A Simple Guide to the CCPA for Small Business

Introduction

If you have customers in the United States, you've likely heard of the GDPR. But there's another major privacy law you absolutely need to know: the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). As the most comprehensive state-level privacy law in the U.S., the CCPA sets the standard for how businesses handle the personal information of California residents.

Ignoring the CCPA is not an option, even if your business isn't located in California. The law has a broad reach and non-compliance can lead to significant fines. This guide will break down the essentials of the CCPA in simple terms, helping you understand your obligations and the steps you need to take to become compliant.

Who Does the CCPA Apply To?

The CCPA applies to any for-profit business that collects personal information from California residents and meets at least one of the following criteria:

• Has an annual gross revenue of over $25 million.

  
  

• Buys, sells, or shares the personal information of 100,000 or more California consumers or households.

  
  

• Derives 50% or more of its annual revenue from selling or sharing California consumers' personal information.

Even if you don't meet these thresholds now, understanding the law is crucial as your business grows.

What Are the Key Consumer Rights Under CCPA?

The CCPA grants California consumers several fundamental rights over their data:

• The Right to Know: Consumers can request to know what personal information you have collected about them, where you got it, and why you are using it.

  
  

• The Right to Delete: Consumers can request that you delete their personal information.

  
  

• The Right to Opt-Out: Consumers have the right to direct you not to "sell" or "share" their personal information.

  
  

• The Right to Correct: Consumers can request that you correct inaccurate personal information.

  
  

• The Right to Limit Use of Sensitive Information: Consumers can limit your use of their "sensitive" personal information (like health data or precise geolocation).

  
  

The "Do Not Sell or Share" Requirement

This is one of the most visible requirements of the CCPA. You must provide a clear and conspicuous link on your website's homepage titled "Do Not Sell or Share My Personal Information." This link must lead to a page where consumers can easily opt-out of the sale or sharing of their data, which is often used for targeted advertising.

Practical Steps for CCPA Compliance

1. Update Your Privacy Policy: Your policy needs a specific section for California residents that details their CCPA rights and explains how to exercise them.

   
   

2. Implement the "Do Not Sell or Share" Link: Place this link in your website footer.

   
   

3. Establish a Process for Handling Requests: You need a reliable way to receive and fulfill consumer rights requests within the legally required timeframe (typically 45 days).

   
   

4. Review Your Data Practices: Understand what data you're collecting from California residents and who you are sharing it with (e.g., marketing platforms, analytics tools).