CCPA/CPRA

The California Consumer Privacy Act applies to for-profit businesses that do business in California and meet thresholds based on annual revenue, the volume of consumers' personal information handled, or the share of revenue derived from selling or sharing it; the thresholds are adjusted over time. The California Privacy Rights Act amended it, created the California Privacy Protection Agency and added the category of sensitive personal information.

Consumers have rights to know, access, delete and correct their information, to opt out of its sale or sharing for cross-context behavioural advertising, and to limit the use of sensitive information. Businesses must give notice at collection, honour opt-out preference signals, and bind service providers and contractors by contract. Regulations also address risk assessments, cybersecurity audits and automated decision-making technology.

Unlike the GDPR and LGPD, the CCPA does not require a lawful basis for every processing activity; it relies on notice and opt-out. Example: an online retailer adds a "Do Not Sell or Share My Personal Information" link and answers verifiable consumer requests within the statutory timeframe.