California Consumer Privacy Act (CCPA)

Enacted in 2018 and effective January 1, 2020, the CCPA applies to for-profit businesses meeting at least one of three thresholds: annual gross revenue exceeding $25 million; buying or selling personal information of 100,000 or more consumers or households per year; or deriving more than 50% of annual revenue from selling consumers' personal information.

The CCPA grants California residents four core rights:

• The right to know what personal information is collected and how it's used.
• The right to delete personal information held by a business.
• The right to opt out of the sale of personal information.
• The right to non-discrimination for exercising these rights.

The CCPA was significantly expanded by the California Privacy Rights Act (CPRA) in 2023, which added new rights, created the California Privacy Protection Agency as a dedicated enforcement body, and introduced additional obligations around sensitive personal information and data minimization.