What is CCPA/CPRA?
The California Consumer Privacy Act (CCPA), which took effect in 2020, was significantly expanded by the California Privacy Rights Act (CPRA) in 2023. Together, they create comprehensive privacy rights for California residents and obligations for businesses that collect their personal information.
CCPA (2020)
- • Right to know what data is collected
- • Right to delete personal information
- • Right to opt out of data sales
- • Right to non-discrimination
CPRA Enhancements (2023)
- • Right to correct inaccurate information
- • Right to limit use of sensitive data
- • Expanded definition of "sharing"
- • California Privacy Protection Agency
Significant Penalties
CCPA violations can result in fines up to $7,500 per intentional violation. The CPRA increases penalties to $7,500 per violation for businesses and up to $2,500 per consumer record for unintentional violations involving minors' data.
Who Must Comply with CCPA/CPRA?
CCPA/CPRA applies to for-profit businesses that do business in California and meet at least one of the following thresholds:
Annual Revenue
Gross annual revenues exceeding $25 million in the preceding calendar year
Consumer Records
Buy, sell, or share personal information of 100,000 or more consumers or households annually
Revenue from Data
Derive 50% or more of annual revenues from selling or sharing consumers' personal information
Categories of Personal Information
CCPA defines personal information broadly as any information that identifies, relates to, or could reasonably be linked with a California consumer or household. This includes:
Identifiers
Protected Classifications
Commercial Information
Biometric Information
Internet Activity
Geolocation Data
Sensory Information
Employment Information
Education Information
Inferences
Consumer Rights Under CCPA/CPRA
CCPA/CPRA grants California consumers six fundamental rights regarding their personal information:
Right to Know
Request information about data collection and use
Right to Delete
Request deletion of personal information
Right to Opt-Out
Opt out of sale or sharing of personal information
Right to Non-Discrimination
No discrimination for exercising rights
Right to Correct
Request correction of inaccurate information (CPRA)
Right to Limit Use
Limit use of sensitive personal information (CPRA)
Response Timeline
Businesses must respond to consumer requests within 45 days (with a possible 45-day extension for complex requests). Requests must be fulfilled free of charge, with verification of the consumer's identity.
Privacy Policy Disclosure Requirements
Your privacy policy must include specific CCPA/CPRA disclosures:
Opt-Out Requirements
If you sell or share personal information, you must provide clear opt-out mechanisms:
"Do Not Sell" Link
Prominently display a "Do Not Sell My Personal Information" link on your homepage and wherever personal information is collected.
Global Privacy Control
Under CPRA, you must honor Global Privacy Control (GPC) signals as valid opt-out requests.
Penalties & Enforcement
CCPA/CPRA enforcement includes both regulatory penalties and private rights of action:
Regulatory Enforcement
- • Up to $2,500 per violation (unintentional)
- • Up to $7,500 per violation (intentional)
- • Additional penalties for violations involving minors
- • California Privacy Protection Agency oversight
Private Right of Action
- • $100-$750 per consumer per incident
- • Only for data breaches involving personal information
- • 30-day cure period for first violations
- • Class action lawsuit potential
CCPA/CPRA Compliance Checklist
Determine CCPA/CPRA Applicability
Assess if your business meets the revenue, data, or revenue thresholds
Conduct Data Mapping
Identify all personal information collection, use, and sharing practices
Update Privacy Policy
Include required CCPA disclosures and consumer rights information
Implement Consumer Request Process
Create systems to verify identity and respond to requests within 45 days
Add "Do Not Sell" Links
Provide clear opt-out mechanisms on your website
Review Third-Party Contracts
Ensure service providers and contractors comply with CCPA requirements
Train Your Team
Educate employees on CCPA requirements and consumer request procedures
Establish Ongoing Monitoring
Regular audits and assessments to maintain compliance
Automate Your CCPA/CPRA Compliance
Managing CCPA/CPRA compliance manually is complex and risky. PrivaBase automates consumer request processing, data mapping, privacy policy management, and ongoing monitoring to keep you compliant with California's evolving privacy laws.