California Privacy Rights Hub

CCPA (California Consumer Privacy Act) was enacted in 2018 and became effective January 1, 2020. It created baseline privacy rights for California consumers. CPRA (California Privacy Rights Act) was passed by voters in November 2020 as Proposition 24 and became effective January 1, 2023. CPRA significantly expands CCPA by adding new rights (right to correct, right to limit use of sensitive personal information), creating a new enforcement agency (CPPA), expanding the definition of sensitive personal information, and creating stricter obligations for businesses. CPRA is often called "CCPA 2.0" because it amends and strengthens the original CCPA framework rather than replacing it entirely.

Generally, no. The CCPA provides a private right of action ONLY for data breaches caused by a business's failure to maintain reasonable security measures (CC 1798.150). You cannot sue a company for other CCPA violations such as failing to respond to your consumer rights request, selling your data without permission, or failing to post a privacy policy. For non-breach violations, your only remedy is to file a complaint with the California Privacy Protection Agency (CPPA) or Attorney General, who can investigate and impose civil penalties. The limited private right of action for data breaches includes statutory damages of $100-$750 per consumer per incident, plus actual damages if greater, and permits class action lawsuits.

Under CC 1798.150, you can recover statutory damages of $100 to $750 per consumer per incident (the exact amount is at the court's discretion), OR actual damages if you can prove they are greater. Actual damages may include identity theft costs, fraudulent charges, cost of credit monitoring, time spent recovering from the breach (at a reasonable hourly rate), emotional distress in some cases, and out-of-pocket expenses. You can also seek injunctive relief to force the business to improve security practices. If you prevail in the lawsuit, you can recover attorney fees and costs. Class action lawsuits are permitted, which can result in substantial aggregate damages across thousands or millions of affected consumers.

Yes, CC 1798.150(b) requires that you provide the business with 30 days' written notice identifying the specific CCPA provisions you claim have been violated and provide the business an opportunity to cure the alleged violation. If the business cures the violation within 30 days and provides you with an express written statement that it has cured and will not violate CCPA again, you cannot proceed with a lawsuit. The notice must be sent to the business's agent for service of process or designated CCPA contact. Failure to provide this notice can result in dismissal of your lawsuit. This cure period does not apply to Attorney General or CPPA enforcement actions.

A business must comply with CCPA if it does business in California AND meets one or more of these thresholds: (1) Has annual gross revenues exceeding $25 million, OR (2) Annually buys, sells, or shares personal information of 100,000 or more California residents or households, OR (3) Derives 50% or more of its annual revenues from selling or sharing consumers' personal information. The business need not be located in California - any business that collects PI of California residents and meets a threshold must comply. Small businesses below these thresholds are exempt. There are also specific exemptions for employee data, B2B data (until 2023), public records, and certain regulated entities.

Businesses covered by CCPA must provide at least two methods for submitting requests (typically a toll-free phone number and website submission form). Look for a "Do Not Sell or Share My Personal Information" link on the company's homepage, or check their privacy policy for contact information. You can submit requests to know, delete, or correct your personal information. You do not need to create an account to submit a request. The business may ask you to verify your identity, but cannot require you to provide more information than necessary for verification. The business has 45 days to respond (with one 45-day extension if needed). They must provide the response free of charge. You can make up to 2 "right to know" requests per year.

Under CC 1798.29, any person or business that owns or licenses computerized data including personal information about California residents must notify affected individuals in the event of a breach. Personal information is defined as first name/initial + last name plus SSN, driver's license, financial account number, medical information, health insurance information, or username/email + password. Notification must be made "in the most expedient time possible and without unreasonable delay" (AG guidance suggests ~45 days). If more than 500 California residents are affected, the business must also notify the California Attorney General. Notification must include specific elements required by CC 1798.29(d), and if SSN or driver's license was breached, the business must offer 12 months of free credit monitoring per CC 1798.82.

CPRA made significant changes effective January 1, 2023: (1) Created the California Privacy Protection Agency (CPPA) as a new enforcement authority, (2) Added a "right to correct" inaccurate personal information (CC 1798.106), (3) Added a "right to limit use of sensitive personal information" (CC 1798.121), (4) Expanded the definition of "sensitive personal information" to include precise geolocation, racial/ethnic origin, religious beliefs, union membership, genetic data, biometric data, health data, sex life/sexual orientation, (5) Changed "sale" threshold from 50,000 to 100,000 consumers, (6) Created new "sharing" category for cross-context behavioral advertising, (7) Tripled look-back period for responding to data requests from 12 to 36 months, (8) Created stricter data minimization and purpose limitation requirements, and (9) Added employee data protections (previously exempt).