What Is CCPA?

California Consumer Privacy Act (CCPA)

Enacted in 2018, the California Consumer Privacy Act (CCPA) is a broad state law that provides California residents with

• The right to know what personal information is being collected about them and how that information is being used.
• The right to access their personal data.
• The right to delete most information collected about them.
• The right to opt out of selling their information to third parties.
• The right to non-discrimination after exercising their rights under CCPA.

CCPA was expanded in 2020 with the passage of the California Privacy Rights Act (CPRA, also known as Proposition 24). CPRA limits businesses’ usage of “sensitive personal information,” such as geolocation, race, ethnicity, religion, genetic data, and sexual orientation, and removes the set time period which businesses can correct violations without penalty. The amendments also created the first state agency dedicated exclusively to consumer privacy, the California Privacy Protection Agency. The Agency is tasked with implementing regulations, providing guidance, and enforcing the CCPA alongside the California Attorney General.

CCPA provides a private right of action, which means that California residents can sue a business directly if they believe the company has violated their privacy rights under the CCPA.

Winston & Strawn’s Privacy & Data Security practice has vast experience advising clients on CCPA compliance and representing clients in litigation matters related to alleged CCPA violations.