# CCPA Requirements

## Overview

The California Consumer Privacy Act (CCPA) is a comprehensive privacy law that grants California residents rights over their personal information. CCPA applies to businesses that meet certain thresholds and process personal information of California residents.

## Applicability

### Business Thresholds
- Annual gross revenues exceeding $25 million
- Annually buys, receives, sells, or shares personal information of 50,000+ consumers, households, or devices
- Derives 50%+ of annual revenues from selling consumers' personal information

### Personal Information Definition
- Information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to a particular consumer or household
- Includes identifiers, characteristics, commercial information, biometric information, internet activity, geolocation data, audio/visual information, professional information, education information, and inferences

## Consumer Rights

### Right to Know
- Right to know what personal information is collected
- Right to know categories of sources
- Right to know business purposes
- Right to know categories of third parties
- Right to know specific pieces of personal information

### Right to Delete
- Request deletion of personal information
- Exceptions apply (legal obligations, transactions, security, etc.)
- Verify consumer identity
- Respond within 45 days (extendable to 90 days)

### Right to Opt-Out of Sale
- Right to opt-out of sale of personal information
- "Do Not Sell My Personal Information" link
- Clear and conspicuous opt-out mechanism
- Honor opt-out requests

### Right to Non-Discrimination
- Cannot discriminate for exercising rights
- Cannot deny goods or services
- Cannot charge different prices
- Cannot provide different quality
- Exceptions: price differences based on value of data

### Right to Opt-In (Minors)
- Minors under 16: opt-in required
- Minors under 13: parental consent required
- Cannot sell personal information without consent

## Notice Requirements

### Privacy Policy
- Comprehensive privacy policy
- Categories of personal information collected
- Categories of sources
- Business purposes
- Categories of third parties
- Consumer rights and how to exercise
- Contact information

### Notice at Collection
- Categories of personal information collected
- Business purposes
- Link to privacy policy
- "Do Not Sell My Personal Information" link (if applicable)

### Notice of Financial Incentive
- Material terms of financial incentive
- Value of consumer data
- How to opt-in
- Right to withdraw

## Sale of Personal Information

### Definition of Sale
- Selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating personal information
- For monetary or other valuable consideration
- To another business or third party

### Opt-Out Requirements
- "Do Not Sell My Personal Information" link
- Clear and conspicuous placement
- Easy to use opt-out mechanism
- Honor opt-out requests
- No opt-in required after opt-out

### Service Provider Exception
- Not a sale if disclosed to service provider
- Service provider contract required
- Limited to business purposes
- Cannot use for other purposes

## Service Providers

### Definition
- Business that processes personal information on behalf of business
- Under written contract
- For business purposes only
- Cannot use for other purposes

### Service Provider Contracts
- Prohibit selling personal information
- Prohibit using for other purposes
- Require appropriate safeguards
- Require deletion upon request

## Verification

### Identity Verification
- Verify consumer identity
- Reasonable verification methods
- Cannot require account creation
- Cannot charge fee for verification

### Authorized Agent
- Accept requests from authorized agents
- Verify agent authorization
- Verify consumer identity
- Provide proof of authorization

## Response Requirements

### Response Time
- Acknowledge receipt within 10 business days
- Respond within 45 calendar days
- May extend to 90 calendar days with notice
- Provide explanation for extension

### Response Format
- Deliverable format
- Portable format (if requested)
- No account creation required
- No fee for first request

## Data Minimization

### Collection Limitation
- Collect only necessary personal information
- Limit to disclosed purposes
- Do not collect excessive information
- Regular review of collection practices

### Retention Limitation
- Retain only as long as necessary
- Define retention periods
- Implement deletion procedures
- Regular data purging

## Security Requirements

### Reasonable Security
- Implement reasonable security procedures
- Protect against unauthorized access
- Protect against destruction
- Protect against use
- Protect against disclosure
- Protect against modification

### Security Measures
- Encryption
- Access controls
- Authentication
- Monitoring
- Incident response
- Regular security assessments

## Employee and B2B Exemptions

### Employee Information
- Limited exemptions for employee information
- Notice at collection required
- Right to know (limited)
- Right to delete (limited)
- No right to opt-out of sale

### B2B Information
- Limited exemptions for B2B information
- Notice at collection required
- Right to know (limited)
- Right to delete (limited)
- No right to opt-out of sale

## Compliance Checklist

### Consumer Rights
- [ ] Implement right to know procedures
- [ ] Implement right to delete procedures
- [ ] Implement right to opt-out procedures
- [ ] Implement right to non-discrimination
- [ ] Implement minor opt-in procedures

### Notice Requirements
- [ ] Develop comprehensive privacy policy
- [ ] Implement notice at collection
- [ ] Implement notice of financial incentive
- [ ] Update notices regularly

### Opt-Out Mechanism
- [ ] Implement "Do Not Sell" link
- [ ] Make link clear and conspicuous
- [ ] Honor opt-out requests
- [ ] Maintain opt-out list

### Verification
- [ ] Implement identity verification
- [ ] Accept authorized agent requests
- [ ] Verify agent authorization
- [ ] Document verification procedures

### Response Procedures
- [ ] Acknowledge requests within 10 days
- [ ] Respond within 45 days
- [ ] Provide information in deliverable format
- [ ] Document all requests and responses

### Service Provider Management
- [ ] Identify all service providers
- [ ] Execute service provider contracts
- [ ] Monitor service provider compliance
- [ ] Ensure service providers do not sell data

### Security
- [ ] Implement reasonable security measures
- [ ] Encrypt personal information
- [ ] Implement access controls
- [ ] Monitor for security incidents
- [ ] Develop incident response procedures

## Best Practices

1. **Map Personal Information**: Understand what personal information you collect
2. **Implement Consumer Rights**: Make it easy to exercise rights
3. **Clear Notices**: Provide clear and comprehensive privacy notices
4. **Honor Opt-Outs**: Respect consumer opt-out requests
5. **Verify Identity**: Implement reasonable verification procedures
6. **Respond Promptly**: Meet response time requirements
7. **Manage Service Providers**: Execute and monitor contracts
8. **Implement Security**: Protect personal information
9. **Train Staff**: Ensure staff understand CCPA requirements
10. **Document Everything**: Maintain comprehensive documentation

## Common Pitfalls

1. **Insufficient Notices**: Not providing comprehensive privacy notices
2. **Poor Opt-Out Mechanism**: Difficult to find or use opt-out
3. **Delayed Responses**: Not meeting response time requirements
4. **Inadequate Verification**: Not verifying consumer identity
5. **Service Provider Issues**: Not properly managing service providers
6. **Insufficient Security**: Not implementing reasonable security measures
7. **Discrimination**: Discriminating against consumers exercising rights
8. **Inadequate Documentation**: Not documenting requests and responses
9. **Collection Issues**: Collecting excessive personal information
10. **Retention Issues**: Retaining personal information too long

