California Consumer Privacy Act (CCPA)

The California Consumer Privacy Act, CCPA, is a California state law giving state residents rights over their personal data, including the right to know what data a business holds about them, to request its deletion, and to opt out of its sale or sharing. It was later amended and expanded by the California Privacy Rights Act (CPRA), which added further protections and created a dedicated enforcement agency.

CCPA applies to businesses meeting certain size or data-volume thresholds that collect California residents' data, regardless of where the business itself is headquartered. It differs from General Data Protection Regulation in scope and mechanism: GDPR generally requires an affirmative legal basis before processing personal data at all, while CCPA is built more around disclosure and opt-out rights, particularly around the sale of data to third parties, a category defined broadly enough to capture some advertising practices that wouldn't intuitively be called a "sale."

For analytics teams, CCPA affects what a "do not sell or share" opt-out signal means for ad tracking and audience-building pipelines, and requires being able to identify and export or delete a specific individual's data on request, which depends on reliable data classification of what counts as personally identifiable information. Consent and opt-out preferences are typically managed through a consent management platform. This is general background, not legal advice; several U.S. states have since passed similar but not identical laws, and applicability depends on specific business circumstances.