CCPA (California Consumer Privacy Act)

The CCPA — California Consumer Privacy Act — is the state law giving California residents enforceable rights over the personal information businesses collect about them. Signed on June 28, 2018 as Assembly Bill 375 and effective January 1, 2020, it was the first comprehensive consumer privacy law in the United States, and it made California the de facto privacy regulator for American marketing, because few national businesses can ignore their largest state market.

The CCPA grants consumers a short list of powerful rights: to know what personal information a business collects and how it is used, to request deletion, to opt out of the sale of their data (the law's famous 'Do Not Sell' link), and to not be discriminated against for exercising any of these. It applies to for-profit businesses over revenue or data-volume thresholds, with penalties enforced by the state. The California Privacy Rights Act (CPRA) — Proposition 24, passed by voters in November 2020 and effective January 1, 2023 — then extended the regime: it added the right to correct data, expanded 'sale' to cover 'sharing' for cross-context behavioral advertising (closing the loophole adtech had been driving through), created the category of sensitive personal information, and stood up a dedicated enforcement agency, the California Privacy Protection Agency. For marketers the practical consequences are concrete. Third-party data flows — pixels, audience sharing, RETARGETING feeds — can constitute 'sharing' requiring an opt-out path; the 'Do Not Sell or Share' link and honoring opt-out signals like Global Privacy Control are compliance surface; and the law rewards FIRST-PARTY DATA strategies built on consent. Unlike GDPR, the CCPA is opt-out rather than opt-in — collection is lawful by default, but the exit door must work.

The CCPA matters to any business marketing to Californians above the law's thresholds — which captures most national brands — and its template spread: a wave of state laws (Virginia, Colorado, Connecticut, and more) copied its architecture, so building to CCPA-plus-CPRA standards is how teams stay ahead of the patchwork. The discipline is to treat privacy as infrastructure rather than legal theater. Map where personal data flows into ad platforms, wire the opt-out so it actually stops the sharing, honor Global Privacy Control signals, and prefer consented first-party data — because enforcement actions have repeatedly targeted marketing pixels and broken opt-outs, not exotic data abuses. (This is general information, not legal advice; consult counsel for specific obligations.)

The CCPA began as a 2018 ballot-initiative threat by privacy advocate Alastair Mactaggart, which the California legislature pre-empted by passing AB 375 in a single week — Governor Jerry Brown signed it on June 28, 2018. Voters then entrenched and extended the regime through Proposition 24 (the CPRA) in November 2020, making California's framework the template most US state privacy laws now follow.

Etymology: source.

Search interest for this term over the last five years:

View interest-over-time on Google Trends →

Areas of marketing where ccpa is a core concern: