persona-logo
Back to identity glossary

California Consumer Privacy Act (CCPA)

The California Consumer Privacy Act (CCPA) is the California equivalent of GDPR and went into effect on January 1, 2020. It specifies that consumers have a right to request what information is being collected, for what purpose, and with whom it's being shared. Consumers can also request to opt out of their data being shared or for their data to be deleted (which businesses must comply with unless that data impairs their ability to provide core services). Individuals also have the right to equal service and price, even if they exercise their privacy rights. Under CCPA, businesses are not allowed to sell the PII of anyone under 16 years of age, unless these individuals have specifically opted in.

A more comprehensive version of CCPA, the Consumer Privacy Rights Act (CPRA), went into effect on January 1, 2023 and gives consumers control over whether companies can share their personal information as well as whether they can sell it.

Frequently asked questions

The California Consumer Privacy Act (CCPA) applies to any for-profit business that operates in California and meets any of three criteria:

  1. Has a gross annual revenue of over $25 million

  2. Receives, buys, or sells the personal data of 50,000+ California residents

  3. Acquires 50% or more of its total annual revenue from the sale of residents’ personal information

Businesses that do not meet any of the criteria listed above, along with nonprofit and government agencies, are not subject to California Consumer Privacy Act (CCPA) regulations.

Under the California Consumer Privacy Act (CCPA), residents have multiple rights, including:

  • The right to ask businesses to disclose what personal information has been collected about them and what the business will do with that information

  • The right to ask businesses to delete or not sell their personal information

  • The right to be notified — before or at the point of data collection — of how this data may be used

It’s also worth noting that it’s not possible to waive these rights, and any contract stipulation to this effect is null and void.

According to the Government of California, companies are “doing business” in the state if any of the following conditions are met:

  1. They engage in any transaction for the purpose of financial gain within the state

  2. They’re organized or commercially located in California.

  3. Sales within California exceed set amounts.