🇺🇸California Consumer Privacy Act

← Back to laws in United States

California Consumer Privacy Act: the core California privacy statute

The California Consumer Privacy Act is one of the most important privacy laws in the United States. It gives California consumers rights over their personal information and imposes duties on businesses that collect, use, retain, sell or share that information. The law is not limited to data breaches or online tracking. It reaches ordinary business data practices, including collection notices, retention, access requests, deletion requests, correction requests and opt-out rights.

The CCPA should be read together with the California regulations. The statute creates the main rights and duties; the regulations explain how those duties must be operationalised in notices, request mechanisms, opt-out links, preference signals, contracts and internal compliance processes.

General duties at the point of collection

A business that controls the collection of a consumer’s personal information must inform consumers, at or before the point of collection, about the categories of personal information collected, the purposes for which they are collected or used, whether they are sold or shared, and the retention period or retention criteria. If sensitive personal information is collected, the business must provide corresponding information for that sensitive data.

The CCPA also contains a proportionality idea. Collection, use, retention and sharing must be reasonably necessary and proportionate to achieve the disclosed purposes or another compatible disclosed purpose. This makes the notice more than a disclosure document. It becomes the reference point against which later use of data is judged.

Consumer rights under the CCPA

Consumers have the right to know what personal information is collected and to access personal information. They may request deletion of personal information, correction of inaccurate personal information and information about what personal information is sold or shared and to whom. They may opt out of the sale or sharing of personal information and may limit the use and disclosure of sensitive personal information in specified circumstances.

The right of non-retaliation is important. A business should not punish a consumer for exercising CCPA rights, although the law permits certain price or service differences when they are allowed under the statute and properly disclosed.

Sale, sharing and sensitive personal information

The CCPA uses specific concepts of “sale” and “sharing”. A sale is not limited to payment in money; it can include other valuable consideration. Sharing is especially relevant to cross-context behavioural advertising. Businesses that sell or share personal information need to provide usable mechanisms for consumers to opt out.

Sensitive personal information receives additional treatment. Where the business uses or discloses sensitive personal information beyond permitted purposes, consumers must be given the ability to limit that use and disclosure. This affects areas such as precise geolocation, certain identification information, account credentials, racial or ethnic origin, religious beliefs, union membership, health information and similar categories when they fall within the statutory definition.

Exemptions and boundaries

The CCPA contains important exemptions and carve-outs, including for certain medical information, protected health information, business associate activity, deidentified information, aggregate information and activities governed by other laws. These exemptions should be applied carefully. A business may have some data that is exempt and other data that remains within the CCPA.

For example, a healthcare provider may have protected health information regulated by HIPAA, but it may also process website analytics, marketing leads, job applicant information or other personal information that needs a separate analysis.