US Privacy Law

CCPA (California Consumer Privacy Act)

California's landmark 2018 data privacy law — the strongest consumer data protection statute in the US — giving California residents the right to know, delete, and opt out of the sale of their personal information.

Legal Definition

The California Consumer Privacy Act (CCPA), effective January 2020 and strengthened by the California Privacy Rights Act (CPRA) in 2023, gives California residents rights including: the right to know what personal data is collected; the right to delete personal data; the right to opt out of sale or sharing of personal data; the right to correct inaccurate data; and the right to limit use of sensitive personal information. It applies to businesses that meet certain thresholds (revenue, data volume) and carry on business in California. The California Privacy Protection Agency (CPPA) enforces it.

📖 Constitutional / Statutory Basis: California Constitution Article I, Section 1 (inalienable right to privacy)

Practical Example

A California resident discovers that a data broker is selling her personal information — including her browsing history and location data — to advertisers without her consent. Under the CCPA, she submits an opt-out request. If the broker continues selling her data, she can complain to the CPPA or bring a private action for a data breach.

Frequently Asked Questions

Does the CCPA apply outside California in the US?

The CCPA formally applies only in California. However, because many large businesses operate nationally and prefer a single compliance standard, CCPA requirements often influence data practices nationwide. Other states (Virginia, Colorado, Texas, etc.) have enacted their own privacy laws modelled partly on the CCPA.

Can I sue a company under the CCPA for a data breach?

Yes — the CCPA provides a private right of action specifically for data breaches resulting from a business's failure to implement reasonable security. Statutory damages of $100–$750 per consumer per incident are available without proving actual harm. For other CCPA violations, enforcement is by the CPPA.

Know the law. Know what to say.

The Advocate covers US law and Scripture — 389 real scenarios across 7 countries with exact rebuttals and law references. Free to start.

Explore US Rights — Free

or get a free checklist