CCPA (California Consumer Privacy Act)

Framework Name

‍California Consumer Privacy Act (CCPA)

Type

‍Mandatory

Region / Jurisdiction

‍California, USA (applies to any business meeting the thresholds below and serving California residents, regardless of where the company is headquartered)

Enforcing Body / Certifying Party

‍Originally enforced solely by the California Attorney General. Since CPRA's amendments took effect, it's jointly enforced with the California Privacy Protection Agency (CalPrivacy)

Penalty / Consequence of Non-Compliance

‍Civil penalties of $2,500 per violation, rising to $7,500 for intentional violations or those involving a minor's data. As originally written, businesses had a 30-day window to fix a violation before being penalized, that cure period no longer exists today, a change made by CPRA

What It Is & Why It Matters

CCPA, passed in 2018 and effective in 2020, was the first comprehensive consumer privacy law in the United States, giving California residents four core rights: to know what personal data a business collects about them, to have it deleted, to opt out of its sale to third parties, and to not be discriminated against for exercising those rights. It applies to businesses with more than $25 million in annual revenue, or that handle personal data of 100,000 or more consumers, households, or devices, or that get half or more of their revenue from selling personal data.

It matters because it was the first law of its kind in the US, arriving years before most other states had any comprehensive privacy statute at all, and it set off a wave of similar state laws that followed its basic model. It was substantially expanded by the California Privacy Rights Act in 2023, which added new rights, a dedicated enforcement agency, and rules that didn't exist in CCPA's original form, covered in that separate entry.

Who Needs It

• You meet CCPA's revenue or data-volume thresholds and serve California residents, regardless of where your company is based
• You want to understand the foundational consumer rights, know, delete, opt-out, non-discrimination, that other US state privacy laws were later modeled on
• You're building a privacy program and want to distinguish what the original law required from what CPRA later added
• You want the historical context for why California became the reference point for US privacy law