What is the CCPA (California Consumer Privacy Act)?

The CCPA (California Consumer Privacy Act, effective 2020) grants California residents rights over their personal information and imposes obligations on businesses that collect it. Unlike GDPR's focus on consent for processing, CCPA emphasizes the right to opt out of the sale of personal information and the right to know what data businesses collect.

CCPA applies to for-profit businesses that meet thresholds: annual gross revenue over $25 million, or buying/receiving/selling personal information of 100,000+ California residents, households, or devices, or deriving 50%+ of annual revenue from selling California residents' personal information. Many businesses handling email lists meet these thresholds.

Key provisions include: right to know what personal information is collected and how it's used, right to delete personal information, right to opt-out of the sale of personal information, and right to non-discrimination for exercising CCPA rights. The amended CPRA (California Privacy Rights Act) strengthened these provisions. CCPA doesn't require consent for email marketing specifically, but it does require honoring data rights-including deletion requests that affect email lists.