Contractor agreements must also include a certification of CCPA compliance. The CCPA requires written agreements with service providers and contractors that specify the business purpose for data processing, prohibit selling or sharing the data, restrict use to contracted purposes, require cooperation with consumer requests, and include data retention and deletion terms. If your business sells or shares personal information with third parties (including sharing data for targeted advertising), you must post a clear, conspicuous ‘Do Not Sell or Share My Personal Information’ link on your homepage. The policy must reflect any changes in data collection practices, consumer rights processes, or categories of personal information collected, sold, or shared during the preceding year.
This requires efficient systems, as outlined in compliance resources like Osano’s CPRA Checklist. Businesses must establish processes to handle these requests within 45 days, with a possible 45-day extension for complex cases. Businesses must first determine applicability to ensure compliance efforts are focused appropriately. Both CCPA and CPRA apply to businesses meeting specific thresholds, ensuring only significant data handlers are covered. The California Privacy Rights Act (CPRA), approved in November 2020 and effective from January 2023, amends and expands CCPA, introducing additional protections and establishing the California Privacy Protection Agency (CPPA) for enforcement. Our repository reflects 2025 updates, including the https://influencemarketingnews.com/privacy-laws-and-influencer-marketing/ latest California Privacy Protection Agency (CPPA) regulations on automated decision-making and data broker compliance, ensuring alignment with current standards.
Disclose whether you sell or share data and with which third parties (advertisers, analytics providers). California may issue new rules or FAQs (the CPPA is expected to release additional guidance throughout 2026). Compliance isn’t “set and forget.” Conduct periodic internal audits to ensure policies and procedures are followed. Review every third-party vendor or service that processes California consumers’ data. Establish dedicated channels for Data Subject Access Requests, secure verification processes, and workflows for retrieving and delivering data within 45-day timelines. Design systems to detect and honor Global Privacy Control (GPC) signals as valid opt-out requests.
The California Privacy Protection Agency is currently engaged in a formal rulemaking process and has proposed CCPA regulations pertaining to the right to limit, but these are not currently final or effective. Learn more about debt collectors—including what they can and can’t do—here. Businesses may need to ask you for additional information for verification purposes. It is the business that is responsible for responding to consumer requests.
- The CCPA requires specific contractual terms with every entity that processes personal information on your behalf.
- It is the business that is responsible for responding to consumer requests.
- This requires efficient systems, as outlined in compliance resources like Osano’s CPRA Checklist.
- The rulemaking process included hosting multiple hearings and reviewing hundreds of public comments, all of which were carefully considered by the CPPA Board prior to adopting the regulations.
- Personal information does not include publicly available information (including public real estate/property records) and certain types of information.
Why CCPA Compliance Is Now a Strategic Business Imperative
Personal information does not include publicly available information that is from federal, state, or local government records, such as professional licenses and https://madeintexas.net/accounting-services-in-poland.html public real estate/property records. Consumers have the right to also limit a business’s use and disclosure of their sensitive personal information. Businesses that are subject to the CCPA have several responsibilities, including responding to consumer requests to exercise these rights and giving consumers certain notices explaining their privacy practices. Businesses that use ADMT to make significant decisions must comply with the ADMT requirements beginning January 1, 2027. I’m deeply grateful to our team and to members of the public whose contributions helped to shape these regulations,” said Jennifer Urban, Chair of the California Privacy Protection Agency Board.
- For HR departments, employee personal information includes names, addresses, social security numbers, performance reviews, disciplinary records, compensation information, benefits data, background check results, and job application materials.
- However, there is additional time for businesses to comply with some of the new requirements, namely cybersecurity audits, risk assessments, and requirements for automated decisionmaking technologies.
- CPRA (effective Jan. 1, 2023) strengthened consumer rights by adding a right to correct inaccurate personal information and a right to limit use of sensitive personal data.
- Nonprofit organizations or government agencies are often exempt from certain CCPA compliance regulations.
Sensitive personal information
CCPA compliance requires cross-functional coordination across legal, IT, security, HR, and marketing. Automated redaction tools use AI to identify sensitive information across 40+ categories and provide audit trails documenting what was redacted, when, by whom, and under what authority. Effective redaction permanently removes sensitive data from the document file structure, including visible text, hidden layers, metadata, and embedded objects. Redact client financial information when sharing case files with expert witnesses. Redact financial information when escalating to third-party vendors. Redacting sensitive information in non-production environments, shared documents, and archived records substantially reduces this exposure.
CPRA distinguishes between “service providers” (processing data on behalf of businesses, similar to GDPR data processors) and “contractors” (a broader category including affiliates). Privacy automation tools can auto-collect and compile personal data from cloud systems, speeding responses. For deletions, permanently remove data (not “soft-delete”) from all systems, including backups. Use ticketing systems or specialized DSAR tools for tracking.
Right to correct inaccurate information
A company that retargets ads to 75,000 California residents and shares behavioral data with advertising partners for 30,000 additional residents has crossed the 100,000 threshold. CCPA compliance means implementing systems, policies, and procedures to meet statutory obligations for collecting, processing, sharing, and securing California residents’ personal information. Document your training program, including who was trained, when, and on what topics. The CCPA requires specific contractual terms with every entity that processes personal information on your behalf. The CPRA amendments (effective January 1, 2023) and 2026 regulatory updates added further requirements around sensitive personal information, risk assessments, cybersecurity audits, and automated decisionmaking technology (ADMT). Businesses that meet the law’s applicability thresholds must build operational processes for handling consumer requests, managing vendor relationships, and documenting data practices.
- Automated consumer request management platforms reduce both compliance risk and operational cost, handling requests systematically within mandated timeframes while maintaining required documentation.
- CCPA regulations continue to evolve, and requirements may change.
- Data brokers collect information about consumers from many sources including websites, other businesses, and public records.
- A company that retargets ads to 75,000 California residents and shares behavioral data with advertising partners for 30,000 additional residents has crossed the 100,000 threshold.
Provide instructions for exercising rights and ensure notices are accessible on all platforms. Businesses must disclose SPI collection and allow consumers to limit its use. Implementing comprehensive CCPA compliance requires systematic approach and ongoing attention. This comprehensive article ensures businesses can navigate CCPA and CPRA compliance effectively.
Before suing, you must give the business written notice of which CCPA sections it violated and allow 30 days to respond in writing that it has cured the violations and that no further violations will occur. You can only sue a business under the CCPA if there is a data breach, and even then, only under limited circumstances. In November of 2020, California voters approved Proposition 24, the CPRA, which amended the CCPA and added new additional privacy protections that began on January 1, 2023.