Key Takeaways
- California’s Consumer Privacy Act (CCPA) gives residents meaningful new rights over how companies collect and sell their personal data. These include the right to access, delete and opt out of the sale of their personal information.
- The CCPA is widely expected to influence the development of future national privacy standards. However, the law is complex, includes numerous exceptions and is anticipated to face ongoing legal challenges.
- Consumers can take action now by looking for the “do not sell my data” option that companies are required to provide. Michelle Moore, PhD, and academic director of the MS-CSOL program, urges consumers to be proactive in contacting companies about their data privacy concerns.
SAN DIEGO, Calif. (Jan. 21, 2020) — Widespread concern about how companies are collecting and using people’s personal data has triggered game-changing initiatives to provide a check against the practice of selling your data for profit without your knowledge.
First it was the European Union’s General Data Protection Regulation (GDPR), which took effect in 2018. Now California has passed a law that aims to provide similar protections; the California Consumer Privacy Act (CCPA) went into effect on Jan. 1, 2020.
To help shed light on the new law and what it means for consumers, Michelle Moore of the University of San Diego cybersecurity master’s degree program joined host Allie Wagner for an appearance on KUSI’s “Good Morning San Diego.”
The biggest takeaway, said Moore, who is academic director of USD’s online Master of Science in Cyber Security Operations and Leadership, is that “consumers now have rights that they can act upon” when it comes to “companies that are selling their data.”
Under the new law, California consumers have the following rights, according to an overview developed by the Association of Corporate Counsel:
- To know what personal information is collected about them
- To know whether and to whom their personal information is sold/disclosed, and to opt-out of its sale
- To access their personal information that has been collected
- To have a business delete their personal information
- To not be discriminated against for exercising their rights under the Act (meaning businesses may not treat people differently, in terms of the provision of goods and services, pricing, etc., for opting out)
The CCPA is viewed as being likely to influence the development of future national standards for personal privacy protection. Observers assert that it is complex, includes numerous exceptions and is expected to draw legal challenges moving forward.
For consumers who are concerned about how their data is being used but feel overwhelmed by the enormity and complexity of what has been dubbed “surveillance capitalism,” Moore shared another helpful piece of advice.
Under the new law, companies are required to offer consumers a button or function that enables them to say, essentially, “do not sell my data.” She urged consumers to be proactive, contacting companies to get their questions answered and make their wishes known if they have concerns.
VIDEO: Watch the “Good Morning San Diego” interview
About the University of San Diego’s Cybersecurity Program
The University of San Diego offers two widely regarded cybersecurity master’s degree programs, the online Master of Science in Cyber Security Operations and Leadership and the Master of Science in Cyber Security Engineering, which is offered both on campus and online.
Designed in collaboration with key industry stakeholders to be an invaluable asset for career advancement in a dynamic, in-demand field, both programs offer cutting-edge curriculum taught by expert instructors with deep experience in the field. For more information about the University of San Diego’s online and on-campus cyber security master’s degree programs, please visit cybersecurity.sandiego.edu.
Media Contact
Name: Courtney Legoll
Company: University of San Diego
Phone Number: 619-260-2961
Email: [email protected]
frequently asked questions
What is the difference between the California’s Consumer Privacy Act and the California Privacy Rights Act (CPRA)?
The difference between the CCPA and the CPRA is that the CPRA is an amendment to the CCPA rather than a separate privacy law. California voters approved the California Privacy Rights Act in 2020, and its amendments to the CCPA generally took effect in 2023. The CPRA expanded consumer rights, added a category for sensitive personal information, modified the law’s applicability thresholds and established the California Privacy Protection Agency. Because the CPRA amended rather than replaced the CCPA, current requirements are generally discussed as the CCPA as amended by the CPRA and subsequent changes. Materials describing only the original 2020 version may not reflect current requirements.
What is the California Privacy Protection Agency?
The California Privacy Protection Agency (CPPA) is the state agency responsible for implementing and enforcing California’s consumer privacy law. Established by the CPRA, it was the first independent data protection authority in the United States. The agency has rulemaking, investigative and enforcement authority, meaning privacy requirements can evolve through regulations as well as through legislation. The California Attorney General also retains enforcement authority under the CCPA. For privacy professionals, understanding the CPPA’s regulations and enforcement activity is an important part of staying current with California privacy requirements.
Who does the CCPA apply to?
The CCPA generally applies to for-profit businesses that do business in California, collect California residents’ personal information and meet at least one of the law’s applicability thresholds. These include having annual gross revenue above the applicable threshold; buying, selling or sharing the personal information of at least 100,000 California consumers or households annually; or deriving at least 50% of annual revenue from selling or sharing California residents’ personal information. The revenue threshold is adjusted periodically, so businesses should verify the current amount rather than rely on older summaries. The law generally does not apply to government agencies or nonprofit organizations, and certain types of information are subject to other laws or exemptions.
What is considered personal information under the CCPA?
Personal information under the CCPA is defined broadly as information that identifies, relates to, describes or could reasonably be linked with a particular consumer or household. Examples include names and email addresses, internet activity, geolocation data, employment and education information, commercial and purchasing records, biometric information and inferences drawn about a person’s preferences or characteristics. The definition extends beyond information that directly identifies someone. Certain publicly available information, properly deidentified information and certain aggregated information are excluded when they meet the requirements of the law.
What is sensitive personal information under the CCPA?
Sensitive personal information is a category of personal information that receives additional protections under the CCPA. It can include government identification numbers, account log-in credentials, financial account information, precise geolocation, the contents of certain private communications, genetic data, biometric information used to identify someone, health information, information about a person’s sex life or sexual orientation and information about racial or ethnic origin, religious or philosophical beliefs or union membership. California consumers have the right to limit certain uses and disclosures of their sensitive personal information.
What happens if a business violates the CCPA?
A business that violates the CCPA can face administrative fines and other enforcement actions. The maximum administrative fine is adjusted periodically and, as of 2025, is up to $2,663 per violation or $7,988 for intentional violations and violations involving consumers under 16. The CCPA also provides a limited private right of action for certain data breaches involving nonencrypted or nonredacted personal information when a business failed to maintain reasonable security procedures and practices. Consumers may seek actual damages or statutory damages of up to $799 per consumer per incident, subject to the law’s requirements. The CCPA does not generally allow consumers to sue for every type of privacy violation.
