CCPA

Also known as: California Consumer Privacy Act

framework · governance and compliance · regulatory-standard

California state law granting consumers rights over personal information collected by businesses.

The California Consumer Privacy Act, enacted in 2018 and effective 1 January 2020, is the foundational US state-level comprehensive privacy law, granting California residents rights to know what personal information is collected about them, to delete it, to opt out of its sale, and to non-discrimination for exercising those rights. The 2020 California Privacy Rights Act (CPRA) ballot initiative substantially amended the CCPA effective 1 January 2023, adding the right to correct, expanded protections for sensitive personal information, contractor and service-provider obligations, and creating the California Privacy Protection Agency (CPPA) as a dedicated enforcement and rulemaking body. The combined CCPA/CPRA regime applies to for-profit businesses meeting revenue or volume thresholds and has catalyzed similar laws in Virginia, Colorado, Connecticut, Utah, and a growing list of other states.

Originators

California Legislature (CCPA, AB 375); California voters (CPRA, Proposition 24) high

Year / Decade

2018 (CCPA enacted); 2020 (effective; CPRA passed); 2023 (CPRA effective) high

Primary sources

California Civil Code §1798.100 et seq., California Consumer Privacy Act of 2018 (AB 375), California Privacy Rights Act of 2020 (Proposition 24) high

Core components

Consumer rights (know, delete, opt-out of sale or sharing, correct under CPRA, limit use of sensitive personal information)
Business thresholds for applicability
Contractor and service-provider contract requirements
Privacy notice requirements
California Privacy Protection Agency (CPPA) under CPRA
Private right of action for security breach (limited)

Primary use case

Consumer privacy compliance for businesses processing California residents' personal information; influential template for subsequent US state privacy laws.

Common criticisms

State-by-state patchwork creates compliance complexity for national businesses
lower statutory penalties than GDPR
sale-of-data definition contested in early enforcement
B2B and employee data exemptions partially expired with CPRA
CPPA rulemaking pace and process challenged in litigation
overlap and conflict with sectoral laws (HIPAA, GLBA) creates carve-out complexity.

Lineage

Child of: FIPPs
Siblings: GDPR, HIPAA, FIPPs
Derived from: FIPPs