CCPA / CPRA
California Consumer Privacy Act (as amended by CPRA)
California's privacy law granting consumers rights over their personal information and imposing a duty to implement reasonable security. The CPRA amendments added new rights and a dedicated enforcement agency (CPPA).
Who it applies to
For-profit businesses doing business in California that meet a threshold — gross revenue over $25M, handling personal information of 100k+ consumers/households, or earning half their revenue from selling/sharing data — and process California residents' personal information.
Consumer rights
Business obligations
- §1798.130 Methods for handling consumer requests6 mapped
Establish and document methods to receive, verify and respond to consumer privacy requests, and maintain records of them.
- §1798.150 Duty to implement reasonable security7 mapped
Implement and maintain reasonable security procedures appropriate to the personal information held; failure giving rise to a breach creates a private right of action.