California Consumer Privacy Act (CCPA)
California’s landmark privacy law giving consumers the right to know, delete, and opt out of the sale of their personal information.
The California Consumer Privacy Act (CCPA), effective January 1, 2020, was the first comprehensive state-level privacy law in the United States. It applies to for-profit businesses that collect California consumers’ personal information and meet certain thresholds: annual gross revenue over $25 million, buying/selling personal information of 100,000 or more consumers or households, or deriving 50% or more of annual revenue from selling consumers’ personal information.
The CCPA grants California consumers several rights: the right to know what personal information is collected, the right to delete their data, the right to opt out of the sale of personal information, and the right to non-discrimination for exercising these rights. Unlike the GDPR, the CCPA uses an opt-out model — businesses can collect and use personal information by default but must provide a clear "Do Not Sell My Personal Information" link. The law was significantly amended by the CPRA, which took effect in 2023 and added additional protections including data minimization requirements and the right to correct inaccurate data.