🛡️CCPA

NEW

Also known as: California Consumer Privacy Act

California privacy law granting rights to know, delete, and opt out of sale of personal information collected by businesses.

DESCRIPTION

The CCPA establishes consumer rights to know what personal information is collected, delete certain data, and opt out of its sale. It applies to for-profit entities meeting thresholds and requires notices, data inventories, and response to requests. Enforcement began with the Attorney General; the CPRA amended the law and created the California Privacy Protection Agency. Organizations must update policies, consent mechanisms, contracts, and data governance processes to comply.

ALTERNATIVE DEFINITIONS

California Office of the Attorney General

The CCPA gives California consumers more control over the personal information that businesses collect about them.

Stresses consumer control over personal information.

Source

California Privacy Protection Agency

The CCPA provides California residents with rights regarding their personal information, including the right to know, delete, and opt-out of the sale of personal information.

Explicitly lists core consumer rights under the law.

Source

IAPP

The California Consumer Privacy Act of 2018 (CCPA) is a comprehensive privacy law granting California residents new rights related to personal information and imposing obligations on covered businesses.

Frames CCPA as comprehensive law with resident rights and business obligations.

Source

RELATED TERMS

Data Subject Rights Opt-out Do Not Sell Personal Information Privacy Notice Data Processing Data Protection Impact Assessment Enforcement

COMPETING TERMS

GDPR California Privacy Rights Act

RELATIONS

• Narrower: California Consumer Privacy Act (CCPA)

KNOWLEDGE AREAS

Data Privacy & Compliance Data Governance AI Governance Data Management

TARGET AUDIENCE

Data Privacy Officer Chief Information Security Officer Data Governance Manager IT Auditor Chief Data Officer AI Product Manager

EXTERNAL SOURCES

• Wikipedia - California Consumer Privacy Act
• California Office of the Attorney General - Official CCPA overview and guidance
• California Legislature - Statutory text of CCPA
• California Privacy Protection Agency - Agency resources and enforcement

TOP QUESTIONS

What businesses are covered by CCPA?

For-profit entities meeting thresholds (revenue, data volumes) or sharing common branding and controlling purposes typically fall under CCPA’s scope.

Category: Scope

What rights does CCPA grant?

Rights include access (know), deletion (subject to exceptions), and opt-out of sale or sharing of personal information.

Category: Rights

How did CPRA change CCPA?

CPRA expanded rights, created sensitive personal information category, and established the California Privacy Protection Agency for enforcement.

Category: Update

What are common CCPA compliance mistakes?

Missing data maps, unclear notices, weak identity verification, and not honoring opt-out signals (e.g., GPC) are frequent errors.

Category: Mistakes

What is a CCPA opt-out mechanism?

A clear, accessible “Do Not Sell or Share My Personal Information” link and systems to enforce preferences and signals.

Category: Requirements

How does CCPA compare to GDPR?

Both grant individual rights; GDPR is broader with legal bases and stricter consent, while CCPA focuses on sale/sharing and consumer control.

Category: Alternatives

How should organizations manage CCPA requests?

Implement request intake, identity verification, fulfillment workflows, and audit trails within statutory timeframes.

Category: Operations

Does CCPA apply to employee data?

CPRA removed most exemptions, making employee and B2B data subject to many CCPA provisions.

Category: Clarification

How does CCPA impact data governance?

It requires accurate inventories, purpose limitation, retention policies, and contracts with service providers to manage privacy obligations.

Category: Governance