Why this matters.
The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives California consumers broad rights over their personal information — including the right to know what is collected, the right to delete, the right to opt out of the sale or sharing of their data, and the right to correct inaccurate information. The California Privacy Protection Agency (CPPA) and the California Attorney General can seek civil penalties of $2,500 per unintentional violation and $7,500 per intentional violation. Because California has over 39 million residents, businesses that serve customers anywhere in the US and meet the thresholds may be covered.
Even businesses based outside California must comply if they meet any of the thresholds: annual gross revenue over $25 million; buy, sell, or share personal information of 100,000 or more California consumers or households annually; or derive 50% or more of annual revenue from selling or sharing California consumers’ personal information. Many other US states have enacted similar laws (Virginia, Colorado, Texas, etc.), and the CCPA is widely used as the compliance benchmark for a national standard.