Clym Logo
US flagUS — California

California Consumer Privacy Act (CCPA): Complete Compliance Guide

Overview

The California Consumer Privacy Act (CCPA) is a law that grants California residents enhanced privacy rights and consumer protections regarding their personal data. Effective January 1, 2020, the CCPA aims to give consumers more control over how businesses collect, use, and share their personal information.

It requires businesses to disclose data collection practices, allows consumers to request access to or deletion of personal information, and offers the right to opt out of the sale of personal data. The law was initially enforced by the California Attorney General, with fines for non-compliance. The California Privacy Rights Act (CPRA), effective January 1, 2023, further expands upon the CCPA by adding new consumer rights, enhancing existing ones, and establishing the California Privacy Protection Agency (CPPA) as the primary enforcement authority.

The CPRA introduces new obligations for businesses, such as data minimization, purpose limitation, and requirements around sensitive data. The final CCPA regulations, effective March 23, 2023, provide detailed guidelines on how businesses must comply with both CCPA and CPRA requirements, ensuring alignment and enforcement of consumer privacy rights in California.

Business Scope

Does the California Consumer Privacy Act Apply to Your Business?

The CCPA applies to businesses that meet at least one of its thresholds. Use this tool to check whether it applies to yours.

California Consumer Privacy Act Scope Checker

Answer three questions to determine whether the CCPA applies to your organization.

Note: the CCPA applies based on California residents' data, regardless of where your business is located.

Consumer Rights

California Consumer Rights Under the CCPA

The CCPA grants five individual privacy rights to California residents. Businesses must respond to authenticated requests within 45 days. A 45-day extension is available with written notice to the consumer.

Receive a copy

Request a copy of personal information we have collected about you

45-day response window
Delete your data

Delete personal information we have collected about you

45-day response window
Do not sell or share

Request that we stop sharing or selling your information with third parties

45-day response window
Update your data

Correct inaccurate or incomplete information we have collected about you

45-day response window
Find out about your data

Request access to the information we have collected about you

45-day response window
Clym for CCPA Compliance

How Clym Helps You Comply with the California Consumer Privacy Act

UOOM / GPCAutomatic UOOM Detection

Clym detects browser-based Global Privacy Control signals and automatically applies opt-out status — no extra configuration needed from your dev team.

Consent ManagementCCPA-Compliant Cookie Banner

Configurable consent banner that asks for opt-in consent before non-essential cookies run, and a full consent audit log.

Consumer RightsAutomated DSR Management

Clym's Data Subject Request portal handles every CCPA request type, with built-in 45-day deadline tracking and escalation alerts.

Privacy NoticeAuto-Generated Privacy Notice

Clym scans your site and generates your CCPA-compliant privacy notice, updated automatically when new trackers or data categories are detected.

Book a demoStart free trial — no credit card

Regulation Summary

  • June 28, 2018: CCPA signed into law.
  • January 1, 2020: CCPA becomes enforceable.
  • July 1, 2020: California Attorney General begins enforcement actions.
  • November 3, 2020: CPRA passed, expanding the CCPA.

  • Companies operating in California or collecting data from California residents.
  • Businesses with annual gross revenues over $25 million.
  • Entities buying, receiving, or sharing data of 50,000+ consumers, households, or devices.
  • Companies earning 50% or more of revenue from selling personal data.

  • Non-profits.
  • Personal data collected for employee or contractor-related purposes.
  • Some financial and health data already regulated by other laws (e.g., GLBA, HIPAA).

  • Implement a “Do Not Sell My Personal Information” link.
  • Honor consumer requests to access, delete, or opt-out.
  • Provide notice of the categories of data collected, the purpose, and the third parties receiving data.

  • Display a prominent opt-out link for data sales.
  • Present a clear privacy policy with detailed information.
  • Enable verifiable requests for accessing or deleting data.

Website owners using Google Analytics should review how CCPA applies to analytics data collection and sharing. Our guide on making Google Analytics GA4 CCPA compliant covers the CCPA-specific steps in detail.

  • Mandatory training for personnel handling consumer data requests.
  • Appoint a Data Protection Officer (if necessary).
  • Enhanced protections for minors under 16.

  • Access: Know what data is collected.
  • Delete: Request data deletion.
  • Opt-Out: Prevent the sale of personal data.
  • Know: Understand how personal data is used and shared.
  • Non-Discrimination: Equal service regardless of exercising rights.

  • Authority: California Attorney General and California Privacy Protection Agency (CPPA).
  • Fines: Up to $7,500 per intentional violation and $2,500 per unintentional violation.
  • Private Right of Action: Consumers can sue in cases of data breaches.