What Does CCPA Stand for and How Can it Affect Your Business?

CCPA stands for California Consumer Privacy Act. It’s a digital protection law that gives consumers more control over the data that organizations collect, store, and share.

While the California Consumer Privacy Act specifically impacts businesses in California, many other states have similar laws addressing consumer data privacy and protection.

To stay informed on all of the latest updates to compliance and data privacy regulations, subscribe to the DOT Security blog!

CCPA Compliance: What Is the California Consumer Privacy Act?

The California Consumer Privacy Act was passed in 2018 and became the most comprehensive privacy law in the US, giving consumers more control over how their data is stored and protecting their data from being bought and sold without their consent.

Then, in November of 2020, California residents voted on and passed Proposition 24, or the California Privacy Rights Act (CPRA), which amended the CCPA and gave consumers additional rights.

The CCPA is part of a larger trend in state and federal legislation. As a whole, this legislation works to move the needle toward data protection and privacy in the digital era as we continue to embrace the technological frontier as society.

Because consumer data is often confidential, identifiable, and sensitive, the way that data is protected is important. Data protection and privacy laws, like the CCPA, came shortly after some well-known company data abuse in which large businesses and organizations were caught selling collected data without consumer knowledge or consent.

What Is Personal Identifiable Information? (PII)

Personal Identifiable information (PII) is defined as: any unique data to an individual that facilitates the direct or indirect identification of that individual.

In other words, PII is information that someone could use to trace back to you and your identity. Data that’s categorized as PII includes but is not limited to: social security numbers, physical addresses, phone numbers, email addresses, specific demographic data, and anything that would allow physical or electronic communication.

Protecting your consumers’, clients’, and employees’ PII is absolutely critical. By complying with state and industry regulations and standards, you’re putting yourself in a position to better serve stakeholders while avoiding penalties and fines.

How Does CCPA Protect Consumers?

The CCPA provides consumers some core rights concerning their data. The original rights provided by the CCPA included:

1. The right to delete data from a business’ database: Consumers can request that a business permanently delete all their personal information that a business has collected.
2. The right to opt out of data collection: It gives consumers the ability to remove themselves from data collection completely.
3. The right to know how a business is collecting and using their data: Consumers now have the ability to know exactly which information is being collected and how businesses are going to use it in the future.

“The CCPA requires businesses to give consumers certain information in a “notice at collection.” A notice at collection must list the categories of personal information businesses collect about consumers and the purposes for which they use the categories of information.”

Additionally, amendments to the CCPA went into effect on January 1st, 2023. They added two more integral data rights:

4. The right to correct inaccurate data: Under the CCPA, consumers have the right to request that inaccurate information be corrected by an organization. Organizations have 45 calendar days to respond to the initial request, and upon notifying the consumer, can take up to 90 days to make any necessary corrections.
5. The right to limit use and disclosure of collected data: The amended CCPA also allows consumers to limit an organizations use of their sensitive personal information (i.e. your social security number or geolocation data) to processes involved in providing you the product or service for which you’re paying, effectively restricting how much of your data can be shared or even permanently stored.

The CCPA also protects consumers by making it illegal to discriminate against them if they choose to exercise any of the rights listed above. This means businesses cannot change their business offerings, charge more, or refuse to do business with someone who wants to monitor and manage their personal data.

What Happens If You Don't Comply With the CCPA?

If you’re conducting business in California and you meet the requirements for CCPA compliance (outlined below), it’s critical that you do everything in your power to remain compliant. In fact, DOT Security suggests you go above and beyond compliance requirements to give yourself an advantageous position in the market and to avoid any non-compliance penalties in the first place.

The CCPA enables steep fines and civil lawsuits in the event of non-compliance. The fines can be up to $7,500 per individual violation. The penalties don’t stop there, though, and this figure doesn’t take into account the cost of any civil lawsuits levied against a company found in violation of CCPA compliance.

What Businesses Does CCPA Apply to?

At an individual level, the CCPA impacts residents of California. For businesses, similar to the EU’s General Data Protection Regulation (GDPR), every entity that operates and has consumers who are residents of California must abide by the law, regardless of the state in which they are based.

In addition to that, for the CCPA to apply, a business must meet any one of three criteria:

• Generate at least $25 million in annual revenue.
• Obtain data from 50,000+ customers.
• Earn at least half of its annual revenue by selling consumer data.

If a business meets one of these qualifiers, it must meet the requirements of the CCPA when doing business with Californians.

How Do Privacy Laws Like CCPA Affect Businesses?

The good news is that the above qualifications are designed to protect you. If you do not meet one of those qualifications, you are not required to be compliant with the privacy requirements of the CCPA. Essentially, your business with Californians can remain the same.

Similarly, the CCPA does not apply to you if you don’t do any business in California. But be wary that if you do meet one of the qualifications, having just one Californian customer means you must comply with the CCPA regulations.

Even if you don’t do any business in or have any customers from California, you may want to look to your own state regulations on data privacy and protection. Every year, more states and industries are rolling out standard data privacy and protection regulations.

Becoming CCPA Compliant

For companies who are required to become compliant with the rules set by the CCPA, you may be asking yourself ”what is CCPA compliance?” It’s important that every business knows exactly what is required of it. Below is a quick rundown of what CCPA compliance looks like:

• Update Your Privacy Policies: The CCPA requires businesses to have explicit notifications of their intent to collect and sell information at or before the collection point. Meaning, you must alert the consumer that they’re opting into data collection before they do it. This notice must include what information you’re gathering and the reasons behind it.
• Update Classifications of Your Data Inventory: When storing data, you must include records of that information’s sale, transfers to third parties, and time of collection. Additionally, you must indicate if the information is covered by another privacy law like HIPAA.
• Create New Compliant Procedures for Consumers to Reach their Data: CCPA-compliant companies must offer a way for consumers to request access to their information which also means the ability to delete it or opt out of future sales.
• Review Your Site and Business’ Security: Data security is required by the CCPA so you must obtain reasonable security for your stored data.
• Train Your Staff: Be sure that your staff is trained on cybersecurity awareness and up to date on what the CCPA is, what the requirements for compliance are, and how to handle any new requests or incidents that could arise because of it.

What’s the Difference Between CCPA, CalOPPA, and GDPR?

The CCPA isn’t the only privacy-focused law in California. In 2003, the California Online Privacy Protection Act (CalOPPA) was passed. It was the first state law in the US to require that commercial websites collecting personal information post a California-specific privacy policy that must include certain content.

The CCPA, coming in over a decade later, took data privacy rights further by giving consumers the right to delete previously collected data and opt out of future data collection from online companies

Another example of privacy laws is the General Data Protection Regulations (GDPR) created in the European Union the same year as the CCPA.

The GDPR gives European Union citizens a significant amount of control over their private data on the internet. Specifically, it changed the way that websites can acquire consumer consent in order to obtain data. The regulations outline the guidelines for how a website must communicate how personal data will be used and institutes requirements for proof of user consent.

Though the CCPA, CalOPPA, and GDPR are all different in their definitions and protections of user data, they do have one major thing in common: they affect how people around the world do business with people living in these regions.

Get Started with Data Security and Compliance

Businesses collect a lot of valuable information these days to inform their business operations, offer value to consumers, and to optimize processes.

However, with more attention being paid to the collection, storage, and sharing of consumer data, states are passing serious legislation, like the CCPA, to empower consumers with control and more transparency over the use of their own personal information.

By complying with the CCPA or other state-specific data privacy regulations, companies can avoid hefty fines, reputational damage, and consumer discontent. All while staying ahead of the curve when it comes to data privacy protections.

Complying with state and industry regulations will keep your business out of trouble with the authorities and your consumers alike. Subscribe to the DOT Security blog to stay up to date on everything you’ll need to know to be compliant now and in the future.