California Consumer Privacy Act (Wikipedia)

Wikipedia’s article on the CCPA (2018, effective 2020) and its 2020 ballot-measure amendment, the CPRA.

License: CC BY-SA 4.0 — https://creativecommons.org/licenses/by-sa/4.0/

Key points

• Applies to for-profit businesses meeting at least one threshold: over $25 million in annual revenue, buying/selling 100,000+ consumers’/households’ personal information, or earning over half of revenue from selling personal information.
• Grants California residents rights to know, access, delete, opt out of sale (and, per the CPRA, “sharing”), correct (CPRA), and limit use of sensitive personal information (CPRA), with a non-discrimination guarantee for exercising any of them.
• Requires a homepage link (historically “Do Not Sell My Personal Information”) letting visitors opt out without creating an account; the CPRA’s opt-out preference signal requirement (e.g., Global Privacy Control) and consolidated “Your Privacy Choices” link/icon are widely-adopted current practice, though this Wikipedia article’s own detail on them was thin — corroborated separately via general regulatory-compliance sources.
• Verified consumer requests generally require a response within 45 days, extendable once by another 45 days with notice.
• Penalties run $2,500 per unintentional violation and $7,500 per intentional one; a private right of action allows $100–$750 per consumer per data-breach incident.

Cited In

Standards

• CCPA / CPRA (California Consumer Privacy Act / California Privacy Rights Act)