California Consumer Privacy Act (CCPA)

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA) of 2020, is California's comprehensive consumer privacy law, codified at California Civil Code §1798.100 et seq. It grants California residents rights to know what personal information businesses collect about them, request deletion, correct inaccuracies, opt out of the sale or sharing of their data, and limit use of sensitive personal information, with enforcement handled by both the California Privacy Protection Agency (CPPA, created by CPRA to write implementing regulations and investigate violations) and the California Attorney General. It applies to for-profit businesses doing business in California that meet a revenue or data-volume threshold — currently $25 million in annual gross revenue, handling personal information of 100,000+ California consumers or households, or deriving 50%+ of annual revenue from selling or sharing personal information.