CCPA

The California Consumer Privacy Act (CCPA) is a state privacy law that took effect in 2020 and established new rights for California residents regarding their personal information. It was among the most prominent comprehensive privacy laws in the United States and has influenced privacy legislation in other states. The CCPA was subsequently amended and expanded by the California Privacy Rights Act (CPRA), which strengthened several provisions and created a dedicated enforcement agency.

The CCPA applies to certain for-profit businesses that collect personal information from California consumers and meet defined thresholds related to size, revenue, or the scale of data they handle. Not every organization that touches California consumer data is covered, and the law includes specific criteria and exemptions. Because the thresholds and definitions are detailed, businesses often assess their data practices to determine whether and how the law applies to them.

Personal information under the CCPA is defined broadly to include information that identifies, relates to, or could reasonably be linked with a particular consumer or household. This expansive definition means many common data points, beyond obvious identifiers, can fall within scope. The law focuses on transparency about what information is collected, the purposes for which it is used, and whether it is shared or sold.

The CCPA grants consumers several rights, which can include the right to know what personal information a business collects and how it is used, the right to request deletion of personal information, the right to opt out of the sale or sharing of personal information, and protection against discrimination for exercising these rights. Amendments under the CPRA added further rights, such as the ability to correct inaccurate information and to limit the use of certain sensitive personal information. Covered businesses are generally expected to provide clear privacy notices and accessible methods for submitting requests.

Enforcement of the CCPA involves state authorities, and the law also provides a limited private right of action in specific circumstances, such as certain data breaches involving inadequate security. Penalties and statutory damages can apply depending on the nature of the violation, so covered businesses commonly invest in privacy notices, request-handling workflows, and data inventories to support their obligations.

This entry is general information rather than legal advice. The CCPA, as amended, is a detailed and evolving framework, and its application depends on the specific business, the data involved, and the activities at issue. Organizations should consult qualified legal counsel to evaluate whether the law applies to them and how to meet its requirements.

MediaBloom works with more than 300 businesses and designs its platform with privacy expectations in mind, supporting practices such as transparent data handling and the ability to act on consumer requests where applicable. These capabilities are meant to help customers operate responsibly, while each business remains responsible for determining its own obligations under the CCPA and related laws.