California privacy law: What is CCPA and does it apply to my business?

2 min read

What you'll learn:

Consumer rights under the CCPA
Does CCPA apply to my business?
CCPA deadlines and enforcement
What if my business does not meet the criteria?

California has always been a leader in protecting the inalienable rights of its residents, so much so that it amended the state constitution to include the right of privacy. Following a series of other state laws—including the Online Privacy Protection Act, the Privacy Rights for California Minors in the Digital World Act, and the Shine the Light Act—the California Consumer Privacy Act (CCPA) is the newest law on the books that ensures a Californian's right of privacy.

What is the California Consumer Privacy Act?

The California Consumer Privacy Act was signed in 2018 by California Governor Jerry Brown. Similar to the General Data Protection Regulation (GDPR) in the European Union, the CCPA is a California-specific data privacy law that protects the use and sale of consumers' personal data. The CCPA broadly defines personal data as any identifying information that can reasonably be associated with a California consumer or household.

Leave Taxes to a Pro

Simplify your taxes

Consumer rights under the CCPA

The CCPA gives Californians the following rights:

To know what of their specific personal information has been collected
To access their personal information
To know whether their personal information is being sold or disclosed and to whom
To deny the sale of their personal information
To receive equal service and price, even if they choose to exercise their privacy rights

Does CCPA apply to my business?

At least one of the following must be true of the business in order for a consumer to exercise their rights:

The company's annual gross revenue is over $25 million
The company derives at least 50% of its annual revenue from selling consumers' data
The company buys, sells, or shares data of more than 50,000 CA residents, consumers, or devices.

It is important to note that the business' location does not matter. If your business meets the above criteria, it is important for you to start taking steps towards CCPA compliance.

CCPA deadlines and enforcement

The CCPA goes into effect on January 1, 2020, but the enforcement date is July 1st, giving the impacted companies a grace period of six months to ensure that they meet the standards set by the new law. If companies fail to comply, Californians have the right to file private lawsuits, in addition to the added consequence of the California Attorney General seeking civil penalties per violation.

What if my business does not meet the criteria?

While a majority of small businesses will not meet the above requirements, it is important to understand that privacy is of utmost importance to your customers. Doing what you can to protect customer data allows you to build trust and can help you feel more prepared if the law expands or changes. California may be the first state to enact specific privacy regulations regarding user data, but it certainly won't be the last.

If you still have questions about CCPA compliance, ask a lawyer.

This article contains general legal information and does not contain legal advice. Rocket Lawyer is not a law firm or a substitute for an attorney or law firm. The law is complex and changes often. For legal advice, please ask a lawyer.