The California Consumer Privacy Act is a California privacy law that gives residents more control over how businesses collect, use, share, and sell their personal information. It is one of the most important privacy laws in the USA because it can apply to businesses that handle personal information from California residents, even if the business is located outside California.<\/p>\n\n\n\n
The CCPA took effect on January 1, 2020. It was later amended by the California Privacy Rights Act, also called the CPRA. Today, many official California resources refer to the law as the CCPA, as amended.<\/p>\n\n\n\n
This article is for general information only and is not legal advice. Businesses should review the current law, regulations, and legal guidance before making compliance decisions.<\/p>\n\n\n\n\n\n
The California Consumer Privacy Act (CCPA<\/a>) is a state privacy law that gives California residents specific rights over their personal information.<\/p>\n\n\n\n Personal information means information that identifies, relates to, describes, or could reasonably be linked with a particular consumer or household. This can include names, contact details, online identifiers, commercial information, internet activity, geolocation data, and other categories covered by the law.<\/p>\n\n\n\n The CCPA gives consumers the right to ask what information a business collects, how it is used, whether it is sold or shared, and with whom it is disclosed. It also creates duties for businesses, including privacy notices, request-response processes, opt-out options, and safeguards around personal information.<\/p>\n\n\n\n The CPRA amended the CCPA and added new privacy protections that began applying in 2023. The California Attorney General explains that the CPRA did not create a separate law. It amended the CCPA and added new consumer rights and business obligations.<\/p>\n\n\n\n Important changes include:<\/p>\n\n\n\n For businesses, the main takeaway is that CCPA compliance should be reviewed as an ongoing privacy program, not a one-time 2020 checklist.<\/p>\n\n\n\n CCPA compliance generally applies to certain for-profit businesses that do business in California, collect personal information from California residents, and meet legal thresholds.<\/p>\n\n\n\n A business may need to comply if it meets criteria such as:<\/p>\n\n\n\n The older CCPA threshold included 50,000 California residents, households, or devices. Under CPRA amendments, this threshold changed, so businesses should not rely on older numbers without checking the current statute.<\/p>\n\n\n\n This is especially important for SaaS companies, survey platforms, research businesses, ecommerce brands, marketing teams, and companies that collect customer or respondent data from California residents.<\/p>\n\n\n\n The CCPA protects natural persons who are California residents.<\/p>\n\n\n\n This generally includes:<\/p>\n\n\n\n That means a California resident may still have CCPA rights even while traveling or temporarily living elsewhere.<\/p>\n\n\n\n The law can affect both B2C and B2B contexts when personal information from California residents is collected and used. Businesses should review how they collect personal information from customers, employees, prospects, website visitors, survey respondents<\/a>, and business contacts.<\/p>\n\n\n\n The CCPA gives California residents several consumer privacy rights. These rights help consumers understand and control how businesses use their personal information.<\/p>\n\n\n\n Consumers can request information about the personal information a business has collected about them.<\/p>\n\n\n\n This can include:<\/p>\n\n\n\n Consumers can ask a business to delete personal information collected from them, subject to legal exceptions.<\/p>\n\n\n\n A business may be allowed to keep certain information when it is needed to complete a transaction, detect security incidents, comply with legal obligations, or use the information in ways allowed by the law.<\/p>\n\n\n\n Consumers can ask a business to correct inaccurate personal information it maintains about them.<\/p>\n\n\n\n This right was added through the CPRA amendments and is now an important part of CCPA consumer rights.<\/p>\n\n\n\n Consumers can opt out of the sale or sharing of their personal information.<\/p>\n\n\n\n Businesses that sell or share personal information may need to provide clear opt-out mechanisms, such as a \u201cDo Not Sell or Share My Personal Information\u201d link or other accepted methods. California also recognizes opt-out preference signals in certain contexts.<\/p>\n\n\n\n Consumers can ask certain businesses to limit the use and disclosure of sensitive personal information.<\/p>\n\n\n\n Sensitive personal information can include certain types of government identifiers, financial account information, precise geolocation, racial or ethnic origin, religious beliefs, health information, biometric data, and other categories covered by the law.<\/p>\n\n\n\n Businesses cannot discriminate against consumers for exercising their CCPA rights.<\/p>\n\n\n\n This means businesses generally cannot deny goods or services, charge different prices, or provide a different level of service because a consumer used their privacy rights, except where the law allows certain differences tied to the value of the data.<\/p>\n\n\n\n CCPA requirements can vary by business, but most covered organizations need clear processes for privacy notices, consumer requests, opt-outs, and data handling.<\/p>\n\n\n\n Common requirements include:<\/p>\n\n\n\n For companies that collect survey, research, customer experience, or employee experience data, these requirements can affect consent language, privacy notices, retention policies, access controls, and how consumer requests are handled.<\/p>\n\n\n\n CCPA and GDPR<\/a> both focus on privacy rights, but they are not the same law.<\/p>\n\n\n\n The GDPR is a European Union privacy law that applies broadly to personal data processing and has a strong legal basis model for processing data. The CCPA is a California privacy law focused on consumer rights, transparency, access, deletion, correction, opt-out rights, and limits on sale or sharing.<\/p>\n\n\n\n Key differences include:<\/p>\n\n\n\nWhat changed after the CPRA amendments?<\/strong><\/h2>\n\n\n\n
\n
Who needs to comply with the California Consumer Privacy Act?<\/strong><\/h2>\n\n\n\n
\n
Who is protected under the CCPA?<\/strong><\/h2>\n\n\n\n
\n
What consumer rights does the California Consumer Privacy Act provide?<\/strong><\/h2>\n\n\n\n
Right to know<\/h3>\n\n\n\n
\n
Right to delete<\/h3>\n\n\n\n
Right to correct<\/h3>\n\n\n\n
Right to opt out of sale or sharing<\/h3>\n\n\n\n
Right to limit sensitive personal information<\/h3>\n\n\n\n
Right to non-discrimination<\/h3>\n\n\n\n
What are the main CCPA requirements for businesses?<\/strong><\/h2>\n\n\n\n
\n
How is CCPA different from GDPR?<\/strong><\/h2>\n\n\n\n