The California Consumer Privacy Act of 2018 (CCPA) is a state law that imposes a number of obligations on companies that collect personal information. It gives consumers more knowledge of and control over the personal information that businesses collect about them.
It’s applicable if you’re doing business in California and meet one of three criteria:
1. You have annual revenues in excess of $25 million,
2. you derive 50% of your revenue from the sale of personal information or
3. you collect or share the data of 50,000 or more people.
The CCPA creates rights for consumers and places obligations on businesses to change how they handle personal information from their users. So it’s pretty important for everyone - not just lawyers - to know how the law works.
Consumers’ rights include:
- The right to access what personal data a business uses (or sells);
- A right to delete personal data;
- A right to prohibit the sale of personal data - called “opting out”
- The right for kids under 16 to not have any personal information sold by a business without their actual consent - called “opting in”
There are more - but those are the basics.
A Business’ obligations include:
- Notifying consumers about personal data being collected;
- Making it easy for consumers to protect their privacy;
- Honoring consumer rights requests
- Disclosing privacy policies and how personal data is used and sold
(Lots more here too - these are just the basics).
The CCPA is complicated - but these rights and obligations are the heart of the law. - It gives consumers the right to control personal information - with lots of obligations for companies.