California Consumer Privacy Act (CCPA) Explained

California led the way among U.S. states with comprehensive consumer privacy legislation — and its requirements now serve as a model many other states have followed with their own versions.

Who Must Comply

The CCPA (as amended by the California Privacy Rights Act) generally applies to for-profit businesses that do business in California and meet certain thresholds — such as annual gross revenue over $25 million, or handling personal data of a significant number of California consumers or households.

Many businesses outside California are still subject to the law if they meet these thresholds and have California customers, regardless of where the business itself is physically located.

Consumer Rights Under the CCPA

California consumers have the right to know what personal information a business collects about them, request deletion of that information, opt out of the sale or sharing of their personal information, and correct inaccurate information.

The law also requires businesses to provide a clear "Do Not Sell or Share My Personal Information" option and to honor consumer requests within specific timeframes.

Compliance Obligations for Businesses

Covered businesses must provide detailed privacy notices at or before the point of data collection, implement reasonable security procedures, and establish a process for verifying and responding to consumer rights requests.

The law also created a dedicated enforcement agency, the California Privacy Protection Agency, giving California a more active regulatory presence than most other states currently have.

Frequently Asked Questions

Does the CCPA apply to employee data?

Certain employee and business-to-business data protections were phased in under later amendments, so the current scope should be confirmed with current counsel rather than assumed.

What happens if my business doesn't comply with a consumer's deletion request?

Non-compliance can result in regulatory enforcement action and, in cases involving data breaches linked to inadequate security, private lawsuits from affected consumers.

The CCPA set the template for a growing wave of state privacy laws. A data privacy attorney can help your business build a compliance program that scales as more states adopt similar requirements.