The California Consumer Privacy Act of 2023 (CCPA) is an extensive and comprehensive data privacy law that provides California residents with more control over their personal information. The law applies to for-profit companies doing business in California with more than $25 million in annual revenue, those who collect personal information from 50,000 or more consumers annually, or those who derive 50 percent or more of their annual revenue from the sale of consumer personal information. The law also applies to any company that collects personal information from California residents and stores it within the state.
The goal of the CCPA is to protect the personal information of California residents by giving them more control over how their data is used, shared and stored. It provides California residents with the right to know what personal information a company collects about them, the right to request that their data be deleted, and the right to opt-out of the sale of their personal information. It also requires companies to provide detailed information about their data collection and use practices, and to provide more secure storage and transmission of consumer data.
What Personal Information is Protected Under the CCPA?
The CCPA defines “personal information” as any information that can be used to identify, or reasonably link to, an individual consumer or household. This includes, but is not limited to, names, addresses, email addresses, phone numbers, Social Security numbers, driver’s license numbers, IP addresses, geolocation data, and biometric data. The law also protects information that can be used to create a profile of a consumer or household, such as purchasing habits, web browsing history, and inferences drawn from these data points.
What Rights Do California Consumers Have Under the CCPA?
Under the CCPA, California residents have the following rights:
Right to Know:
California residents have the right to know what personal information a company collects about them, how it is used, and with whom it is shared. Companies must provide this information to consumers in a clear and concise format.
Right to Delete:
California residents have the right to request that a company delete their personal information upon request. Companies must respond to such requests within 45 days, and must provide information on how to request deletion.
Right to Opt-Out of Sale:
California residents have the right to opt-out of the sale of their personal information. Companies must provide a way for consumers to opt-out of the sale of their personal information and must honor those requests.
Right to Non-Discrimination:
California residents have the right to not be discriminated against for exercising their rights under the CCPA. Companies must not deny services or charge different prices for services based on a consumer’s decision to exercise their rights under the CCPA.
What Are Companies Required to Do Under the CCPA?
Under the CCPA, companies are required to provide detailed information about their data collection and use practices, and to provide more secure storage and transmission of consumer data. They must also provide consumers with an easy way to exercise their rights under the law, such as an online portal or toll-free phone number. Companies must also provide clear and conspicuous notices to consumers when they collect personal information, and must obtain affirmative consent before collecting or using sensitive data.
Conclusion
The California Consumer Privacy Act of 2023 is a comprehensive data privacy law that provides California residents with more control over their personal information. The law applies to for-profit companies doing business in California, and provides California residents with the right to know what personal information is collected about them, the right to request that their data be deleted, the right to opt-out of the sale of their personal information, and the right to not be discriminated against for exercising their rights. Companies must provide detailed information about their data collection and use practices, and must obtain affirmative consent before collecting or using sensitive data.