What is CCPA (California Consumer Privacy Act)?

The CCPA was the first comprehensive consumer privacy statute in the United States, and it remains the template most other state laws adapted. It applies to for-profit businesses that collect Californians' personal information, do business in California, and meet at least one threshold: more than $25 million in annual gross revenue; buying, selling, or sharing the personal information of 100,000 or more consumers or households (a figure set by the CPRA amendments); or deriving 50% or more of annual revenue from selling or sharing personal information.

Its core rights: to know what personal information a business collects, uses, and discloses; to delete personal information (with exceptions); to opt out of the sale — and, post-CPRA, the sharing — of personal information; and to non-discrimination for exercising rights. Businesses must respond to verified requests within 45 days, extendable once by a further 45. 'Personal information' is defined broadly, reaching identifiers, commercial history, internet activity, geolocation, and inferences drawn to build a profile.

The law is enforced by the California Attorney General and, since the CPRA, the California Privacy Protection Agency, with civil penalties up to $2,500 per violation and $7,500 for intentional violations or violations involving minors' data. There is no general private right of action — but there is a targeted one for data breaches: consumers can seek statutory damages of $100 to $750 per consumer per incident when unencrypted personal information is breached due to unreasonable security.

The Sephora settlement (2022) defined the enforcement pattern for eCommerce: third-party advertising and analytics trackers on a site can constitute a 'sale,' and ignoring Global Privacy Control signals is an independent violation.