🛡️California Consumer Privacy Act (CCPA)

NEW

Also known as: California Consumer Privacy Act

California privacy law granting consumers rights over personal information collected by businesses and imposing obligations on covered entities.

DESCRIPTION

CCPA grants rights such as access, deletion, and opt-out of sale of personal information for California residents. It mandates disclosures, data mapping, request handling, and reasonable security practices. The CPRA amended and expanded CCPA, adding enforcement by the California Privacy Protection Agency. Organizations must update notices, contracts, and processes to comply. CCPA complements global regimes like GDPR and sector-specific laws.

ALTERNATIVE DEFINITIONS

California Office of the Attorney General

The California Consumer Privacy Act (CCPA) gives consumers more control over the personal information that businesses collect about them, and the CCPA regulations provide guidance to businesses on how to comply.

Highlights consumer control and regulatory guidance for compliance.

Source

California Privacy Protection Agency

The California Consumer Privacy Act (CCPA) provides California consumers with rights relating to the collection, use, and disclosure of their personal information.

Emphasizes consumer rights about collection, use, and disclosure.

Source

RELATED TERMS

Data Subject Rights Consent Management Do Not Sell Personal Data Privacy Policy Opt-out Data Mapping Data Retention

COMPETING TERMS

GDPR California Privacy Rights Act

RELATIONS

• Broader: CCPA

KNOWLEDGE AREAS

Data Privacy & Compliance Data Governance Data Management

TARGET AUDIENCE

Data Privacy Officer Chief Information Security Officer Data Governance Manager IT Auditor Chief Data Officer Data Management Consultant

EXTERNAL SOURCES

• Wikipedia - California Consumer Privacy Act
• California Legislature - Statutory text of CCPA
• California Office of the Attorney General - Consumer rights under CCPA
• California Privacy Protection Agency - Agency responsible for CPRA/CCPA

TOP QUESTIONS

What rights does CCPA grant to consumers?

Access, deletion, and opt-out of sale of personal information, among others, with required disclosures by businesses.

Category: Definition

How did CPRA change CCPA?

CPRA expanded rights, created the California Privacy Protection Agency, and introduced sensitive personal information and additional obligations.

Category: Context

Who must comply with CCPA?

Businesses meeting revenue, data volume, or purpose criteria involving California residents’ personal information.

Category: Requirements

What is a common mistake in CCPA compliance?

Failing to map data flows and vendors, leading to incomplete notices and response processes.

Category: Mistakes

How should organizations manage CCPA requests?

Implement identity verification, standardized workflows, logging, and SLAs for access, delete, and opt-out requests.

Category: HowTo

What risks arise from poor CCPA compliance?

Regulatory fines, reputational damage, and loss of consumer trust.

Category: Risk

How does CCPA compare to GDPR?

Both grant privacy rights; GDPR is broader and extraterritorial, while CCPA focuses on consumer rights and sale opt-outs.

Category: Alternatives

What data governance practices support CCPA?

Data inventory, retention policies, minimization, contractual controls, and regular audits.

Category: BestPractices

Where to start with CCPA compliance?

Assess applicability, perform gap analysis, update privacy notices, and establish request workflows and vendor contracts.

Category: HowTo