CCPA

The California Consumer Privacy Act (CCPA) is a California statute enacted in 2018 that governs the collection, use, and sale of personal information by businesses. It applies to for-profit entities that do business in California and meet certain thresholds related to revenues, data processing, or the number of California residents whose information is processed. The act defines personal information broadly and seeks to give California residents greater control over how their data is handled.

The CCPA grants several consumer rights, including the right to know what personal information is collected, used, shared, or sold; the right to access and obtain a copy of that information; the right to request deletion of personal information, subject to certain exceptions; and the right to opt out of the sale or sharing of personal information and certain targeted advertising practices. It also provides that individuals should not face discrimination for exercising these privacy rights. Businesses must inform consumers about their data practices and provide processes to submit and respond to such requests.

Business obligations under the CCPA include providing clear privacy notices at the point of collection, responding to consumer requests within specified timeframes, implementing reasonable security procedures, and ensuring that service providers and contractors handle data in accordance with contractual obligations. The act restricts certain data practices and requires administrative, technical, and physical safeguards to protect personal information.

The CPRA, a major amendment to the CCPA, expanded protections by creating the California Privacy Protection Agency and introducing additional rights and categories, including sensitive personal information and a right to correct inaccurate information. The CPRA also broadens data minimization and purpose limitation concepts and enhances enforcement capabilities.