CCPA & CPRA: California's Consumer Privacy Rules

Why it exists

These laws were created to give consumers control over the vast amounts of personal information businesses collect about them. Before CCPA, individuals had little say in how their data was gathered, used, or sold. CCPA and its amendment, CPRA, establish a baseline of privacy rights for California residents, making data handling more transparent and accountable.

The mental model

Treat CCPA/CPRA as a set of non-negotiable user rights for their data. Imagine every California user has a dashboard with buttons for "Show me my data," "Delete my data," "Correct my data," and "Don't sell or share my data." Your systems must be built to respond when they push those buttons, without penalizing them for doing so.

How it works

The law grants California consumers several core rights. The Right to Know lets them see what personal information you've collected. The Right to Delete requires you to erase their data upon request, with some exceptions. The Right to Opt-Out of Sale/Sharing means you must stop selling or sharing their data if they ask. The CPRA amendment added the Right to Correct inaccurate information and the Right to Limit Use and Disclosure of Sensitive Personal Information (e.g., precise geolocation). Businesses must provide clear notices about these rights and have processes to fulfill user requests in a timely manner.

When to use it

Compliance is mandatory for most for-profit businesses that handle the data of California residents and meet certain thresholds (related to revenue or the volume of data processed). As a marketer, this impacts how you collect leads, use tracking pixels, build user profiles, and manage customer databases. You must have clear privacy policies and mechanisms for users to exercise their rights, such as a prominent "Do Not Sell Or Share My Personal Information" link.

When not to use it

The specific rules are not federally mandated across the entire US, though other states have similar laws (like in Virginia, Colorado, and Utah). However, since it's often difficult to segment California users from others, many companies apply these standards to all US users as a best practice. The law has defined exceptions, for example, for data needed to complete a transaction or for certain legal and security purposes.

One canonical example

A user in California visits your website. They see a "Your Privacy Choices" link in the footer. They click it and submit a request to see all the data your company has stored about them. Your company must then provide that data, such as their name, email, and purchase history, in a readable format. If they then request deletion, you must erase that data from your marketing databases, CRMs, and other systems, subject to legal exceptions.