What are the CCPA and CPRA?
The California Consumer Privacy Act, commonly called the CCPA, is a California privacy law that gives consumers rights over personal information and imposes duties on covered businesses. The California Privacy Rights Act, or CPRA, amended and expanded the CCPA. Together, the framework addresses transparency, access, deletion, correction, data sales and sharing, sensitive personal information, retention and contractual controls over service providers, contractors and third parties.
The framework can apply to organisations outside California when they do business in the state, process California consumer information and meet the relevant statutory thresholds. Applicability and exemptions should be assessed carefully because organisational structure, revenue and processing activity can affect the analysis.
What rights do California consumers have?
Rights can include the right to know what personal information is collected and disclosed, request access, request deletion, correct inaccurate information and obtain portable copies. Consumers may also have rights to opt out of the sale or sharing of personal information and to limit certain uses and disclosures of sensitive personal information.
Businesses must provide methods for submitting requests and should verify identity proportionately. They also need procedures for recognising opt-out preference signals where required and for handling requests submitted through authorised agents.
What obligations apply to businesses?
Covered businesses should maintain accurate notices, data inventories and request workflows. They need contracts that define the permitted use of personal information by service providers and contractors. Data should be retained only for disclosed and reasonably necessary periods, and organisations must implement reasonable security procedures appropriate to the nature of the information.
The programme should also address website tracking, advertising technology, disclosures to third parties, employee and business-contact information where applicable, and the distinction between a sale, sharing and processing performed by a service provider.
Where can organisations find official guidance?
The California Privacy Protection Agency publishes regulations and rulemaking materials. Because the regulatory framework and enforcement priorities can evolve, organisations should monitor official updates and obtain legal advice for specific interpretations.
Operational compliance should be based on actual data flows rather than website notices alone. Marketing, product, procurement, legal, privacy, security and customer-support teams may all need to participate.
Frequently asked questions
Is the CPRA a separate law from the CCPA?
The CPRA amended and expanded the CCPA. The combined framework is commonly referred to as the CCPA as amended by the CPRA.
Does the CCPA apply only to companies located in California?
No. An organisation outside California may be covered when it does business in California and meets the applicable conditions and thresholds.
What is the difference between selling and sharing personal information?
Sale generally involves making personal information available for monetary or other valuable consideration, while sharing focuses on certain cross-context behavioural advertising disclosures. Specific analysis is required.
What is sensitive personal information?
It includes defined categories such as precise geolocation, certain government identifiers, account credentials, contents of communications and some health, biometric or demographic information.
Do service providers need contracts?
Yes. Contracts should restrict purposes and uses, require appropriate protections and support the business in meeting applicable obligations.