Overview: California Consumer Privacy Act

California privacy law is going through an evolutionary phase which is expected to continue for the next several years. The primary focus of California privacy law is to protect and regulate the use of personal information of consumers that is collected by businesses. California privacy law is being implemented through legislative action, regulations and voter-passed propositions.

There have been two significant recent events in the development of California privacy law. The first was passage of the California Consumer Privacy Act (CCPA) by the state legislature in 2018. The CCPA became effective on January 1, 2020, and enforcement began on July 1, 2020. The CCPA is currently enforced by the California Office of the Attorney General (OAG). Since its passage, the Office of Administrative Law (OAL) of the OAG has proposed and then modified a set of regulations to provide guidance to businesses on how to comply with the CCPA, and to enable consumers to exercise new rights over their personal information. A final set of regulations were promulgated on August 14, 2020, and final amendments to the regulations became effective on March 15, 2021 – find the CCPA regulations here.

The second significant event was the passage of a California ballot measure (Proposition 24) approved by California voters in November 2020, which created the California Privacy Rights Act (CPRA). The CPRA changes and expands many of the rights and obligations established under the CCPA, and will take effect on January 1, 2023. The CPRA created a new investigative, enforcement and rulemaking authority called the California Privacy Protection Agency (CPPA).

The CCPA currently applies to businesses that either (1) have annual revenue of at least $25 million [or are owned or controlled by such an entity]; or (2) buy, sell or share personal information of at least 50,000 California consumers or households for commercial purposes; or (3) derive more than half of their annual revenue from the sale of personal information. When implemented in 2023, the CPRA will change these criteria, expanding the threshold number of consumers or households from 50,000 to 100,000, and expanding the 50% of annual revenue to include revenue derived from either selling or sharing personal information.

This article is intended to be the first in a series of articles that Sierra IP Law, PC - Patents, Trademarks & Copyrights will publish to provide information regarding the critical aspects of the CCPA and CPRA.

Sierra IP Law, PC - Patents, Trademarks & Copyrights

7030 N. Fruit Ave.
Suite 110
Fresno, CA 93711

1925 G. Street
Bakersfield, CA 93301
(661) 200-7724 | phone

956 Walnut Street, 2nd Floor
San Luis Obispo, CA 93401
(805) 275-0943 | phone

Contact Form

180 Promenade Circle, Suite 300
Sacramento, CA 95834
(916) 209-8525 | phone

1300 10th St., Suite F.
Modesto, CA 95345
(209) 286-0069 | phone

414 Olive Street
Santa Barbara, CA 93101
(805) 275-0943 | phone

1650 Borel Place, Suite 216
San Mateo, CA, CA 94402
(650) 398-1644. | phone

110 N. San Joaquin St., 2nd Floor
Stockton, CA 95202
(209) 286-0069 | phone

US Bancorp Tower
111 SW Fifth Avenue, Suite 3150
Portlane, OR 97204
(503) 343-9983 | phone

Wells Fargo Center
601 W. 1st Avenue, Suite 1400
Spokane, WA 99201
(509) 255-3442 | phone

1201 Pacific Avenue, Suite 600
Tacoma, WA 98402
(253) 345-1545 | phone

1030 N Center Pkwy Suite N196
Kennewick, WA 99336

    linkedin facebook pinterest youtube rss twitter instagram facebook-blank rss-blank linkedin-blank pinterest youtube twitter instagram