California has always been a leader in protecting the inalienable rights of its residents, so much so that it amended the state constitution to include the right of privacy. Following a series of other state laws—including the Online Privacy Protection Act, the Privacy Rights for California Minors in the Digital World Act, and the Shine the Light Act—the California Consumer Privacy Act (CCPA) is the newest law on the books that ensures a Californian’s right of privacy.
What is the California Consumer Privacy Act?
The California Consumer Privacy Act was signed in 2018 by California Governor Jerry Brown. Similar to the General Data Protection Regulation (GDPR) in the European Union, the CCPA is a California-specific data privacy law that protects the use and sale of consumers’ personal data. The CCPA broadly defines personal data as any identifying information that can reasonably be associated with a California consumer or household.
We’re here to help
If you have questions how CCPA impacts your business,
ask a lawyer and get an answer within 1 business day.
Consumer rights under the CCPA
The CCPA gives Californians the following rights:
- To know what of their specific personal information has been collected
- To access their personal information
- To know whether their personal information is being sold or disclosed and to whom
- To deny the sale of their personal information
- To receive equal service and price, even if they choose to exercise their privacy rights
Does CCPA apply to my business?
At least one of the following must be true of the business in order for a consumer to exercise their rights:
- The company’s annual gross revenue is over $25 million
- The company derives at least 50% of its annual revenue from selling consumers’ data
- The company buys, sells, or shares data of more than 50,000 CA residents, consumers, or devices.
It is important to note that the business’ location does not matter. If your business meets the above criteria, it is important for you to start taking steps towards CCPA compliance.
CCPA deadlines and enforcement
The CCPA goes into effect on January 1, 2020, but the enforcement date is July 1st, giving the impacted companies a grace period of six months to ensure that they meet the standards set by the new law. If companies fail to comply, Californians have the right to file private lawsuits, in addition to the added consequence of the California Attorney General seeking civil penalties per violation.
What if my business does not meet the criteria?
While a majority of small businesses will not meet the above requirements, it is important to understand that privacy is of utmost importance to your customers. Doing what you can to protect customer data allows you to build trust and can help you feel more prepared if the law expands or changes. California may be the first state to enact specific privacy regulations regarding user data, but it certainly won’t be the last.
If you still have questions about CCPA compliance, ask a lawyer.