California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA)

The California Consumer Privacy Act of 2018 (CCPA) gives California consumers more control over the personal information that businesses collect about them. It became operative on January 1, 2020. In November 2020, California voters approved Proposition 24, the California Privacy Rights Act (CPRA), which amended the CCPA and added new protections that began on January 1, 2023.

Who it covers. The law applies to for-profit businesses that do business in California and meet any one of three tests: gross annual revenue over $25 million; buying, selling or sharing the personal information of 100,000 or more California residents or households; or earning 50% or more of annual revenue from selling California residents' personal information.

Consumer rights. Californians can ask to know what a business collects, have it deleted or corrected, opt out of its sale or sharing, and limit the use of sensitive personal information. Businesses may not discriminate against people for using these rights.

Why it matters in advertising. Under the law, "sharing" means sharing for cross-context behavioral advertising — targeting ads based on personal information from a person's activity across many websites. Businesses that sell or share must offer a "Do Not Sell or Share My Personal Information" link, and consumers can also opt out through a user-enabled global privacy control such as the GPC.

Enforcement. Proposition 24 established the California Privacy Protection Agency. Apart from certain data-breach claims, only the Attorney General or the Agency may take legal action against businesses that don't comply.