The California Consumer Privacy Act sets strict requirements for how businesses collect and handle consumer data.
## Who Does CCPA Apply To?
The CCPA applies if you:
- Do business in California
- Collect personal information from California residents
- Meet any of these thresholds:
- Annual gross revenues > $25 million
- Buy/share data of 100,000+ Californians/households
- Derive 50%+ revenue from selling/sharing consumer data
## Consumer Rights Under CCPA
### Right to Know
Consumers can request:
- What personal information is collected
- The purpose of collection
- With whom data is shared
- You must respond within 45 days
### Right to Delete
Consumers can request deletion of:
- Personal information collected
- Data held by service providers
- Exceptions include legal obligations
- You must verify the request
### Right to Opt-Out
Consumers can opt-out of:
- Sale of personal information
- Sharing for cross-context behavioral advertising
- Profiling for automated decisions
- You must provide prominent opt-out links
### Right to Non-Discrimination
Businesses cannot:
- Deny goods/services
- Charge higher prices
- Provide lower quality service
- For exercising CCPA rights
## Implementation Steps
1. Audit data practices
2. Create privacy policy
3. Implement opt-out mechanisms
4. Set up request procedures
5. Train staff
6. Update contracts
7. Regular compliance reviews
## Key Requirements
**Privacy Policy Must Include:**
- Categories of personal information collected
- Purpose of collection
- Categories of sources
- Retention periods
- Consumer rights
- Contact information
**Response Procedures:**
- Establish verification process
- Respond within 45 days
- Provide clear responses
- Document all requests
- Maintain security
## Penalties
- Up to $2,500 per violation
- Up to $7,500 per intentional violation
- Private right of action for data breaches
- Start compliance now to avoid penalties
The CCPA is just the beginning. More state laws are coming.