CCPA Compliance: 10 Answers to Complex Privacy Questions
Your website’s analytics tools may trigger consumer privacy rights even if you never collect personal data directly from your users.
The California Consumer Privacy Act grants users rights over their data, including deletion and opt-out of sales. Businesses must disclose collection practices, honor requests within forty-five days, and ensure third-party vendors comply with these strict contractual obligations.
What businesses must comply with the CCPA?
You must comply if you are a for-profit entity that does business in California and meets at least one specific threshold.
Smaller organizations often assume they are exempt because they lack large revenue streams. However, processing sensitive data at scale can still push you into compliance territory. You should evaluate your data flows carefully to determine your legal standing.
What counts as personal information under this law?
The law defines personal information broadly to include any data that identifies, relates to, or could reasonably be linked to a specific consumer or household. This includes obvious identifiers like names and email addresses, but also covers geolocation data, browsing history, and inferred characteristics.
Even aggregated data can be personal if it can be re-identified through cross-referencing with other datasets. You must treat analytics cookies and device identifiers as personal information if they persist across sessions. This broad definition catches many businesses off guard.
Do I need to offer a "Do Not Sell" link?
You must provide a clear and conspicuous link titled "Do Not Sell or Share My Personal Information" on your homepage if you sell or share personal data. This link must allow consumers to opt out without creating an account or logging in.
If you do not sell or share data, you are not required to display this specific link. However, you must still disclose your data practices clearly in your privacy policy. The distinction between selling and sharing is subtle but legally significant.
How are service providers different from third parties?
A service provider is a company you hire to process data on your behalf, such as a cloud hosting provider or email marketing platform. They are restricted from using the data for any purpose other than providing the specific services you contracted for.
Third parties, by contrast, can use the data for their own purposes, such as building advertising profiles. You must sign a written contract with service providers that explicitly prohibits them from retaining, using, or disclosing the data for any other reason. This contractual shield is your primary defense against liability for their actions.
What is the "Global Privacy Control" signal?
The Global Privacy Control is a browser-based signal that indicates a user’s preference to opt out of the sale or sharing of their personal information. Your systems must automatically recognize and honor this signal as a valid request to opt out.
Ignoring this signal is treated the same as ignoring a direct request from a consumer. You must configure your website’s tracking scripts to detect this header and adjust their behavior accordingly. Failing to implement this technical check can result in non-compliance even if you have a manual opt-out form.
See also: GDPR vs HIPAA: Key Differences for Data Protection Compliance
How do I handle data deletion requests?
You must delete personal information you have collected from a consumer, subject to specific legal exceptions. These exceptions include retaining data necessary to complete a transaction, detect security incidents, or comply with legal obligations.
You cannot delete data if you need it to maintain the integrity of your systems or to exercise free speech rights. You must respond to these requests within forty-five days, with a possible one-time extension of forty-five days if you notify the consumer. Documenting your deletion process is critical for audits.
| Request Type | Response Deadline | Extension Allowed |
|---|---|---|
| Access | 45 days | Yes, 45 days |
| Deletion | 45 days | Yes, 45 days |
| Opt-Out | Immediate | No |
What are the penalties for non-compliance?
Regulators can impose civil penalties of up to seven thousand five hundred dollars per intentional violation. For unintentional violations, the penalty is up with two thousand five hundred dollars per incident, provided you cure the violation within thirty days of notice.
Private consumers can also sue for certain data breaches involving unencrypted personal information. These lawsuits can result in statutory damages ranging from one hundred to seven hundred fifty dollars per consumer per incident. The financial risk scales with the number of affected individuals.
Does the CCPA apply to data collected before 2020?
However, you must still honor deletion and access requests for data collected prior to this date if it remains in your possession.
You are not required to proactively delete historical data that falls outside the scope of active collection. But if a consumer asks for their data to be deleted, you must comply regardless of when it was originally gathered. This creates a long-tail compliance obligation for legacy databases.
How do I verify the identity of a requester?
You must verify that the person making a request is the same person whose data you hold. For online requests, you can use existing authentication methods, such as password-protected accounts, to verify identity.
For offline requests, you may need to use multi-step verification, such as asking for two or three pieces of identifying information. You must balance verification rigor with privacy, ensuring you do not collect more data than necessary to confirm identity. Poor verification processes can lead to data leaks or rejected legitimate requests.
What is the role of data brokers in this framework?
Data brokers collect and sell personal information from various sources, often without the consumer’s direct knowledge. The CCPA requires data brokers to register with the state attorney general and disclose their data practices.
Even if you do not sell data directly, you may be liable if you use data brokers to target advertisements. You must ensure your contracts with these brokers include strict compliance clauses. Understanding the supply chain of your data is as critical as managing your own database.
Key takeaways
- Third-party data brokers can trigger compliance obligations even if you do not sell data directly.
- Service providers must sign strict contracts limiting how they use your customers' information.
- Failure to honor deletion requests can lead to significant regulatory fines per violation.
The CCPA requires strict contractual controls and technical implementations for opt-out signals, not just privacy policy updates. Audit your third-party data flows and verify your website’s response to global privacy controls immediately.
Frequently asked questions
Does the CCPA apply to small businesses with no revenue?
Generally, no, unless you buy or sell the personal information of more than one hundred thousand consumers. Revenue alone is not the only threshold for compliance.
Can I charge a fee for processing privacy requests?
You cannot charge a fee for standard requests, but you may charge a reasonable fee if the request is excessive or repetitive. You must provide the consumer with a notice of this fee before processing.
How does the CCPA interact with online tracking technologies?
Tracking technologies that collect personal information trigger compliance obligations. You must disclose these practices and honor opt-out requests for any data they collect. See our guide on online tracking for technical details.
Do I need to update my privacy policy for the CCPA?
Yes, your policy must disclose specific categories of data collected, sources, and purposes. It must also detail consumer rights and how to exercise them.
How this guide was produced: written by the InfoSec Ledger editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.
