CCPA Compliance

What is CCPA compliance?

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), is the most far-reaching consumer privacy law in the United States. CCPA compliance means giving California residents control over the personal information your website collects about them, and being able to prove - technically and operationally - that your site honors those rights. In practice that is a set of concrete obligations: telling people what you collect, letting them opt out of the sale or sharing of their data, deleting their data on request, and responding to those requests within legal deadlines.

A privacy policy alone does not make a site compliant. The requirement is that the mechanisms on your live site actually work - the "Do Not Sell or Share" link genuinely stops the data flow, the deletion request is answered in time, and the opt-out signal from a browser is respected. A misconfigured tag or a broken opt-out link is a violation even when the page looks correct.

Who must comply with the CCPA?

A common misconception is that the CCPA only applies to companies based in California. It does not. Jurisdiction follows the location of the consumer, not the business. The CCPA applies to any for-profit business that does business in California, collects personal information from California residents, and meets at least one of these thresholds:

• Has annual gross revenue over $25 million.

• Buys, sells, or shares the personal information of 100,000 or more California consumers or households per year. The CPRA raised this from the original 50,000 and added "sharing" to the test.

• Derives 50% or more of its annual revenue from selling or sharing consumers' personal information.

"Doing business in California" is read broadly and does not require a physical office. If you market to California residents or get meaningful website traffic from the state, you are likely in scope. This pulls in a large share of e-commerce sites, SaaS platforms, and digital publishers.

Does the CCPA apply to non-profits?

The CCPA applies to for-profit businesses, so most non-profit organizations are not directly covered. There are important exceptions: a non-profit can fall in scope if it is controlled by, or shares branding with, a covered for-profit business, or if it otherwise operates for the profit of another entity. Non-profits should also note that other privacy obligations may still apply even when the CCPA does not.

What personal information does the CCPA cover?

The definition of personal information is deliberately expansive. It covers far more than names and email addresses. Under Cal. Civ. Code section 1798.140 it includes online identifiers, IP addresses, geolocation data, browsing and search history, and inferences drawn from that data to build a profile of a consumer. This means a business that never collects a name or an email can still be processing personal information through cookies, analytics trackers, and advertising pixels - which is enough to trigger CCPA obligations.

Consumer rights under the CCPA

The law grants California residents a set of rights that a compliant business must be able to honor within the legal timeline:

• The right to know what personal information is collected, where it comes from, why it is collected, and who it is shared with.

• The right to delete personal information the business has collected, subject to statutory exceptions. Requests must be honored within 45 days, with one 45-day extension when reasonably necessary.

• The right to opt out of the sale or sharing of personal information. Businesses that sell or share data must post a clear "Do Not Sell or Share My Personal Information" link.

• The right to correct inaccurate personal information, added by the CPRA.

• The right to limit the use of sensitive personal information, such as precise geolocation, requiring a "Limit the Use of My Sensitive Personal Information" link where applicable.

• The right to non-discrimination for exercising any of these rights.

A critical technical requirement is honoring opt-out preference signals such as the Global Privacy Control (GPC). CPRA regulations require businesses to treat a GPC signal as a valid request to opt out of sale or sharing. This has to be automated - the site must detect the signal and suppress the relevant advertising and analytics data flows for that visitor.

CCPA fines and penalties

Enforcement is handled by the California Privacy Protection Agency (CPPA) and, for data breaches, by consumers directly. The penalties are structured per violation, which is what makes them add up:

• Up to $2,500 per unintentional violation. A single broken opt-out link on a high-traffic site can be counted as one violation per affected consumer - potentially thousands of them.

• Up to $7,500 per intentional violation, or per violation involving the personal information of a minor.

• A private right of action for data breaches of unencrypted personal information caused by unreasonable security, with statutory damages of $100 to $750 per consumer, per incident, or actual damages if greater.

The CPRA also removed the guaranteed 30-day right to cure. Regulators may still allow time to fix a problem, but it is no longer an automatic safe harbor, which raises the value of continuous, proactive compliance.

CCPA vs CPRA: what changed

The CPRA did not replace the CCPA - it amended and strengthened it, and took full effect for enforcement in 2023. The most important changes: it added the rights to correct and to limit sensitive personal information, introduced the concept of "sharing" for cross-context behavioral advertising, raised the consumer threshold to 100,000, created the CPPA as a dedicated enforcement agency, and removed the guaranteed cure period. When people say "CCPA" today, they generally mean the CCPA as amended by the CPRA.

How to check if your website is CCPA compliant

Because modern websites change constantly, a one-time audit is not enough. A routine deployment, a new marketing pixel, or a misconfigured tag manager rule can quietly break a mechanism that was compliant last week. A reliable check has to test the actual behavior of the site, not just the presence of a policy:

• Confirm the "Do Not Sell or Share" link exists and actually stops advertising and analytics data flows on later visits, not just returns a success page.

• Confirm deletion and access requests are answered within the 45-day deadline.

• Confirm the site detects and honors the Global Privacy Control signal.

• Confirm the privacy notice discloses the categories collected, the purposes, and the sharing practices, and that it is updated at least every 12 months.

Complyy checks all of this continuously from the outside, the same way a regulator would, and captures timestamped evidence for every finding. Enter your domain above to run a free CCPA compliance check on your site.