ccpa

CCPA applies to for-profit businesses doing business in California that meet at least one threshold: over $25 million in annual gross revenue, buying/selling/sharing PI of 100,000 or more consumers or households, or deriving 50% or more of revenue from selling or sharing personal information.

Verify the consumer's identity, check whether any statutory exception applies, then delete the PI and direct service providers and contractors to delete it. Confirm the outcome to the consumer within 45 days, extendable once by 45 days with notice.

A service provider processes PI on behalf of the business under a written contract prohibiting other uses, so the disclosure is not a sale. A third party receives PI without those contractual restrictions, which may constitute a sale or sharing requiring opt-out coverage.

Yes, businesses must honor the Global Privacy Control (GPC) signal as a valid opt-out of sale and sharing, equivalent to clicking the "Do Not Sell or Share My Personal Information" link. No identity verification is required beyond confirming the requester is the consumer.

GDPR is generally stricter and covers most CCPA obligations, but CCPA adds specific requirements: the Do Not Sell or Share link, GPC signal handling, SPI limitation links, notice at collection, minors' opt-in for sale/sharing, and service provider contract terms under §1798.100(d).

Civil penalties reach $2,500 per unintentional violation and $7,500 per intentional violation or violations involving minors. The private right of action is limited to data breaches, with statutory damages of $100–$750 per consumer per incident.