CCPA/CPRA

California's consumer privacy law and its 2023 expansion, giving state residents rights over their personal data.

People in California can ask a business what data it has about them, ask it to delete that data, and tell it to stop selling or sharing it.

The California Consumer Privacy Act and its amendment, the California Privacy Rights Act, granting state residents the right to access, delete, and opt out of the sale of their personal data, with biometric data treated as sensitive personal information requiring extra protection.

The California Consumer Privacy Act (CCPA) took effect in 2020, and the California Privacy Rights Act (CPRA) amendments took effect in 2023 and created the California Privacy Protection Agency to enforce the law. Residents have several rights:

• Right to know, which lets people learn what personal information a business collects and how it uses it.
• Right to delete, which lets people ask a business to delete their data.
• Right to correct, which lets people fix inaccurate information.
• Right to opt out, which lets people stop the sale or sharing of their data.
• Right to limit sensitive data use, which lets people restrict how sensitive information, such as biometric data, is used.

The law applies to a business that does business in California and meets any one of three thresholds:

1. Annual gross revenue above about $26.6 million, a figure adjusted for inflation.
2. Buying, selling, or sharing the personal information of 100,000 or more consumers or households a year.
3. Earning 50 percent or more of annual revenue from selling or sharing personal information.

CCPA/CPRA sits next to terms that are easy to mix up:

• GDPR is the EU law with similar goals and different rules.
• PII (Personally Identifiable Information) is the common term for information that identifies a person, while California uses personal information.
• Right to erasure is the GDPR's deletion right, which resembles California's right to delete.