What is CCPA?

The California Consumer Privacy Act of 2018 (CCPA) represents a pivotal shift in data privacy regulation, particularly for U.S.-based businesses and global entities handling California residents’ information. Results from recent analyses indicate several key outcomes:

• Scope and Applicability: The CCPA applies to any for-profit entity conducting business in California that meets at least one of these criteria: annual gross revenues above $25 million; collects, buys, receives, or sells the personal information of 50,000 or more consumers, households, or devices; derives 50% or more of its annual revenues from selling consumers’ personal information (CCPA Text, Cal. Civ. Code §§ 1798.100–1798.199).

• Consumer Rights Provisions: Empirical studies demonstrate increased consumer awareness and exercise of the following rights:

  • Right to Know: Consumers can request disclosure of categories and specific pieces of personal information collected.
  • Right to Delete: Consumers may request the deletion of personal information collected.
  • Right to Opt-Out: Consumers can direct a business to not sell their personal information.
  • Non-Discrimination: Businesses are prohibited from discriminating against consumers who exercise their rights.

• Impact on Businesses: A study by Schwartz and Peifer (2019) found that “compliance costs for covered businesses have significantly increased,” with notable investments in data mapping, consumer request mechanisms, and employee training.

  • Implementation challenges include technical limitations in identifying household vs. individual device data.
  • The definition of personal information is broad, encompassing identifiers such as IP address, browsing history, and inferences drawn from data.

• Data Sale and Disclosure: Researchers observed that companies have revised privacy policies to clarify practices regarding the sale or disclosure of personal information. Opt-out mechanisms, such as “Do Not Sell My Personal Information” links, are now standard features on most major websites targeting California residents.

• Enforcement and Penalties: Enforcement by the California Attorney General began July 1, 2020. Penalties include civil fines up to $2,500 per violation or $7,500 per intentional violation. While early enforcement was initially focused on non-compliance notifications, legal actions have since highlighted the need for rigorous compliance frameworks.

In summary, the CCPA has established a new legal standard for consumer privacy in the United States, influencing data governance strategies and consumer rights awareness across industries. The results highlight both increased transparency and significant compliance burdens for affected entities.