What is CCPA?
Also called California Consumer Privacy Act, CPRA.
The CCPA is California's consumer privacy law, significantly amended by a later ballot measure, granting residents rights to know, delete and correct personal information and to opt out of its sale or sharing. It applies to for profit businesses meeting statutory thresholds that handle California residents' personal information, regardless of where the business itself is located.
The rights framework differs from European law in emphasis. Rather than requiring a lawful basis before processing, the statute centers on disclosure and opt out. Businesses must describe the categories of personal information collected, the purposes, and the categories disclosed to others, and must provide accessible mechanisms to exercise rights, including a way to opt out of sale or sharing for cross context behavioral advertising.
The amended law added rights to correct inaccurate information and to limit the use of sensitive personal information, extended coverage to employee and business contact data, and created a dedicated state privacy agency alongside attorney general enforcement. Contracts with service providers and contractors must include specified terms, and businesses must honor recognized opt out preference signals sent by a browser or device.
Sale and sharing are defined broadly enough to capture common advertising integrations that involve no money changing hands. Many businesses discover that embedding third party tags qualifies, which is why opt out links and preference signal handling became widespread. Response deadlines for consumer requests are set by the statute and are generally somewhat longer than the European baseline, with an extension available.
Regulatory attention to automated decision making and profiling has been developing through agency rulemaking, and other United States states have enacted their own comprehensive privacy laws with overlapping but not identical requirements. Organizations therefore tend to build one rights handling process and configure jurisdictional differences on top, rather than maintaining separate programs per state.
Key points
- Grants rights to know, delete, correct and opt out
- Applies to qualifying businesses handling California residents' data
- Sale and sharing definitions capture common ad integrations
- Opt out preference signals must be honored
- Rules on automated decision making have been developing
In practice
A software company with California customers publishes a privacy notice listing collected categories and purposes, adds an opt out link for sharing, and configures its site to honor browser opt out signals. Its request process verifies identity, then returns the categories collected, the sources, the purposes and the recipients. Contracts with analytics vendors are updated to include the terms the statute requires of service providers.