CCPA Full Form: Consumer Rights, Scope, and CPRA Changes

CCPA is the full form of the California Consumer Privacy Act, a state data privacy law that gives California residents specific rights over the personal information businesses collect about them. It was signed in June 2018, took effect on January 1, 2020, and was significantly expanded by the California Privacy Rights Act (CPRA) passed by voters in November 2020, with most of those changes active since January 1, 2023. Because the CPRA amended the original statute rather than replacing it, the combined law is still commonly called the CCPA.

What the Law Lets You Do

The CCPA gives you a set of rights you can exercise directly against covered businesses, generally up to twice a year at no cost, with a 45-day response window after a verifiable request.¹

Know What a Business Has Collected

You can ask any covered business to disclose the categories and specific pieces of personal information it has collected about you, where it came from, why the business uses it, and which third parties have received it. The disclosure covers the preceding 12 months.¹

Delete It

You can request deletion of the personal information a business collected from you, and the business must pass that instruction along to its service providers and contractors. Exceptions exist for data a business is legally required to keep, such as records needed to complete a transaction.¹

Correct Inaccurate Information

Added by the CPRA, this right lets you ask a business to fix inaccurate personal information it holds about you. The business must use commercially reasonable efforts to make the correction.²

Opt Out of Sale or Sharing

You can direct a business to stop selling or sharing your personal information with third parties. The CPRA extended this beyond outright sales to cover “sharing” for cross-context behavioral advertising, meaning ads targeted to you based on your activity across different websites.³ Businesses that sell or share data have to display a “Do Not Sell or Share My Personal Information” link, and they must also honor the Global Privacy Control, a browser-level signal that automatically communicates your opt-out preference to every site you visit.⁴

Limit the Use of Sensitive Personal Information

You can tell a business to use your sensitive personal information only for purposes an average consumer would expect when requesting the goods or services. If a business uses that category of data for anything beyond those expected purposes, it has to post a “Limit the Use of My Sensitive Personal Information” link and honor the request.⁵

Not Face Retaliation for Exercising Your Rights

A business cannot deny you service, charge a higher price, or give you lower-quality service because you made a privacy request.¹

Stronger Default Protection for Minors

For anyone under 16, the default flips. A business cannot sell or share a minor’s personal information unless it first gets affirmative consent: directly from a consumer aged 13 to 15, or from a parent or guardian for a child under 13. A business that willfully disregards a consumer’s age is treated as if it knew.³

What Counts as Personal Information

The CCPA defines personal information broadly as anything that identifies, relates to, or could reasonably be linked to a specific person or household. Names, Social Security numbers, email addresses, and phone numbers are covered, but so are browsing history, purchase records, geolocation data, biometric identifiers such as fingerprints and facial scans, and the inferences a business draws to build a consumer profile.¹ Truly anonymous or aggregated data that cannot be re-linked to an individual falls outside the law.

The CPRA added a heightened category called sensitive personal information. It includes government identifiers like Social Security and driver’s license numbers, financial account details combined with login credentials, precise geolocation, the contents of private communications such as email and text messages, genetic and biometric data, information about health or sexual orientation, and data revealing racial or ethnic origin, religious beliefs, or union membership.¹

When You Can Sue

Consumers have one direct right to sue under the CCPA, and it is narrow. If your unencrypted and unredacted personal information is exposed in a data breach because a business failed to maintain reasonable security practices, you can file a civil lawsuit for statutory damages of $100 to $750 per person per incident, or your actual losses if those are greater.⁶

Before suing for statutory damages, you have to send the business written notice of which provisions were violated and give it 30 days to cure the problem. If the business fixes the issue in that window and provides a written statement that no further violations will happen, the statutory damages claim cannot go forward. Simply improving security after a breach does not count as curing that breach, and if you are suing only for actual financial losses, no advance notice is required.⁶

This is the only path for consumers to sue directly under the law. For any other violation, such as a business ignoring your deletion request, enforcement rests with the California Privacy Protection Agency and the California Attorney General, and your option is to file a complaint rather than a lawsuit.

Which Businesses Have to Comply

The CCPA applies to for-profit businesses that collect personal information from California residents and meet at least one of three thresholds. The first is annual gross revenue above $25 million, a figure the California Privacy Protection Agency adjusts for inflation in odd-numbered years; for 2025 it is set at $26,625,000.⁷ The second covers businesses that buy, sell, or share the personal information of 100,000 or more consumers or households annually. The third catches businesses that derive at least half their annual revenue from selling or sharing consumer personal information, regardless of size.⁸

The law reaches any qualifying entity doing business in California even if headquartered elsewhere, and it extends to parent and subsidiary companies sharing branding and consumer data with a covered business.⁸

Some data is carved out because it is already regulated by federal law. Protected health information covered by HIPAA, financial data covered by the Gramm-Leach-Bliley Act, and information collected under the Fair Credit Reporting Act are exempt. These are exemptions for the data itself, not blanket passes for an industry, so a hospital or bank can still face CCPA obligations for personal information that falls outside those federal frameworks.

How the CPRA Changed Things

The CPRA kept the CCPA’s foundation and added several layers. It created a dedicated enforcement body, the California Privacy Protection Agency, with authority to investigate violations, conduct audits, and bring administrative actions.⁹ It introduced the rights to correct inaccurate data and to limit use of sensitive personal information. It expanded the opt-out right from sales alone to cover “sharing” for targeted advertising. And it removed the 30-day cure period that previously gave businesses a chance to fix violations before facing administrative penalties, which makes prompt compliance more important than it was under the original law.

1
State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
2
California Privacy Protection Agency. California Consumer Privacy Act of 2018 – Section 1798.106
3
California Legislative Information. California Code CIV 1798.120 – Consumers Right to Opt Out of Sale or Sharing of Personal Information
4
State of California – Department of Justice – Office of the Attorney General. Global Privacy Control (GPC)
5
California Privacy Protection Agency. California Consumer Privacy Act of 2018 – Section 1798.121
6
California Legislative Information. California Code CIV 1798.150 – Personal Information Security Breaches
7
California Privacy Protection Agency. California Privacy Protection Agency Announces 2025 Increases
8
California Legislative Information. California Code CIV 1798.140 – Definitions
9
California Legislative Information. California Code CIV 1798.155 – Administrative Enforcement