What Is the CCPA?

The CCPA is the most comprehensive privacy law in the United States to date and is designed to give Californians more control over their personal information.

Major new data protections the CCPA introduces include:

• Right to access information – Consumers in California will be able to know the “what, who, and why” surrounding their personal information. Specifically, they can request the following, which must be provided in a portable format:

  • Which categories of personal information were collected, shared, or sold?
  • Categories of sources from which this personal information was collected, with whom it was shared, and to whom it was sold to
  • The specific pieces of personal information it has collected about that consumer
  • Why the personal information was collected?

• Right to deletion – Consumers in California will be able to request that a company delete the personal information it has collected about them.

• Right to opt out – Consumers in California will be able to direct a company to not sell their personal information to third parties. It’s also important to note that the definition of “sell” in the bill is broader than simply monetary exchange.

Although it was passed in June 2018, the CCPA will go into effect on January 1, 2020. As a result, companies can expect the California Attorney General to clarify the requirements of the CCPA and expect the California legislature to amend the law. The CCPA has already been amended to include, for example, a grace period for businesses in which the Attorney General cannot bring an enforcement action until six months after final regulations have been published, or July 1, 2020, whichever is sooner. Please note that this grace period does not apply to the private right of action consumers can bring under the CCPA. There are also several other amendments still pending in the California legislature.