CCPA Compliance Guide

According to the California Attorney General’s office, the CCPA is a landmark privacy initiative that secures personal data privacy rights for California residents. 

The CCPA gives Californians more control over the personal data companies collect about them, including transparency into how they use and share that information. The CCPA also grants California consumers the ability to force companies to delete their personal data and prevent companies from selling that data to third parties. At the same time, the CCPA helps consumers avoid discrimination when exercising these newfound privacy rights.

Under the CCPA, personal data refers to information that correlates or relates to a specific consumer or household (i.e., personally identifiable information, or PII). Such data may include the following personal identifiers:

• Real names

• Aliases

• Postal addresses

• Online identifiers

• IP address

• Account names

• Email addresses

• Social Security numbers

• Driver’s license numbers

• Passport numbers

• Biometric information like fingerprints or facial scans

• Geolocation data

• Professional or employment-related data

Per the CCPA, personal information doesn’t include publicly available data from local, state, or federal records such as professional licenses and public real estate and property records. For a complete breakdown of how the California legislature defines personal data, see section 1798.140 (v)(1) of the CCPA.

Additional state privacy laws exist outside California, and other states continue to review privacy legislation proposals. Outside of the U.S., countries such as the members of the European Union, Australia, Canada, and Japan have privacy legislation in place. 

As privacy regulations continue evolving worldwide, businesses need to take a proactive approach to ensure compliance with the ones that impact them. With so many rapid changes occurring, many businesses — and small and midsize businesses in particular — may be best off partnering with a third party to achieve compliance.

Why do we need privacy compliance?

Privacy compliance deters organizations from using an individual’s personal information without consent. This may include data-sharing practices like selling data without permission or exposing private information to the public.

Today, there’s a heightened demand for privacy compliance due to the enormous amount of commercial information companies collect to drive marketing, sales, research, and technology initiatives. According to a recent survey, 97% of organizations are investing in big data, and the global big data market, which brought in $240.56 billion in 2021, is expected to reach $655.53 billion by 2029.

While businesses need data, protecting it is challenging. Cybercrime remains a top threat globally, with threat actors becoming increasingly sophisticated and effective in their tactics. Research indicates that during the third quarter of 2022, roughly 15 million data records were exposed globally through data breaches, approximately a 37% increase from the previous quarter. Additionally, the average data breach costs U.S. companies $9.44 million.

Privacy programs like the CCPA help consumers by incentivizing companies to take greater responsibility for the data they collect, store, and manage. It’s important to note that privacy frameworks like the CCPA are continuously evolving. As such, businesses need to pay close attention to privacy regulations to ensure continued compliance.

In 2018, the European Union drastically changed the global privacy landscape with the introduction of the General Data Protection Regulation (GDPR) — a groundbreaking law that forever changed the way companies handle personal information.

Today, the GDPR remains one of the most far-reaching privacy frameworks in the world. It also paved the way for the CCPA, which launched two years later.

The CCPA and GDPR are similar in that both aim to give consumers more control over their personal data and protect them against unlawful data processing. But there are some important differences to consider. 

For example, CCPA only applies to businesses with gross annual revenues of at least $25 million, collect data on at least 50,000 individuals, households, or devices, or earn more than half their annual revenue from selling PII. The GDPR, on the other hand, applies to all businesses that process the personal data of European citizens — regardless of annual revenue or data volume. 

In addition, the GDPR has more stringent privacy requirements than the CCPA. For example, the CCPA enables companies to collect data after an individual makes a purchase or signs up for a service, but the GDPR requires consumers to opt-in before any data collection can occur. The GDPR also has a much wider scope, as it contains specific data processor and cross-border transfer requirements and processing and automated decision-making limitations. The CCPA mainly focuses on the sale of personal information and respecting consumers who opt out of data collection.

As for enforcement, the GDPR levies much more severe penalties. For example, CCPA violations carry fines of up to $7,500 per incident. Consumers also have the right to sue a business for up to $750 per violation or even more, depending on the extent of the damages. GDPR violations are much costlier and can extend to up to 4% of a company’s global annual turnover or €20 million (about $23 million) — whichever is greater. 

The EU also applies to a much larger group of people. While the CCPA only protects Californians (approximately 40 million people), the GDPR extends to every citizen within the EU (approximately 750 million people). 

Consumers have several rights under the CCPA, spread out across different categories. In this section, we provide a general breakdown of each.

Right to notice

Under the CCPA, businesses must present consumers with a notice at the point of data collection that outlines what data will be collected and how it will be used. These notices must contain links to the business’ privacy policy. 

Right to know

The right to know enables consumers to request that companies inform them about the categories of personal data they intend to collect, as well as why they collect that data and how they plan to use it. Businesses must respond within 12 months of each request, providing data free of charge.

Right to delete

California consumers have the right to delete personal information that companies collect about them. They also have the right to request that service providers delete certain personal data. Businesses must provide at least two methods for customers to submit requests, such as a toll-free phone number, website form, dedicated email address, or paper form. 

Right to opt-out 

If consumers don’t want a company to use their personal information, they can request that a business stops doing so by exercising the right to opt-out. After a customer opts out, a business is unable to sell their personal information. However, a customer can later provide authorization by opting back in. A company must also wait at least 12 months before asking a customer to opt back in and agree to let the business sell their personal data.

Right to non-discrimination

Under the right to non-discrimination, the CCPA prohibits businesses from denying customers goods or services, providing a different level or quality of goods, or charging different prices to those who exercise their CCPA rights.