The California Consumer Privacy Act (CCPA) is a state privacy law that took effect in 2020, granting California residents specific rights regarding their personal information. It applies to businesses that meet certain revenue or data processing thresholds and collect personal information from California residents. The CCPA was later amended and strengthened by the California Privacy Rights Act (CPRA) in 2023.
Under the CCPA, California residents have the right to know what personal information is collected about them, request deletion of their data, opt out of the sale or sharing of their personal information, and receive equal service regardless of exercising their privacy rights. For B2B organizations, the law includes a partial exemption for business contact information collected in a B2B context, though this exemption has specific limitations that require careful interpretation.
Organizations should have clear privacy policies, implement processes for handling deletion and access requests, and train their teams on compliance requirements. While the B2B exemption provides some flexibility, building compliant data practices protects against regulatory risk as privacy legislation continues to expand.
Key Points
- CCPA gives California residents rights over their personal information including deletion and access
- It includes a partial exemption for B2B contact information with specific limitations
- The law applies to businesses meeting certain thresholds that handle California residents' data
Best Practices
- Maintain a comprehensive privacy policy that clearly describes your data collection practices
- Implement processes to handle consumer data access and deletion requests within required timelines
- Stay updated on CCPA amendments and expanding state privacy laws across the United States