CCPA

The California Consumer Privacy Act (CCPA) is a state-level privacy regulation enacted to protect the privacy rights of California residents. Enforced since January 1, 2020, the CCPA grants consumers the right to know what personal information is collected, request its deletion, and opt-out of the sale of their data. Businesses subject to the CCPA are required to implement measures ensuring transparency, consumer rights, and data protection.

The CCPA gives consumers more control over the personal information that businesses collect about them, and the CCPA regulations provide guidance on how to implement the law. This landmark law secures new privacy rights for California consumers, including:

• The right to know about the personal information a business collects about them and how it is used and shared;
• The right to delete personal information collected from them (with some exceptions);
• The right to opt-out of the sale or sharing of their personal information; and
• The right to non-discrimination for exercising their CCPA rights.

In November of 2020, California voters approved Proposition 24, the California Privacy Rights Act (CPRA), which amended the CCPA and added new additional privacy protections that began on January 1, 2023. As of January 1, 2023, consumers have new rights in addition to those above, such as:

• The right to correct inaccurate personal information that a business has about them; and
• The right to limit the use and disclosure of sensitive personal information collected about them.

Businesses that are subject to the CCPA have several responsibilities, including responding to consumer requests to exercise these rights and giving consumers certain notices explaining their privacy practices. The CCPA applies to many businesses, including data brokers.

CPRA amends the CCPA; it does not create a separate, new law. As a result, our office typically refers to the law as “CCPA” or “CCPA, as amended.”