What CCPA means
Amended by the CPRA, it applies to businesses that meet set thresholds, such as annual revenue or volume of consumer data. Covered businesses must disclose data practices and honor requests to opt out of sale or sharing.
Why it matters for your website
If your business meets the law's thresholds and collects data from California residents, you have duties around privacy notices, opt-outs and data requests. Ignoring them can lead to enforcement and fines. Even if you are not covered, clear privacy practices build trust with customers who care how their data is used.
Example
An online furniture retailer that sells to California shoppers adds a 'Do Not Sell or Share My Personal Information' link and a process for handling requests to see or delete data.
Tips
- Ask a privacy lawyer whether your business meets the law's thresholds.
- List what personal data your site collects, including through ad and analytics tags.
- Keep your privacy policy current whenever you add new tracking or tools.
Common mistakes
- Assuming the law only applies to companies based in California.
- Copying another company's privacy policy that does not match your actual practices.
Questions about CCPA
What is CCPA?
The California Consumer Privacy Act, giving California residents rights over their personal information.
Does the CCPA apply to my small business?
Only if you do business in California and meet at least one of the law's thresholds, which are based on things like revenue and how much consumer data you buy, sell or share. A lawyer can confirm whether you are covered.
What is the difference between the CCPA and CPRA?
The CPRA is a later law that amended and expanded the CCPA. It added rights such as correcting data and created the California Privacy Protection Agency to enforce the rules.
