CCPA (CPRA) Compliance Requirements

The California Consumer Privacy Act (CCPA) came into force on January 1st, 2020, and was amended and expanded by the CPRA, which took effect on January 1, 2023.

CCPA (CPRA) compliance requirements extend much further than those of previous California privacy laws.

This article will act as a practical guide to help you meet the CCPA/CPRA's requirements.

Confirm Whether the CCPA (CPRA) Applies to Your Company

The CCPA (CPRA) only applies to certain entities, which the CCPA (CPRA) simply calls "businesses." There are several relevant sections of the law that define a "business."

Here's the first relevant section, at Section 1798.140:

If your company operates for profit and has customers or users in California (who we'll call "consumers" from now on), it almost certainly meets this part of the CCPA's definition of a "business."

Note that your company does not need to have any physical presence in California, or even the United States, to be subject to the CCPA (CPRA). This law affects businesses worldwide.

The CCPA (CPRA) applies to business that meet one of the following:

1. Pull in annual gross revenues of at least $25 million per year
2. Buy, sell, receive for commercial purposes, and/or share for commercial purposes personal information from at least 100,000 California consumers or household
3. Earn at least half of its annual gross revenues per year from selling or sharing California consumers' personal information

Update Your Company's Privacy Policy

The CCPA (CPRA) increases transparency requirements for businesses. Part of this means updating your Privacy Policy to include information about both the CCPA (CPRA) itself and your business practices.

For a detailed look at the CCPA/CPRA's Privacy Policy requirements, read our article: CCPA/CPRA Privacy Policy Checklist.

Here's the basic outline of your CCPA (CPRA) Privacy Policy. It must contain at least the following:

• Information about consumer rights under the CCPA (CPRA):

  • The right to know

  • The right to delete

    • Instructions on how consumers can exercise their rights to know and delete
  • The right to non-discrimination

• If you sell personal information:

  • Information about the right to opt-out
  • A link to your "Do Not Sell My Personal Information" page

• 3 lists:

  • The categories of personal information your business has collected over the past 12 months

  • The categories of personal information your business has sold over the preceding 12-month period

    • Or, if you haven't sold any personal information in the preceding 12 months, you must disclose this

  • The categories of any personal information your business has disclosed for business purposes over the preceding 12 months

    • Or, if you haven't disclosed any personal information for business purposes in the preceding 12-month period, you must disclose this

Remember that if you need to comply with the CCPA (CPRA), your Privacy Policy will need to comply with other privacy laws, too. These could include:

• California Online Privacy Protection Act (CalOPPA)
• EU General Data Protection Regulation (GDPR)
• Children's Online Privacy Protection Act (COPPA)

Conduct a Personal Information Audit

CCPA (CPRA) compliance requires a complete understanding of how your business uses personal information, including:

• What types of personal information you collect and store
• Your sources of personal information

• What personal information you:

  • Sell
  • Share for business purposes

Identify What Personal Information Your Company Collects

The CCPA (CPRA) brings a new definition of "personal information" that is broader than any privacy law the US has ever seen.

One of your first tasks under the CCPA (CPRA) is to identify what personal information your business collects.

Here's how the CCPA (CPRA) defines "personal information":

This definition of personal information is very similar to that of the GDPR. Interpret it broadly.

For more information, read our article: What is Personal Information Under Privacy Laws?

The CCPA (CPRA) provides specific categories of personal information. These categories of personal information are important also you must refer to them in your Privacy Policy. It also provides some examples of the types of personal information in each category.

Identify Your Sources of Personal Information

There are many potential sources of personal information. For most businesses, their main source of personal information is probably their own customers.

Your customers probably provide some personal information directly and voluntarily. For example, via:

• Emails to your support department
• Physical mail to your billing department
• Forms on your website
• Messages on social media
• Feedback/research surveys

You might collect some other types of personal information from consumers directly, via sources such as:

• Server logs
• Cookies
• Website or app analytics

You might also collect personal information about consumers from third parties. Sometimes this will be publicly available.

The CCPA (CPRA) states that public information is not personal information if it is "lawfully made available from federal, state, or local government records" so long as it is "used for a purpose that is not compatible with the purpose for which the data is maintained."

However, you might collect some other types of publicly available information that would qualify as personal information. For example via:

• Social media profiles
• Job sites
• Online forums

Finally, there might be personal information that you buy, or receive for commercial purposes, from third parties, including:

• Market research companies
• Charities
• Other businesses

Confirm Whether You Sell Personal Information

Some parts of the CCPA (CPRA) only apply if your business sells personal information. Here's how the CCPA (CPRA) defines this:

Based on this definition, it should be obvious whether your business sells personal information.

For clarity, however, the CCPA (CPRA) lists 4 ways of sharing personal information that do not qualify as "selling" personal information. Broadly, they are:

• Making a disclosure at a consumer's request
• Disclosing that a consumer has exercised their right to opt out
• Sharing personal information for a business purpose
• Transferring personal information as part of a merger or acquisition

In any case, the recipient of the consumer's personal information must not sell it.

Confirm Whether Share You Personal Information for Business Purposes

The CCPA (CPRA) requires you to be transparent if you share personal information for "business purposes."

Here's the CCPA/CPRA's main definition of a "business purpose:"

So, the CCPA (CPRA) defines a business purpose as the use of personal information:

• Is reasonably necessary and proportionate
• Is compatible with the purposes for which you collected the personal information

The CCPA (CPRA) provides the following list of 7 business purposes:

You must provide consumers with notice regarding how you share personal information for business purposes both in your Privacy Policy and if you receive a request under the right to know.

Note that the CCPA (CPRA) has other notice requirements beyond the consumer notices that you'll need to become familiar with as well. We address these notices in detail in our article: CCPA (CPRA) Notices.

Facilitate CCPA (CPRA) Consumer Rights

The CCPA (CPRA) brings consumers some powerful new rights over their personal information. Some of these are similar to the GDPR's data subject rights.

Before we go into detail about these rights, here are some practical steps you can take toward CCPA (CPRA) compliance in this area:

1. Explain the right to know, the right to delete, and the right to non-discrimination in your Privacy Policy

2. Set up a way for consumers to access the right to know and the right to delete, including at least:

   • A web page
   • A toll-free phone number
3. Conduct a personal information audit to ensure you can easily facilitate requests

If you sell personal information, you must also:

1. Explain the right to opt out in your Privacy Policy

2. Set up a way for consumers to access the right to opt out, including at least:

   • A web page
   • A toll-free phone number
3. Create a "Do Not Sell My Personal Information" page and link to it on your homepage

The Right to Know

If you receive a verifiable request under the right to know, you must provide these types of information (in respect of the previous 12 months):

1. The categories of personal information your company has collected about the consumer
2. The categories of your sources of the consumer's personal information
3. The business or commercial purposes for which your company collected that personal information
4. The categories of third parties with whom you have shared that personal information
5. The specific pieces of personal information you have collected about the consumer

There are extra rules if you sell personal information or disclose personal information for a business purpose. You must also provide the following information (in respect of the previous 12 months):

1. The categories of any of the consumer's personal information that your company has sold
2. The categories of the third parties to whom your company sold that personal information
3. Which categories of personal information you sold to each category of third party
4. Any categories of the consumer's personal information that your company has disclosed for business purpose

Additional Conditions on the Right to Know

Here are some of the CCPA/CPRA's conditions for how you must facilitate the right to know, from Section 1798.100:

So, you must comply with a request under the right to know:

• If you receive a "verifiable consumer request"
• Twice every 12 months (if requested)
• For free
• In a portable format (e.g., a CSV file)

You should ask for ID if it would be reasonable to do so.

You must provide the requested information within 45 days. You can extend this period by an additional 45 days if you notify the consumer and it is "reasonably necessary" to do so.

The Right to Delete

You must delete the personal information you hold on a consumer on request. The same additional conditions apply to the right to delete as to the right to know. However, there are many exceptions to the right to delete.

Exceptions to the Right to Delete

You might not have to comply with a delete request if it is necessary to retain a consumer's personal information for one of the following 9 types of reasons:

1. Performing a contract
2. Ensuring security
3. Debugging
4. Exercising free speech
5. Complying with the California Electronic Communications Privacy Act (available here)
6. Conducting certain research
7. Solely internal and reasonable uses
8. Complying with a legal obligation
9. Other internal uses that are contextually reasonable

Here are the exceptions to the right to delete in full, at Section 1798.105:

The Right to Opt Out

The right to opt out only applies if you sell consumers' personal information.

You must stop selling a consumer's personal information if you receive a verifiable consumer request under the right to opt out. You can request consent to resume selling a consumer's personal information, but only after 12 months have elapsed since they opted out.

You must provide a clear and conspicuous link on your website's homepage that reads: "Do Not Sell My Personal Information." This link should lead to a web page that allows California consumers to exercise their right to opt out.

Here's an example from Coca-Cola:

Clicking the link leads to a section of Coca-Cola's Privacy Policy:

Clicking the "Make a Request" button leads to this page where users can request to opt out of having their data shared or sold. They can also request a copy of their personal information and request it be deleted:

This is a great example of how to facilitate all 3 of the CCPA/CPRA's "active" rights: the right to know, the right to delete, and the right to opt out.

Your CCPA (CPRA) Opt-Out Free Solution

The Right to Opt In (for Minors)

Your business has the right to sell the personal information of adult California consumers unless they exercise their right to opt out. However, the rules are different for minors.

Here's the relevant section of the CCPA (CPRA), 1798.120:

Let's break down the rules in this section:

• You must not sell a consumer's personal information if you have "actual knowledge" that they are under 16.
• A consumer aged between 13 and 16 can opt into the sale of their personal information.
• In the case of a consumer under 13, their parent or guardian can opt into the sale of their personal information on the consumer's behalf.

If you "wilfully disregard" a consumer's age you will be considered to have "actual knowledge" of their age.

California law tends to define "willful disregard" as a failure to take positive action. Therefore, you should consider implementing age-verification methods if you sell personal information.

The Right to Non-Discrimination

The right to non-discrimination is a "passive" right. You have to explain it in your Privacy Policy, but you don't have to set up a way for consumers to exercise it.

You cannot discriminate against a consumer who exercises their CCPA (CPRA) rights. The CCPA (CPRA) gives a non-exhaustive list of 5 examples of prohibited discriminatory activities:

Essentially, you must treat all consumers the same regardless of whether they exercise their CCPA (CPRA) rights.

However, note this section:

The CCPA (CPRA) does not consider it discriminatory to offer a different price to a consumer has not exercised their right to opt out, so long as the difference in price is based on the actual value your business gets from selling their personal information.

Summary of CCPA (CPRA) Compliance Requirements

To comply with the CCPA (CPRA) your main obligations include:

• Update your Privacy Policy

• Conduct a personal information audit to determine:

  • What types of personal information you collect
  • Your sources of personal information
  • Whether you sell personal information
  • Whether you share personal information for business purposes
• Set up a process to facilitate the right to know and the right to delete
• If you sell personal information, set up a "Do Not Sell My Personal Information" page