Overview of the California Consumer Privacy Act (CCPA) and Its Amendments
The California Consumer Privacy Act (CCPA) is a landmark state statute designed to enhance privacy rights and consumer protection for California residents. Enacted on June 28, 2018, and effective January 1, 2020, the CCPA was introduced by Assemblymember Ed Chau and State Senator Robert Hertzberg as Assembly Bill 375 (AB-375). It was later amended by Senate Bill 1121 in September 2018 and further refined through additional legislative changes signed into law on October 11, 2019. The CCPA’s scope was significantly expanded by the California Privacy Rights Act (CPRA), approved by voters in November 2020 as Proposition 24. The CPRA amendments created the California Privacy Protection Agency (CPPA), establishing a dedicated regulatory body to enforce privacy laws and oversee compliance.
The CCPA applies to for-profit entities that collect consumers’ personal data, conduct business in California, and meet at least one of three thresholds: annual gross revenues exceeding $25 million, buying or selling the personal information of 100,000 or more consumers or households, or deriving over half of annual revenue from selling consumers’ personal information. Unlike some privacy laws, such as the GDPR, the CCPA does not require physical presence in California. Businesses operating online or engaging in transactions within the state—regardless of their geographic location—are subject to its provisions. This broad territorial application distinguishes it from other privacy frameworks, though it remains less precise in defining its geographic reach compared to the GDPR.
The CCPA’s core objective is to grant California residents specific rights over their personal data, including the right to know what data is collected, the right to opt out of the sale or disclosure of their data, the right to access and delete their personal information, and the right to not face discrimination for exercising these rights. These provisions reflect a consumer-centric approach to data privacy, prioritizing transparency, control, and accountability for businesses handling personal information.
Key Provisions and Consumer Rights Under the CCPA
Consumers have the right to know what personal data is being collected about them, including the categories of data, the sources from which it is collected, and the purposes for which it will be used. This right extends to knowing whether their data is sold or shared with third parties and to whom.
One of the CCPA’s most notable features is the opt-out mechanism for the sale of personal data. Businesses must provide a clear and conspicuous ‘Do Not Sell My Personal Information’ link on their websites, directing users to a page where they can submit an opt-out request. The CCPA also mandates that businesses refrain from requesting opt-in consent from a consumer for 12 months following an opt-out request, ensuring that once a consumer exercises their right, it is respected for a meaningful period.
Businesses must obtain parental or guardian consent for children under 13 and the affirmative consent of minors aged 13 to 16 before sharing their data for purposes such as targeted advertising or profiling. The law also requires businesses to implement reasonable security procedures to protect consumer data, though it does not prescribe specific technical or organizational measures, leaving room for industry standards and best practices to evolve.
Automated Decision-Making and the Role of the CPPA in AI Accountability
The California Privacy Rights Act (CPRA) amendments to the CCPA introduced regulations governing automated decision-making processes and risk assessments, effectively establishing California’s framework for AI accountability. These regulations require businesses to disclose the use of automated decision-making technologies, including profiling, and to provide consumers with meaningful information about how these systems operate, the logic involved, and the significance of the processing in relation to the consumer.
The CPPA, created by the CPRA, plays a central role in enforcing these regulations. As California’s first data privacy agency, the CPPA is tasked with overseeing compliance, investigating violations, and imposing penalties. Its authority extends to automated decision-making systems, where it can require businesses to conduct risk assessments to identify and mitigate biases, inaccuracies, or discriminatory outcomes. The CPPA’s oversight ensures that AI systems deployed by covered businesses adhere to fairness, transparency, and accountability standards.
The CPPA’s enforcement powers, including fines up to $7,500 per intentional violation and $2,500 per unintentional violation, incentivize compliance and deter non-compliance with these critical AI governance provisions.
Compliance Obligations and Enforcement Mechanisms
Businesses subject to the CCPA must adhere to a range of compliance obligations to ensure they meet the law’s requirements. These include maintaining reasonable security procedures to protect consumer data, updating privacy policies to reflect the new rights granted under the CCPA, and providing accessible mechanisms for consumers to exercise their rights. For example, businesses must designate methods for submitting data access requests, including a toll-free telephone number, and ensure that privacy notices are available in alternative formats for accessibility. Failure to comply with these obligations can result in significant penalties, including statutory damages of $100 to $750 per consumer per incident in the event of a data breach, as well as fines for intentional or unintentional violations.
This provision differs from other U.S. privacy laws, such as the Virginia Consumer Data Protection Act, which are primarily enforced by state attorneys general. Additionally, the CCPA authorizes authorized agents—such as companies, activists, or associations—to exercise opt-out rights on behalf of California residents, further expanding the scope of enforcement and accountability.
The CPPA, established by the CPRA, further strengthens enforcement by providing a dedicated agency with the resources and expertise to investigate complex privacy issues, including those related to automated decision-making and AI systems. The combination of statutory damages, fines, and regulatory oversight creates a robust compliance framework that holds businesses accountable for their data practices.
Exemptions and Scope Limitations
The CCPA includes several exemptions that limit its applicability to specific types of data and entities. Personal health information (PHI) governed by the Health Insurance Portability and Accountability Act (HIPAA) is exempt from CCPA requirements, as is financial information regulated under the California Financial Information Privacy Act or the federal Gramm-Leach-Bliley Act. However, businesses operating in these sectors must still comply with their respective regulatory frameworks, such as HIPAA for healthcare or the Common Rule for clinical trials.
Another key exemption applies to publicly available information, which the CCPA defines as data that is lawfully made available to the general public from federal, state, or local government records. This exemption aligns with the GDPR’s exception for data manifestly made public by the data subject, though the CCPA’s scope remains narrower in certain respects. For instance, the CCPA does not cover personal data collected from sources other than the consumer, whereas the GDPR applies broadly to all personal data regardless of origin. This distinction underscores the CCPA’s consumer-centric focus, prioritizing data derived directly from individuals over third-party-collected information.
Required actions
- Honour rights to know, delete, correct, opt out of sale and sharing, and limit use of sensitive personal information - Provide access to information about profiling and automated decisions under the CPPA regulations - Perform risk assessments and cybersecurity audits as phased in by the CPPA