The California Consumer Privacy Act (CCPA): Privacy rules for Californians

Scope and Key Provisions of the CCPA

Take a concrete case: a medium-sized ecommerce company based in Ireland receives around 6,000 monthly website visits from California-based users. That company must consider whether it is subject to the CCPA, as businesses outside the US can fall within its scope if they collect data from Californian residents and meet revenue thresholds or process a certain volume of consumer information. The act’s primary objective is to give Californians strong rights to know what personal data is collected about them, request deletion, opt out of data sales, and avoid discrimination for exercising these rights.

The CCPA enforces obligations on companies to be transparent with consumers about data practices. Businesses must update privacy policies, implement processes for verifying consumer identity, and respond to specific consumer requests within defined deadlines. Non-compliance can result in regulatory scrutiny or penalties initiated by Californian authorities, even for foreign organisations. With expanding global privacy expectations, it is sensible for Irish and UK businesses to assess their exposure and align their practices if their activities touch US audiences.

• Applies to businesses collecting data on Californian residents, regardless of location
• Sets thresholds based on revenue and volume of data processed
• Requires clear consumer notification and transparency about data use
• Grants rights to access, delete, and restrict use or sale of personal information
• Imposes administrative, verification, and response process requirements on companies

Compliance Requirements for Businesses

Look at the numbers: An Irish e-commerce company handling data for around 7,200 Californian customers each month must closely monitor its information management practices to avoid falling foul of privacy requirements. For each customer record processed, the firm needs verification steps for deletion requests, robust disclosure systems, and clear opt-out methods for the sale of data. Over a span of six months, this would mean reviewing and potentially updating data storage processes, training staff on new rights, and documenting each compliance action.

Failure to adhere to these measures can result in scrutiny by US regulators, potential penalties, or reputational setbacks. Businesses sometimes overlook less obvious obligations, such as the need to update privacy notices at least once every 12 months, or to maintain internal records of consumer requests and the company’s responses. One critical tip: assign a staff member as a point of contact for all privacy-related queries to ensure nothing slips through the cracks.

• Notify consumers about data collection and sharing at or before the point of collection
• Allow consumers to request access to, or deletion of, their personal information
• Provide a visible and functional opt-out mechanism for the sale of consumer data
• Update privacy policies regularly to reflect the rights and choices available
• Respond to verified consumer requests within a legally mandated timeframe
• Ensure data security to protect against unauthorised access or breaches
• Keep records of data requests, compliance activities, and staff training sessions

Impacts on Consumer Rights

The California Consumer Privacy Act brings greater transparency and control for individuals over their personal information. Under its rules, people are entitled to know what data businesses collect about them, how it’s used, and with whom it’s shared. Consumers now have the right to access this information upon request, as well as to demand deletion or to opt out of the sale of their data. These measures are designed to reduce unauthorised data use and give individuals more say in how their details are treated by any organisation handling large amounts of personal information.

Businesses face clear obligations around disclosure and response. If, for example, a company processes records of 8,400 customers each month, it must prepare to address potentially hundreds of access or deletion requests in a timely and accurate manner. This not only enhances confidence among consumers, but also compels organisations to maintain robust data-mapping and secure handling practices. People in California can identify when their information is being sold and stop it at the source, ensuring more robust privacy for all.

• The right to know what data is collected and for what purpose
• Ability to request access to all personal information held by a business
• Option to demand deletion of personal data in most circumstances
• The power to opt out of the sale of their data at any time
• Protection against discrimination for exercising privacy rights
• Obligation for businesses to provide clear and accessible privacy notices

Common Challenges and Pitfalls for Organisations

Run the maths on this: a company handling 9,600 customer data profiles a month can quickly face issues if they misunderstand the scope of personal information under the CCPA. For instance, failing to account for all data types or sources—such as email lists, social media, and offline records—means that even with tight access controls on databases, legal exposure remains if a request for data deletion cannot be honoured due to overlooked records. That immediately exposes the business to fines and erodes customer trust over time.

Another common pitfall is treating compliance as a one-time project. Regulations evolve and so do internal processes. For organisations in Ireland and the UK serving Californian customers, this can mean missing notifications or failing to keep up with new regulatory guidance. Staff turnover and the absence of clear, documented procedures can further amplify the risk of non-compliance. Consistent training and regular in-house audits help keep these risks in check and build a culture of privacy awareness.

• Not mapping all data sources that may hold Californian personal data
• Over-relying on one-off compliance reviews rather than ongoing assessments
• Inadequate documentation of processes and responses to consumer requests
• Poor staff training leading to mismanaged access or deletion requests
• Failing to monitor updates or amendments to privacy legislation
• Lack of clarity on who in the organisation is responsible for compliance
• Underestimating the need for regular engagement with legal advisors

CCPA Compared to Other Data Privacy Laws

Here is a simple example: Suppose a UK e-commerce company tracks 10,800 customer sessions each month from California, while also running campaigns in the EU and Brazil. They must compare their privacy compliance obligations under the CCPA, GDPR and Brazil’s LGPD. While the General Data Protection Regulation (GDPR) mandates a legal basis for any data processing, the CCPA focuses more on transparency and the consumer’s right to opt-out of data selling. If this retailer mistakenly assumes that complying with one law covers all, they risk penalties or customer complaints in each region.

Another key difference is in the personal data definitions and enforcement measures. GDPR defines personal data more broadly than CCPA and applies to both controllers and processors. The CCPA, while rigorous, is less strict on certain categories and enforcement tends to be based on civil procedures, with penalties for non-compliance often lower than those under GDPR. Brazil’s LGPD, meanwhile, shares similarities with both but introduces its own rights and obligations. Understanding these subtleties is crucial, especially when handling data across multiple jurisdictions.

• Check if data definitions differ across regions
• Review which consumer rights require new workflows
• Monitor the threshold for fines and penalties in each area
• Align privacy notices to region-specific standards
• Verify vendor contracts meet all applicable regulations