CCPA and CPRA requirements for business websites

Definition

California privacy law gives consumers rights over personal information a business collects about them, and imposes duties on businesses that meet one of three thresholds. It is enforced by the California Privacy Protection Agency and the Attorney General.

Does it apply to you

• The CCPA applies to a for-profit business that collects California residents' personal information, decides why and how it is processed, does business in California and meets at least one of three thresholds: gross annual revenue of $26,625,000 or more in the preceding calendar year; buying, selling or sharing the personal information of 100,000 or more California residents or households; or deriving 50% or more of annual revenue from selling or sharing California residents' personal information.
• The revenue figure is adjusted for inflation every two years. The CPPA lists $26,625,000 as effective January 1, 2025. Some organizations and some types of data are exempt.

Why it matters

Covered businesses need to provide the required notices and rights workflows. Enforcement and available remedies depend on the violation; questions about a specific incident or claim need legal review.

Requirements

• A privacy notice that describes the categories collected, the purposes, and the categories disclosed, and that is kept accurate.
• A way for consumers to exercise access, deletion, correction and opt-out rights. For a request to know, delete or correct, the business confirms receipt within 10 business days and responds within 45 calendar days, which it can extend by another 45 days if it tells the consumer. An opt-out of sale or sharing is honored as soon as feasibly possible and within 15 business days.
• Honoring opt-out preference signals sent by a browser, which in practice means the Global Privacy Control.
• Not discriminating against a consumer for exercising a right.

Steadwatch's role

• A shared vendor declaration supplies information for the cookie table, consent categories and permitted resource origins. It also supports privacy-notice updates. Changes are reviewed against the site's actual behavior and the information the business provides.
• Requests made through a form on your site are logged with the date and the governing policy version, and tracked against the deadline for their request type.
• The Global Privacy Control signal is read and honored where it applies.

Records you receive

• A monthly count of requests received and answered within the deadline.
• A consent and preference log showing what was asked and what was chosen.

Your responsibilities

• Determining whether you meet a threshold. That turns on your revenue and on how many consumers you handle, which we do not know.
• Personal information you hold outside the website, such as a CRM, a mailing list, or a spreadsheet.