Glossary CCPA
The <em>California Consumer Privacy Act</em> is the data protection law of the US state of California, in force since 2020 and extended by the CPRA. It gives California residents the right to know what data a business collects about them, to have it deleted, and to opt out of its sale or sharing.
GDPR compliance is not CCPA compliance: the European model asks permission up front, the Californian one requires a way to object afterwards.
The CCPA took effect on 1 January 2020. In November 2020 California voters approved Proposition 24, the California Privacy Rights Act (CPRA), which extends the law and created a dedicated regulator, the California Privacy Protection Agency.
When people say CCPA today they usually mean the extended version. Both names describe the same body of rules at two stages.
It applies to for-profit businesses doing business in California that meet at least one of three thresholds:
A Californian establishment is not required. What counts is doing business there and processing residents' data — which is why it reaches European providers with US customers.
Four rights sit at the core: to know what data is collected and how it is used and shared; to have it deleted (with exceptions); to opt out of sale or sharing, including through the Global Privacy Control signal; and to non-discrimination for exercising those rights.
The CPRA added a right to correction and a right to limit the use of sensitive personal information.
This is where European companies most often get it wrong. The GDPR works on permission first: no legal basis, no processing. The CCPA works on objection afterwards: processing is permitted, and the person must be able to stop it.
That has a practical consequence. A GDPR banner asking for consent up front does not automatically satisfy the Californian requirement — that needs a reachable opt-out and respect for the GPC signal. Conversely, an opt-out alone does not meet European requirements.
If a business falls under the CCPA, three things are visible: a route to opt out of sale and sharing, a privacy notice naming categories and purposes, and honouring the GPC signal that some browsers and extensions send automatically.
The GPC signal is the part most often missed technically: it arrives as a header or a JavaScript property and has to be evaluated server-side or in the consent platform. A banner on its own does not see it.
A technical audit covers this and everything else in one pass.
Request an auditIt may. What matters is not where the company sits but whether it does business in California, processes residents' data and meets one of the three thresholds. A European shop with US customers can fall under it.
Not as it stands. The European banner collects consent up front; California requires an opt-out route and attention to the GPC signal. Many consent platforms support both models, but it has to be switched on.
The definition is broad and does not require money. Disclosing data to a third party for valuable consideration can be enough, which is why many common advertising integrations fall under sale or sharing.
Global Privacy Control is a signal a browser or extension sends automatically to express an opt-out. In California it must be treated as a valid request, without the person clicking anything on the site.
The California Privacy Protection Agency, created by the CPRA, together with the state Attorney General. This text explains the framework; assessing a specific case requires legal advice.