The California Consumer Privacy Act Takes Effect

After its adoption in 2018, the California Consumer Privacy Act (“CCPA”) took effect on January 1, 2020.  Like the General Data Protection Regulation (“GDPR”), which took effect in the European Union in 2018, “the CCPA creates new consumer rights relating to the access to, deletion of, and sharing of personal information that is collected by businesses.”  When it was adopted, the CCPA was “hailed by privacy advocates as a great leap forward in holding companies accountable for how they handle personal data, one that would give U.S. consumers their first real glimpse at how they are being monitored and profited from online.”  In this respect, it is widely regarded as the first major piece of data privacy legislation enacted in the United States. 

Under the CCPA, if a company buys or sells the personal data of more than 50,000 California residents each year, it must tell those residents what it is doing with their personal data.  The residents then have the right to prohibit the company from selling their data or demand that the company delete their data.  Yet given the CCPA’s novelty, it is not entirely clear how these rights will look in practice.  For instance, certain notification requirements are still nebulous and companies (e.g., Facebook) are parsing out what constitutes the “selling” of information.  Nevertheless, this uncertainty was expected and therefore the CCPA permits the California Attorney General to gather input from parties impacted by the law and then propose new regulations that flesh out how businesses are to comply with the it.