Glossary | C | California Consumer Privacy Act (CCPA)

What is the CCPA?

The California Consumer Privacy Act, or CCPA, gives consumers in California additional rights and protections around how companies can use their private information.  

The CCPA, which took effect on Jan. 1, 2020, was designed to enhance consumer privacy rights, and give people more control over their data.  

Key provisions of the CCPA include:  

  • The right to know: People have the right to request information about their personal data that companies collect, disclose and/or sell to other companies.  
  • The right to opt-out: People have the right to opt out of the sale of their personal data to third parties.  
  • The right to delete: People have the right to request that companies delete their personal data, subject to certain exceptions.  
  • The right to non-discrimination: Companies are prohibited from discriminating against people who exercise their privacy rights, such as denying them goods, services, or equal pricing.  
  • Notice and disclosure requirements: Companies must provide clear and transparent notices to their customers, explaining the company’s data collection and processing practices.  
  • Enhanced protections for minors: Additional protections for people under the age of 16, including the requirement that companies provide explicit opt-in consent for the sale of personal data about people aged 13 to 16.  
  • Expanded definition of personal information: CCPA broadly defines personal information to include traditional identifiers, as well as online identifiers, browsing history, geolocation data, and other information that can be linked to an individual.  

CCPA creates new regulatory requirements for companies, similar to those required by Europe’s General Data Protection Regulation, or GDPR. The CCPA applies to companies that meet certain thresholds, such as those with annual gross revenue above a specific amount, or those that handle large amounts of consumer data. It has extraterritorial scope, which means it can impact companies located outside California if they meet certain criteria.