A for-profit business must meet one the following requirements to be subject to the CCPA ”(A) has annual gross revenues in excess of twenty-five million dollars ($25,000,000), as adjusted pursuant to paragraph (5) of subdivision (a) of Section 1798.185; (B) Alone or in combination, annually buys, receives for the business’s commercial purposes, sells, or shares for commercial purposes, alone or in combination, the personal information of 50,000 or more consumers, households, or devices; or (C) Derives 50 percent or more of its annual revenues from selling consumers’ personal information.

For individuals who reside in California, the CCPA privacy law provides consumer rights to know what data is being collected and how it’s being used, the right to delete your personal information, and the right to non-discrimination when you exercise your CCPA privacy rights.

For those organizations that are subject to the CCPA, they are required to uphold those rights within their internal business practices. Furthermore, they are required to document their privacy practices within their online Privacy Policy which must state, among other items, how the organization collects personal information and how that personal information is used.

CCPA is a legal requirement for for-profit businesses that process California consumers personal information and that satisfy any of the following requirements: (A) Has annual gross revenues in excess of twenty-five million dollars ($25,000,000); (B) Alone or in combination, annually buys, receives for the business’s commercial purposes, sells, or shares for commercial purposes, alone or in combination, the personal information of 50,000 or more consumers, households, or devices; or (C) Derives 50 percent or more of its annual revenues from selling consumers’ personal information.”

The CCPA provides consumers a higher level of transparency from companies and forces them to be accountable for the information they collect as well as what they do with it.

For companies, CCPA compliance provides a greater competitive advantage. It allows them to cast a wider net and attract consumers who are more likely to gravitate toward companies that give them more privacy.

Companies that implement CCPA privacy compliance measures also tend to have more robust security and risk management controls to protect them from privacy risk

CCPA differs from GDPR in that its privacy regulations cover residents in the state of California within the United States. The GDPR covers citizens of the European Union (EU). Moreover, while both laws are similar in their fundamental approach — namely, that individuals have certain rights over their personal data — the exact rights that each law offers are somewhat different.

The maximum fine for CCPA non-compliance is $7,500 for each violation.