The California Consumer Privacy Act (CCPA) gives California residents enforceable control over the personal information businesses collect about them, and it requires covered companies to disclose, delete, correct, and limit the use of that data on request. The law took effect in 2018 and was significantly expanded by the California Privacy Rights Act (Proposition 24), with most of those amendments live since January 1, 2023. The current version adds new rights, a dedicated enforcement agency, and penalties that can reach $7,500 per intentional violation.
Who the Law Covers
The CCPA applies to for-profit businesses that collect personal information from California residents and meet at least one of three thresholds. A company is covered if it had annual gross revenues over $25 million in the preceding calendar year; if it annually buys, sells, or shares the personal information of 100,000 or more consumers or households; or if it derives 50 percent or more of its annual revenue from selling or sharing consumer data.1California Legislative Information. California Code CIV 1798.140 – Definitions
One point worth knowing if you’re an employee or a business contact rather than a customer: the original CCPA temporarily exempted workforce data and business-to-business contact information from most of its requirements. Those carve-outs expired on January 1, 2023. Employees, job applicants, contractors, and B2B contacts now get the same rights as ordinary consumers, and businesses owe them the same obligations.
Your Rights as a California Consumer
The law gives California residents six core rights. Each one works independently, and a business cannot retaliate against you for using any of them.
Right to Know
You can ask any covered business to tell you what personal information it has collected about you. The company must disclose the categories of data it holds, where it came from, why the business collected or sold it, who it was shared with, and the specific pieces of information on file.2California Legislative Information. California Code CIV 1798.110 – Right to Know What Personal Information Is Being Collected The disclosure covers the preceding twelve-month period and follows a verified request.
Right to Delete
You can tell a business to erase the personal information it collected from you. Once your identity is verified, the company must delete the data from its own systems and direct its service providers, contractors, and any third parties it shared the information with to do the same.3California Legislative Information. California Code CIV 1798.105 – Consumers Right to Delete Personal Information There are exceptions. A business can keep data it genuinely needs to complete a transaction, detect security incidents, comply with a legal obligation, or exercise free speech rights.
Right to Correct
Added by the CPRA amendments, this right lets you require a business to fix inaccurate information it holds about you. After verifying the request, the company must use commercially reasonable efforts to make the correction.4California Legislative Information. California Code CIV 1798.106 – Consumers Right to Correct Inaccurate Personal Information Bad data moves between companies and can affect decisions about advertising, credit, insurance, and employment, so getting it fixed at the source matters.
Right to Opt Out of Sale and Sharing
You can tell a business to stop selling or sharing your personal information with third parties, and it must comply.5California Legislative Information. California Code CIV 1798.120 – Consumers Right to Opt Out of Sale or Sharing of Personal Information The CPRA stretched the meaning of “sharing” to include handing data to third parties for cross-context behavioral advertising, even when no money changes hands.1California Legislative Information. California Code CIV 1798.140 – Definitions So a company that lets an ad network follow you across sites is “sharing” for CCPA purposes, and you can shut it off.
For minors, the rule flips from opt-out to opt-in. A business that knows a consumer is under 16 cannot sell or share their data without affirmative permission. For ages 13 to 15, the minor can give that permission. For anyone under 13, it has to come from a parent or guardian.5California Legislative Information. California Code CIV 1798.120 – Consumers Right to Opt Out of Sale or Sharing of Personal Information
Right to Limit Use of Sensitive Personal Information
This right, also new under the CPRA, applies to a particularly sensitive subset of data. You can direct a business to use your sensitive personal information only for purposes an average consumer would reasonably expect when asking for the company’s products or services.6California Legislative Information. California Code CIV 1798.121 – Consumers Right to Limit Use and Disclosure of Sensitive Personal Information After you send that direction, the business cannot use the data for anything else unless you later agree.
Right to Non-Discrimination
A business cannot punish you for exercising any CCPA right. No denying service, no charging higher prices, no cutting the quality of what you receive, no retaliating against an employee who invokes the law.7California Legislative Information. California Code CIV 1798.125 – Consumers Right of No Retaliation Following Opt Out or Exercise of Other Rights A company can run a loyalty program or offer a different price tied to data, but only if the difference is reasonably related to the value the data provides. If it can’t show that connection, it can’t offer the price difference.
What Counts as Personal Information
The CCPA defines personal information broadly: anything that identifies, relates to, or could reasonably be linked to a particular consumer or household. The statute lists twelve categories, including identifiers (name, address, email, IP address, Social Security number), commercial information such as purchase history, online activity like browsing and search history, geolocation, biometric data, audio and visual recordings, professional and education information, and inferences drawn about your preferences or behavior.1California Legislative Information. California Code CIV 1798.140 – Definitions
Two kinds of data fall outside the definition. Information lawfully available from government records or that you have voluntarily made public is not personal information under the CCPA. Neither is data that has been fully de-identified or aggregated so it can’t be traced back to any individual.
Sensitive Personal Information
The CPRA carved out a subcategory that carries extra protection. Sensitive personal information includes Social Security and passport numbers, financial account credentials, precise geolocation, racial or ethnic origin, citizenship or immigration status, religious beliefs, union membership, the contents of your mail and messages (unless the business is the intended recipient), genetic data, neural data, biometric identifiers used to identify you, and information about your health or sexual orientation.1California Legislative Information. California Code CIV 1798.140 – Definitions When a business collects any of these, it has to disclose that separately at or before collection, and the right to limit use attaches.
What Businesses Have to Do
Compliance goes well beyond posting a privacy policy. The law reaches website design, data handling, and the mechanics of answering consumer requests.
Notice at Collection
At or before collecting personal information, a business must tell you what categories it collects, why, whether it will sell or share the data, and how long it plans to keep each category.8California Legislative Information. California Code CIV 1798.100 – General Duties of Businesses That Collect Personal Information Sensitive personal information gets its own separate disclosure. Privacy policies must be updated at least every twelve months and must spell out each of your rights and how to use them.
Opt-Out and Limitation Links
Any business that sells or shares personal information must put a clear link on its homepage labeled “Do Not Sell or Share My Personal Information.” If it also uses sensitive personal information beyond what’s needed to provide its services, it has to post a second link: “Limit the Use of My Sensitive Personal Information.”9State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA) You should not have to create an account to use either link, and businesses must also honor browser-based opt-out preference signals.
Response Timelines
When you submit a request to know, delete, or correct data, the business has to verify who you are before responding. Companies must offer at least two ways to submit a request, including an online option. They have to acknowledge your request within ten business days and give a substantive response within 45 calendar days, with one 45-day extension available if reasonably necessary.
No Dark Patterns
The CCPA treats any user interface designed to subvert your decision-making as a “dark pattern,” and consent collected that way is legally invalid. The practical rule: opting out of data sales cannot be harder or slower than agreeing. A company can’t hide the opt-out behind five screens while making the “accept” button huge and obvious. Consent language has to be plain, not legalese.
Data Minimization
The CPRA added a requirement that businesses limit their collection, use, and retention of personal information to what is reasonably necessary and proportionate to the purpose they disclosed at the time of collection.8California Legislative Information. California Code CIV 1798.100 – General Duties of Businesses That Collect Personal Information A business cannot collect new categories of data or repurpose old data for incompatible uses without giving fresh notice. The old habit of stockpiling data just in case runs into this rule.
Enforcement and Penalties
Enforcement is where the CPRA changed the most. The original CCPA gave the California Attorney General sole enforcement power and let businesses cure violations within 30 days before any penalty attached. Neither of those is still true.
The California Privacy Protection Agency
Proposition 24 created the California Privacy Protection Agency (CPPA), a dedicated state body with full authority to implement and enforce the law.10California Privacy Protection Agency. California Consumer Privacy Act of 2018 – Full Statute It investigates violations on its own or in response to consumer complaints, audits businesses, issues subpoenas, writes the implementing regulations, and brings administrative enforcement actions.11California Privacy Protection Agency. Frequently Asked Questions The Attorney General still has independent civil enforcement authority, but the CPPA is the primary day-to-day enforcer.
Fines
After a hearing, the CPPA can impose administrative fines of up to $2,500 per violation and up to $7,500 per intentional violation.12California Legislative Information. California Code CIV 1798.155 – Administrative Enforcement The $7,500 ceiling also applies to any violation involving the personal information of a consumer the business knows is under 16, intentional or not. Because fines are counted per violation, a single bad practice touching thousands of consumers can produce very large liability. The old automatic 30-day cure period is gone; the agency can give a business time to come into compliance, but it is not required to.
Suing Over a Data Breach
Consumers can sue businesses directly in one specific situation: a data breach that happened because the company failed to maintain reasonable security practices. If your unencrypted personal information is exposed, you can file a civil lawsuit seeking statutory damages of $100 to $750 per consumer per incident, or actual damages if those are greater, plus injunctive relief.13California Legislative Information. California Code CIV 1798.150 – Personal Information Security Breaches This private right of action does not reach other CCPA violations. A company that ignores a deletion request or posts a bad privacy notice answers to the CPPA and the Attorney General, not to you in court.