What is the California Consumer Protection Act (CCPA), and does it apply to my business?

What you will discover:

Consumer protection under the CCPA
Is the CCPA applicable to my company?
Deadlines and enforcement under the CCPA
What if my company does not satisfy the requirements?

California has traditionally been a pioneer in defending its inhabitants’ inherent rights, so much so that the state constitution was changed to include the right to privacy. Following a series of other state laws, such as the Online Privacy Protection Act, the Privacy Rights for California Minors in the Digital World Act, and the Shine the Light Act, the California Consumer Privacy Act (CCPA) is the state’s most recent law that protects a Californian’s right to privacy.
What exactly is the Consumer Privacy Act of California?

California Governor Jerry Brown signed the California Consumer Privacy Act in 2018. The CCPA is a California-specific data privacy legislation that safeguards the use and sale of customers’ personal data, similar to the General Data Protection Regulation (GDPR) in the European Union. The CCPA defines personal data broadly as any identifiable information that may be reasonably linked to a California consumer or household.

Consumer protection under the CCPA

Californians have the following rights under the CCPA:

to learn what specific personal information about them has been collected
to gain access to their personal data
To learn whether or whether their personal information is sold or shared, and to whom.
to prevent the selling of their personal data
Even if they chose to assert their privacy rights, they should get similar service and pricing.

Is the CCPA applicable to my company?

In order for a customer to use their rights, at least one of the following conditions must be met by the business:

The yearly gross sales of the corporation exceeds $25 million.
The firm earns at least half of its yearly income from the sale of consumer data. The corporation buys, sells, or shares data from over 50,000 California citizens, customers, or devices.

It is vital to highlight that the location of the company is irrelevant. If your company satisfies the following requirements, it is critical that you begin taking measures toward CCPA compliance.

Deadlines and enforcement under the CCPA

The CCPA enters into effect on January 1, 2020, but the enforcement date is July 1st, allowing affected enterprises a six-month grace period to ensure that they satisfy the new law’s criteria. If businesses refuse to comply, California residents have the authority to initiate private lawsuits, in addition to the California Attorney General pursuing civil fines per infraction.

What if my company does not satisfy the requirements?

While the majority of small businesses will not meet the above requirements, it is critical to understand that your customers value their privacy. Doing your part to secure client data helps to create trust and makes you feel more prepared if the legislation changes or grows. California may be the first state to establish explicit privacy legislation pertaining to user data, but it will most likely not be the last.