CCPA

Definition

The California Consumer Privacy Act, or CCPA, is a state law granting California residents specific rights over the personal information that businesses collect about them, including the right to know what data is collected, request its deletion, and opt out of its sale or sharing. It applies to for-profit businesses meeting certain revenue or data-volume thresholds that do business in California, requiring them to disclose collection practices and honor consumer requests within defined timeframes.

Overview

CCPA emerged from growing public concern that consumers had little visibility into or control over the vast amounts of personal data collected by businesses, particularly through online tracking and data brokerage. California voters and legislators moved to give residents enforceable rights modeled loosely on European approaches but adapted to a state-level, business-focused regulatory structure, making California the first U.S. state to enact a comprehensive consumer privacy law of this scope. Mechanically, CCPA applies to for-profit entities doing business in California that meet at least one of several thresholds, such as exceeding a set annual revenue figure, buying or selling personal information of a minimum number of consumers or households, or deriving a defined share of revenue from selling personal information. Covered businesses must provide a clear privacy notice describing categories of data collected and purposes for collection, offer a mechanism for consumers to submit access, deletion, and opt-out requests, and respond within statutory deadlines, verifying the requester's identity before fulfilling sensitive requests like deletion. CCPA differs from GDPR in scope and mechanism: GDPR is a broad European Union regulation applying to essentially any organization processing EU residents' data regardless of size, with a legal basis requirement for all processing, while CCPA is narrower, applying only to businesses meeting specific size thresholds and focusing on disclosure, opt-out, and deletion rights rather than requiring an affirmative legal basis for every processing activity. It also differs from sector-specific U.S. laws like GLBA or HIPAA, which govern particular industries rather than consumer data broadly across a state's economy. In practice, businesses build CCPA compliance programs around a consumer-facing privacy policy, a "Do Not Sell or Share My Personal Information" mechanism, and internal processes to locate, export, or delete a given consumer's data across systems when a verified request arrives. Later amendments, primarily through the California Privacy Rights Act, added further rights around correction and use of sensitive personal information and created a dedicated state enforcement agency. Compliance is complicated by the practical difficulty of locating a specific individual's data across fragmented internal systems and vendor relationships, and by ambiguity in some statutory definitions that businesses and regulators have refined through subsequent guidance and amendments. Because CCPA applies specifically to California residents and businesses meeting its thresholds, companies operating nationally often build a single, broader privacy program, sometimes extending CCPA-like rights to all U.S. customers, rather than maintaining separate compliance logic per state as more states adopt similar laws.

Key Concepts

• Grants California residents rights to know, delete, and opt out of data sales
• Applies to for-profit businesses meeting revenue or data-volume thresholds
• Requires a clear, accessible privacy notice describing data practices
• Mandates a mechanism for consumers to submit verifiable requests
• Sets statutory deadlines for responding to consumer rights requests
• Expanded by the California Privacy Rights Act with additional protections
• Enforced by a dedicated state privacy protection agency
• Distinguishes personal information sale from other data sharing activities

Use Cases

Frequently Asked Questions

Related in Cybersecurity