California Consumer Privacy Act (CCPA)

What are the user rights under the CCPA?

(1) Access (2) Deletion (3) Portability (4) Opt-out of "Sale"

What are a business' transparency/notice obligations under the CCPA?

(1) Initial notice (2) Website notice (Privacy Policy) (3) Right to opt-out notice ("Do Not Sell") (4) Notice of financial incentives, if applicable

What are the main rights protected under the CCPA?

(1) Transparency requirements/privacy notices (2) Disclosure of the "sale" of personal information (3) Discrimination prohibited (4) User Rights

What is a business under the CCPA?

A business is defined as a company that: (1) operates for profit, (2) determines the purposes and means of processing consumer's personal information (e.g. controller under GDPR) (3) does business in CA (4) Either gross revenue of more than $25M or personal information of 50k+ consumers or 50% or more annual revenue comes from sales of consumer's PII

What is sale under the CCPA?

A sale is defined as selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to another business or a third party for monetary or other valuable consideration.

What does the CPRA change from the CCPA?

Adds user rights to correct, right to limit use, and disclosure of sensitive personal information

Are there any exceptions under the CCPA?

If you are a service provider the CCPA does not apply. A service provider is a company that, pursuant to a written contract, provided that the contract prohibits the entity receiving the information from retaining, using, or disclosing the personal information for any purpose other than for the specific purpose of performing the services specified in the contract. (e.g. Processor from GDPR)

What is personal information under the CCPA?

Personal information is information that identifies, relates to, describes, is capable of being associate with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. IP address is explicitly stated under the CCPA as personal information.

What is the CCPA?

The California Consumer Privacy Act of 2018 (CCPA) gives consumers more control over the personal information that businesses collect about them and the CCPA regulations provide guidance on how to implement the law.

What is the CPRA?

The California Privacy Rights Act of 2020 (CPRA) was approved in 2020 and goes into effect mostly in 2023. This act amends the CCPA to expand privacy rights and regulations.