CCPA / CPRA

What are the CCPA and CPRA?

The CCPA was the first comprehensive US state privacy law. The CPRA, approved by voters in 2020, expanded it substantially. It added rights over sensitive personal information and correction, and created the California Privacy Protection Agency (CPPA), the first dedicated privacy regulator in the US.

Who does it apply to?

For-profit businesses that do business in California, collect consumers’ personal information and meet at least one threshold:

• annual gross revenue above a set amount (originally $25 million, adjusted for inflation); or
• buying, selling or sharing the personal information of 100,000 or more consumers or households; or
• deriving 50% or more of annual revenue from selling or sharing personal information.

“Consumers” means California residents, including employees and business contacts.

Key duties

• Notice at collection and a comprehensive privacy policy.
• Consumer rights: know and access, delete, correct, opt out of sale or sharing (including for cross-context behavioural advertising), limit the use of sensitive personal information, and freedom from retaliation.
• Honour opt-out preference signals, such as Global Privacy Control.
• Contracts with service providers, contractors and third parties that contain the required terms.
• Reasonable security. Some data breaches give consumers a private right of action.
• CPPA regulations: rules on automated decision-making technology, risk assessments and cybersecurity audits, phased in for businesses that meet their criteria.

How does it relate to other frameworks?

Several other US states have passed comprehensive privacy laws with similar but not identical rules. A GDPR-style programme covers much of the ground, but the opt-out model, thresholds and definitions differ.