The first law of its kind in the United States, the California Consumer Privacy Act (CCPA) was initiated in the wake of Europe’s even more comprehensive General Data Protection Regulation (GDPR) to improve data transparency in the most populous U.S. state. Signed into law on June 28, 2018, and taking effect on January 1, 2020, CCPA applies to any for-profit business anywhere in the world that meets any one of the following thresholds:

• Annual gross revenue in excess of $25 million
• Buying, receiving, or selling personal information of more than 50,000 consumers or households
• Earning more than half of your annual revenue from selling personal information

Coined CCPA 2.0, the California Privacy Rights Act (CPRA) was approved by voters on November 4, 2020, as a means to improve upon the existing CCPA. The new rights and requirements outlined in the CPRA will be enforced beginning March 29, 2024, resulting in a law more in line with the EU’s GDPR and providing greater protection for consumers and additional compliance regulations for businesses.

Like GDPR, business required to be CPRA/CCPA-compliant must provide notice to consumers at the time they collect personal data, allow them to opt out and disclose the reason for retaining, sharing or selling personal information. They also must allow consumers to access and delete their personal information, respond to consumer requests within specific timeframes, and maintain all records of requests for a minimum of two years.

Penalties violating CCPA can cost businesses $2500 for per individual violation (i.e., per consumer), with higher fees for intentional violations. While you can avoid liability if you cure the noncompliance within 30 days, there are some types of non-compliance that may not be capable of a cure. For example, if a data breach has already occurred, there’s little you can do to fix it.

With the passing of the CPRA, the price of non-compliance has increased and the establishment of the CCPA is expected to result in greater enforcement. Most notably, CPRA triples the maximum penalty for an individual violation to $7500 for violations concerning minors.

CCPA and CPRA are applicable to any forprofit entity doing business in California that meet any one of the following thresholds:

• Annual gross revenue in excess of $25 million
• Buying, receiving or selling personal information of more than 50,000 consumers or households (expanded to 100,000 under CPRA)
• Earning more than half of your annual revenue from selling personal information

Ketch is easy-to-use data privacy software that makes it easy for businesses and brands to comply with data privacy regulations including CCPA/CPRA.

With Ketch, you can automate opt-outs, collect consent, enforce consumer privacy choices across your systems. Ketch can also help you with essential privacy program tasks like data mapping, ROPAs, risk assessments, and more.