California Consumer Privacy Act (CCPA)

The California Consumer Privacy Act (CCPA) is a state privacy law giving California residents rights over the personal information businesses collect about them — to know what is held, to have it deleted or corrected, and to opt out of its sale or sharing. It took effect on 1 January 2020 and was substantially expanded by the California Privacy Rights Act (CPRA), whose amendments took effect on 1 January 2023.

Most references to “the CCPA” today mean the combined statute as amended. The CPRA did not replace it; it rewrote large parts of it and created a dedicated regulator to enforce the result.

Who the CCPA applies to

The law reaches for-profit entities doing business in California that meet at least one threshold: annual gross revenue above $25 million (adjusted periodically for inflation), buying, selling or sharing the personal information of 100,000 or more consumers or households, or deriving 50% or more of annual revenue from selling or sharing personal information.

Two features catch organizations out. There is no requirement to have a California office — doing business with California residents is enough. And “consumer” means any California resident, not only a customer, so employees and business contacts are inside scope.

The CPRA also introduced sensitive personal information as a distinct category with its own restrictions. It includes government identifiers such as Social Security, driver’s license, state ID and passport numbers; account credentials; precise geolocation; racial or ethnic origin; health data; and biometric information processed for the purpose of uniquely identifying a person. Consumers have a right to limit how sensitive information is used and disclosed, separate from the right to delete it.

Why it matters for identity verification

Identity verification sits inside the most regulated category the statute defines. A verification flow that captures a driver’s license and a face image is handling two kinds of sensitive personal information at once — a government identifier and biometric data used to identify a person. Whatever a business does with ordinary customer data, this data carries the additional obligations.

The more interesting problem runs the other way. The CCPA requires a business to respond to a verifiable consumer request, which means it must confirm the requester is the person whose data they are asking about before acting. That is an identity verification decision with an error on each side:

• Verify too loosely and a stranger can obtain a copy of somebody’s personal file, or delete their account, using a compliance process as the attack path. A disclosure made to the wrong person is a breach.
• Verify too tightly and the business obstructs a legal right, and collects more personal data to process the request than it held to begin with.

Regulators expect the verification standard to scale with the sensitivity of what is requested — a deletion or a full data export warrants more confidence than a category-level disclosure. This is the same risk-tiering logic used in risk-based authentication, applied to a privacy obligation rather than a login.

CCPA compared with GDPR

The structural difference is the one to hold on to. GDPR asks what permits you to process at all; the CCPA assumes you may, and gives the consumer levers to stop you. A program built for one does not automatically satisfy the other, though the operational work — knowing what you hold, where it sits, and how to retrieve or delete it — is largely shared.

What the CCPA does not do

It is not a national law. Other states have enacted their own regimes with different thresholds, definitions and cure periods. A business operating across the United States is complying with a set of overlapping statutes, not one.

It does not create a general right to sue. The private right of action is narrow: it covers breaches of certain unencrypted and unredacted personal information caused by a failure to maintain reasonable security. Everything else is enforced by regulators.

It does not override retention obligations elsewhere. A deletion request does not defeat a record the business is legally required to keep — identity records retained under KYC rules being the common example. The exemption is narrow and specific, not a general escape.

Frequently asked questions

What is the difference between CCPA and CPRA?

The CPRA is an amendment, not a separate law. It expanded the original CCPA — adding the right to correct, creating the sensitive personal information category and the right to limit its use, covering “sharing” as well as selling, and establishing the CPPA as a dedicated regulator. Its provisions took effect on 1 January 2023.

Does the CCPA apply to businesses outside California?

Yes, if they do business in California and meet one of the thresholds. Physical presence in the state is not required — collecting personal information from California residents is enough to bring a business into scope.

Is biometric data covered by the CCPA?

Yes. Biometric information processed to uniquely identify a consumer is sensitive personal information under the CPRA amendments, which gives consumers the right to limit its use and disclosure in addition to the other rights that apply to personal information generally.

How should a business verify a consumer request?

To a standard proportionate to the request. A request to delete an account or export a full record justifies stronger evidence than a request for the categories of data held. The statute does not prescribe a method, but it does require the business to avoid disclosing personal information to someone who is not the consumer.

Related reading

• GDPR — the EU regime the CCPA is most often compared against
• Personally identifiable information — what counts as personal data and why the definitions differ
• Compliance — how privacy obligations sit alongside financial crime rules
• Know your customer — the retention duty that interacts with deletion rights