What Is CCPA? – Definition and How It Works
Learn what the CCPA and CPRA cover, which rights they grant, and what they mean for collected personal information.
The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives California residents rights over personal information that businesses hold about them. This page is a general explanation, not legal advice.
1. Who It Applies To
The law reaches businesses that handle California residents' personal information and meet a threshold — based on revenue, the volume of consumers whose information is processed, or deriving a substantial share of revenue from selling or sharing personal information.
Two points that surprise people:
- Location does not matter. A business outside California is covered if it handles California residents' information and meets a threshold.
- Business-to-business data counts. A work email address belonging to an identifiable person is personal information.
2. What Counts as Personal Information
The definition is broad: anything that identifies, relates to, or could reasonably be linked with a particular consumer or household. That includes identifiers, commercial information, internet activity, geolocation, employment and education information, and inferences drawn from any of it.
The inferences clause matters for anyone building profiles. A derived attribute — an interest, a segment, a predicted behaviour — is personal information in its own right, even though nobody disclosed it.
3. The Rights Granted
| Right | Effect |
|---|---|
| Know | What is collected, from where, why, and who receives it |
| Access | A copy of the information held |
| Delete | Removal, subject to exceptions |
| Correct | Fix inaccurate information |
| Opt out of sale or sharing | Stop the sale or cross-context sharing |
| Limit sensitive information use | Restrict processing of sensitive categories |
| Non-discrimination | No penalty for exercising a right |
4. "Sale" Is Broader Than It Sounds
Sale is defined as disclosing personal information for monetary or other valuable consideration. That reaches arrangements involving no money at all — data exchanged for services, or shared with an advertising partner in return for capability.
"Sharing" covers disclosure for cross-context behavioural advertising specifically, whether or not anything is exchanged.
Anyone concluding "we do not sell data" should check the definition rather than the intuition.
5. Publicly Available Information
CCPA excludes information lawfully made available from government records, and information a business has a reasonable basis to believe the consumer lawfully made available to the general public.
This is the exclusion most relevant to web collection, and it is narrower than "it was on the internet":
- It does not cover information obtained in violation of terms or access controls.
- It does not cover information the consumer made available to a limited audience rather than to the public.
- Inferences drawn from public information are not themselves public. A profile built from public posts is new personal information the exclusion does not reach.
That last point is the one that defeats the common argument. Aggregating public data into a profile creates something the exclusion does not cover.
6. Practical Implications for Collection
- Determine whether you handle personal information at all. Much collected data — prices, product specifications, aggregate ratings — is not.
- Record provenance per record, since responding to a right-to-know request requires knowing where information came from.
- Make deletion possible. A pipeline with no deletion path cannot honour a request, and retrofitting one across raw storage, derived tables, caches, and backups is expensive.
- Distinguish observed from inferred fields, since inferences carry the same obligations and are easy to overlook.
- Set retention deliberately rather than keeping everything indefinitely.
- Check whether your disclosures constitute selling or sharing under the broad definitions.
7. CCPA and GDPR Compared
| CCPA/CPRA | GDPR | |
|---|---|---|
| Basis for processing | Not required in advance | A lawful basis is required |
| Model | Opt out of sale or sharing | Opt in for many purposes |
| Scope | California residents | People in the EU and EEA |
| Public-data exclusion | Explicit | Narrower; no general exclusion |
| Enforcement | Regulator and limited private action | Regulators, with substantial fines |
A programme built for GDPR generally satisfies most of CCPA's substance, because the opt-in model is stricter. The reverse is not true.
8. Summary
The CCPA, as amended by the CPRA, grants California residents rights to know, access, delete, correct, opt out of sale or sharing, and limit sensitive-data use, and it applies to qualifying businesses regardless of where they are.
Personal information is defined broadly and includes inferences; "sale" reaches non-monetary consideration; and the public-availability exclusion does not cover data obtained against access controls or the profiles built from public data — so record provenance, keep observed and inferred fields distinct, and make sure deletion is actually possible.