About CCPA

The California Consumer Privacy Act (CCPA) is a state-wide data privacy law that regulates how businesses all over the world are allowed to handle the personal information (PI) of California residents.

The CCPA goes into effect on January 1, 2020 and requires, among other things:

  • Information Right.

    Consumers have a right to be informed about how their information is processed at or before the point of collection, specifically:

    • the categories of personal information the business collects, sells, or shares
    • the categories of third parties with whom the business shares personal information
    • the categories of sources from which that information was collected
    • the business/ commercial purpose for collecting or selling consumers’ personal information
    • consumers rights and how to exercise them; and
    • how the consumer can object to the selling of their data, via a “Do not sell my data” link (if data is sold)

  • Access Right.

    Consumers have the right to access:

    • the categories of the consumer’s personal information collected in the past 12 months
    • specific pieces of information collected about them
    • the categories of sources from which the business collected the information
    • the purposes for collecting or selling the information
    • the categories of third parties that the personal information is shared with
    • the categories of personal information sold and the categories of third parties that the personal information was sold to
    • the categories of personal information disclosed for business purposes.

  • The right to opt-out (the right to say no to the sale of their data).

    Under the CCPA, a consumer has the right, at any time, to tell a business which sells their personal information to third parties, that they must stop selling such personal information.

  • Businesses are prohibited from selling the personal information of consumers if the business has actual knowledge that the consumer is under the age of 16. In such cases, businesses may only sell the information if:

    • the consumer is between 13 and 16 and has opted-in; or
    • the consumer is less than 13 years of age and the consumer’s parent or guardian has opted-in on the consumer’s behalf

    Under the CCPA, businesses are prohibited from discriminating against consumers for exercising their rights granted under the law. Prohibited forms of discrimination include:

    • Denying goods or services to the consumer.
    • Charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties.
    • Providing a different level or quality of goods or services to the consumer, if the consumer exercises the consumer’s rights under this title.
    • Suggesting that the consumer will receive a different price or rate for goods or services or a different level or quality of goods or services.

  • The right to be deleted

    The CCPA grants consumers the right to request the deletion of any personal information that has been collected about them

  • The right to portability

    Where businesses fulfill Access requests “electronically”, it’s also required that the information be provided to the consumer in “a portable and, to the extent technically feasible, in a readily usable format that allows the consumer to transmit this information to another entity without hindrance”.