Protect California consumer privacy with automated compliance

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), is a comprehensive privacy law that gives California residents control over their personal information. It grants rights to know, delete, correct, opt-out of sale/sharing, limit sensitive data use, and be free from discrimination. The law applies to for-profit businesses meeting revenue, data volume, or data sale thresholds.

CCPA applies to for-profit businesses that collect California residents' personal information AND meet at least one threshold: annual gross revenue exceeding $25 million; annually buying, selling, or sharing personal information of 100,000+ California consumers, households, or devices; or deriving 50% or more of annual revenue from selling or sharing California consumers' personal information.

CCPA defines personal information broadly as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with a particular consumer or household. This includes identifiers, commercial information, biometric data, internet activity, geolocation, professional information, education information, and inferences drawn from this data.

CPRA (California Privacy Rights Act) is a ballot initiative that amended and expanded CCPA, effective January 1, 2023. Key additions include: the California Privacy Protection Agency (CPPA) for enforcement; new rights to correct data and limit sensitive data use; expanded opt-out rights for cross-context behavioral advertising; stricter requirements for service provider contracts; and data minimization and retention requirements.

The California Privacy Protection Agency (CPPA) can impose civil penalties up to $2,500 per unintentional violation and $7,500 per intentional violation or violations involving minors. Additionally, consumers have a private right of action for data breaches involving unencrypted or unredacted personal information, with statutory damages of $100-$750 per consumer per incident, or actual damages if greater.

While both protect consumer privacy, key differences include: CCPA applies to businesses meeting thresholds while GDPR applies to any data processor; CCPA focuses on transparency and opt-out rights while GDPR requires explicit consent for many processing activities; CCPA primarily covers California residents while GDPR protects EU residents; CCPA allows continued data use until opt-out while GDPR often requires affirmative consent.

Under CCPA, consumers can submit verifiable requests to know what personal information a business collects, uses, discloses, or sells about them. Businesses must verify the requester's identity and respond within 45 days (extendable by another 45 days for complex requests). The response must be free of charge and cover the 12 months preceding the request.

If your business sells or shares personal information (including for cross-context behavioral advertising), you must provide a clear and conspicuous "Do Not Sell or Share My Personal Information" link on your website and in your privacy policy. You must also honor Global Privacy Control (GPC) browser signals as valid opt-out requests.