The CCPA, or California Consumer Privacy Act, is a state law that gives California residents control over the personal information businesses collect about them. It took effect in 2020 and was expanded by the California Privacy Rights Act (CPRA), with the combined rules enforced by the California Privacy Protection Agency and the state Attorney General.
Who has to comply
Unlike GDPR, the CCPA only applies to for-profit businesses that do business in California and meet at least one threshold:
- annual gross revenue above a set figure (originally 25 million US dollars, now adjusted for inflation every two years);
- buying, selling or sharing the personal information of 100,000 or more California consumers or households a year; or
- earning half or more of annual revenue from selling or sharing personal information.
Many small businesses fall under none of these. Check the current revenue figure on the California Privacy Protection Agency's site rather than relying on an old article.
Rights it gives consumers
- Know what personal information is collected and how it is used and shared.
- Delete it, with some exceptions.
- Correct inaccurate information (added by the CPRA).
- Opt out of sale or sharing, including sharing for cross-context behavioural advertising.
- Limit use of sensitive data such as precise location or health details.
- No retaliation for using these rights.
Where it differs from GDPR in practice
GDPR mostly works on opt-in: ask first. The CCPA mostly works on opt-out: you may collect, but must tell people and let them say stop. That is why covered sites show a "Do Not Sell or Share My Personal Information" link and must honour the Global Privacy Control signal some browsers send automatically. Sending visitor data to ad networks through a tracking pixel for retargeting can count as "sharing" under the law.
Example: an online supplement store
A US store above the revenue threshold runs Meta and Google ad pixels. It adds a notice at collection, a "Do Not Sell or Share" link in the footer, configures its consent tool to switch off ad pixels when Global Privacy Control is detected, and sets up a form and a toll-free number or email for access and deletion requests, answered within 45 days.
Mistakes businesses make with the CCPA
- Assuming "we never sell data" means no obligations, while ad pixels share it.
- Ignoring Global Privacy Control signals sent by browsers.
- Adding the opt-out link but not wiring it to actually stop any tags.
- Forgetting other states. Virginia, Colorado, Texas and others now have their own privacy laws with different thresholds.
Related terms
- GDPR: the EU law with an opt-in approach.
- Privacy policy: must list CCPA disclosures and rights.
- Pixel tracking: the usual way sites "share" data.
- Cookie: stores the identifiers the law covers.