation); (2) buying, selling, or sharing the personal information of 100,000 or more California consumers or households per year (raised from 50,000 by the CPRA); or (3) deriving 50% or more of annual revenue from selling or sharing consumers' personal information. Notably, location doesn't matter, a business anywhere in the world must comply if it handles California residents' data and crosses a threshold. Non-profits and government agencies are generally exempt
What is the difference between the CCPA and the CPRA?
Text
The CCPA (2018) and the CPRA (2020) are not two separate laws — the CPRA, sometimes called "CCPA 2.0," amended and expanded the original CCPA. The CPRA, effective January 1, 2023, raised the data-volume threshold to 100,000 consumers, introduced a new category of "sensitive personal information" with stricter rules, added the rights to correct and to limit data use, and extended opt-out rights to cover the sharing of data (not just its sale). It also created a dedicated enforcement body, the California Privacy Protection Agency (CPPA), which took over from the Attorney General. In short, the CCPA laid the foundation, and the CPRA strengthened it.