CCPA / CPRA

What it is

The California Consumer Privacy Act (CCPA), effective January 1, 2020, is the first comprehensive US state consumer privacy law. Amended by the California Privacy Rights Act (CPRA) with substantive provisions effective January 1, 2023, it is now enforced by the California Privacy Protection Agency (CPPA) alongside the California Attorney General.

Who it applies to

For-profit businesses that do business in California, collect California consumers' personal information, and meet at least one of:

• Annual gross revenues exceeding USD $25 million (2023 threshold; adjusted for inflation)
• Derive 50 percent or more of annual revenue from selling or sharing consumers' personal information

Key provisions

Consumer rights

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information held by businesses (with exceptions)
• Right to correct inaccurate personal information (added by CPRA)
• Right to opt out of the sale or sharing of personal information
• Right to limit use and disclosure of sensitive personal information (added by CPRA)
• Right to non-discrimination for exercising CCPA rights
• Right to portabilityreceive personal information in a portable, machine-readable format

Key business obligations

• Provide a clear "Do Not Sell or Share My Personal Information" link on the homepage
• Honour Global Privacy Control (GPC) signals as opt-out requests
• Update privacy policies annually with specific CCPA disclosures
• Execute contracts with service providers and contractors specifying processing limits
• Conduct annual cybersecurity audits and risk assessments (CPRA, regulations still being finalized by CPPA)

Breach notification and private right of action

CCPA does not create a general breach reporting deadline of its own; California's separate breach notification statute (Cal. Civ. Code § 1798.82) applies. However, CCPA § 1798.150 creates a private right of action allowing consumers to sue for statutory damages per consumer per incident, or actual damages if greater, when nonencrypted and nonredacted personal information is exposed due to a business's failure to implement and maintain reasonable security procedures.

Attorney General notification is required for breaches affecting more than 500 California residents.

Enforcement

Administrative fines are set per violation, higher for an intentional violation or one involving a minor's information, and the statute's amounts are adjusted for inflation. The CCPA covers a business only above its thresholds (revenue, the number of consumers whose data it handles, or revenue from selling data). Enforcement by the CPPA (administrative) and Attorney General (civil). The 30-day cure period was eliminated by CPRA for most violations (with some CPPA discretion).

Recent amendments

• Jan 2023CPRA substantive provisions in force, CPPA established, sensitive PI category, right to correct, right to limit added.
• Jul 2023CPRA enforcement began, CPPA and Attorney General empowered to enforce.
• Jan 2025Status under review
  CPPA finalized regulations on CCPA enforcement priorities including risk assessments and cybersecurity audits.

How LeakTrace maps to it

An External Cybersecurity Assessment reads what a firm exposes from outside: email settings, the firm’s addresses in monitored breach databases, lookalike domains, exposed services and keys left in the firm's own website code. The Rules and Insurance Briefing that comes with it maps each finding to CCPA / CPRA, with the proof behind it, so the firm can see which obligation a finding touches. The assessment is human-verified before it is released.