Overview
Direct Answer
The California Consumer Privacy Act (CCPA) is a state-level privacy statute enacted in 2018 that grants California residents explicit rights over their personal information held by for-profit businesses. It mandates transparency in data collection, establishes consumer access and deletion rights, and requires opt-out mechanisms for data sales.
How It Works
The law operates through four primary consumer rights: access (right to know what data is collected), deletion (right to request erasure), opt-out (right to prevent sale or sharing of personal information), and non-discrimination (right to equal service despite privacy choices). Organisations must disclose privacy practices in accessible privacy notices and respond to verified consumer requests within 45 days, with limited exemptions for legally required retention.
Why It Matters
Compliance failure exposes organisations to statutory penalties of up to $2,500 per unintentional violation or $7,500 per intentional violation, enforced by California's Attorney General and private litigants. The law has prompted widespread adoption of privacy management infrastructure, data inventory processes, and consent platforms across industries serving California residents, establishing a de facto standard for US privacy regulation.
Common Applications
Technology companies, retail organisations, financial services firms, and healthcare providers have implemented data governance frameworks, automated consent management systems, and customer data platforms to satisfy CCPA requirements. e-commerce platforms and SaaS providers routinely integrate privacy request workflows and data subject access tools into their operations.
Key Considerations
The law applies only to California residents and businesses meeting specific revenue or data-processing thresholds, creating compliance complexity for multi-state operations. Tensions exist between consumer rights and business utility of data, particularly regarding the definition of 'personal information' and exemptions for employee and business-to-business contexts.
More in Governance, Risk & Compliance
Information Governance
GovernanceThe overarching strategy for managing an organisation's information assets, balancing the need for data availability with security, privacy, compliance, and lifecycle management.
Regulatory Technology
Compliance & RegulationTechnology solutions designed to help companies comply with regulations efficiently and cost-effectively.
Compliance
Compliance & RegulationAdherence to laws, regulations, guidelines, and specifications relevant to an organisation's business.
Access Control Policy
Security GovernanceA set of rules defining who can access specific resources and what actions they can perform.
Audit Trail
Security GovernanceA chronological record of system activities enabling the reconstruction and examination of a sequence of events.
Right to be Forgotten
GovernanceA legal concept giving individuals the right to request deletion of their personal data from organisations' records.
AI Risk Management Framework
GovernanceA structured approach to identifying, assessing, and mitigating risks associated with AI systems, as defined by standards such as NIST AI RMF and ISO/IEC 42001.
Regulatory Sandbox
Compliance & RegulationA controlled environment where businesses can test innovative products and services under regulatory oversight.