What Is CCPA?

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives California residents rights over personal information held by businesses meeting certain thresholds.

It differs structurally from European law: there is no lawful basis requirement and no general prohibition on processing. Businesses may collect and use personal information, and consumers have rights to know, delete, correct and opt out.

Who it applies to

Businesses doing business in California that meet one of several thresholds — annual revenue above a stated figure, handling personal information of a large number of consumers, or deriving a substantial share of revenue from selling or sharing personal information.

There is no physical presence requirement. An organisation anywhere that serves California residents at sufficient scale falls within scope.

Sale and sharing are defined broadly

Sale is not limited to monetary exchange — it covers disclosure for other valuable consideration. Sharing covers disclosure for cross-context behavioural advertising.

That breadth means common advertising and analytics arrangements constitute sale or sharing even where no money changes hands, which surprises organisations that do not consider themselves data sellers. The obligation that follows is a clear opt-out mechanism.

The rights, and the opt-out signal

Know what is collected and why, delete, correct, opt out of sale or sharing, limit use of sensitive personal information, and non-discrimination for exercising any of them.

The amendments also require honouring an opt-out preference signal transmitted by a browser, which means compliance cannot rest entirely on a visible link. That technical requirement is the one most commonly unimplemented.

Service providers and contractors

Disclosure to a vendor is not a sale where a compliant contract is in place restricting their use of the information. Those contract terms are specified and are what distinguishes a service provider relationship from a sale.

Which makes vendor contracts a substantive control rather than paperwork: the same data flow is either exempt or a sale depending entirely on what the agreement says.

The wider American picture

Many other states have enacted comprehensive privacy laws, with broadly similar rights and meaningful differences in thresholds, definitions and requirements.

For most organisations the practical approach is to build to the most demanding applicable requirement and apply it uniformly, rather than attempting to vary treatment by the state a consumer resides in — which is both expensive and error-prone.

Sensitive personal information and its own right

The amendments created a category of sensitive personal information — precise location, government identifiers, financial account details, health and biometric data, contents of private communications — with a right to limit its use to what is necessary to provide the service.

That is narrower than a deletion right and easier to overlook, because it requires a distinct mechanism rather than an extension of the existing opt-out. Identifying which of your data falls in this category is the prerequisite.

Where to start

List every third party receiving personal information from your website and establish, for each, whether a compliant service provider contract exists. That list determines your opt-out obligations.

See GDPR for the contrasting structure. GuardsArm delivers CCPA compliance.