CCPA

CCPA, the California Consumer Privacy Act as expanded by the CPRA, is California's state level consumer privacy law that gives residents rights over their personal data and requires covered businesses to know where that data lives and how it moves through their systems.

CCPA gives California residents a defined set of rights over the personal information businesses hold about them: the right to know what has been collected and how it is used and shared, the right to delete it, the right to opt out of its sale or sharing, the right to correct inaccurate information, and the right to limit use of more sensitive categories of personal information. The CPRA amendment expanded several of these rights and created a dedicated state agency to enforce them, bringing California's law closer in spirit to comprehensive privacy regimes elsewhere in the world.

Answering a CCPA request in practice requires more than a privacy policy. A business has to be able to trace a specific person's data through every system that touched it: the application database it was collected in, any warehouse or analytics platform it moved to, any pipeline that transformed it, and any established application or third party integration it was shared with. Businesses that cannot answer that question completely risk responding to requests incompletely, which is itself a compliance gap. CCPA has also functioned as a template. Since it passed, several other states have enacted their own comprehensive consumer privacy laws that follow a broadly similar structure, giving residents rights to know, delete, and opt out of certain uses of their data, which means the operational bar CCPA set is becoming a baseline rather than an exception.

How CCPA Relates to Adjacent Terms

GDPR is the broader EU counterpart, with its own distinct set of rights and a different legal basis for enforcement, though both share the same underlying requirement to know what personal data you hold and where it moves. Personally identifiable information is the data category CCPA protects. And data discovery is the practical technical work of locating that personal information across systems in the first place, which has to happen before any CCPA request can be answered accurately.

What CCPA Compliance Demands From Data Teams

For a governance and compliance leader, a CCPA deletion or access request is a direct test of whether the organization's map of its own data is real or aspirational. A gap between what a spreadsheet says about where personal data lives and what the code actually does creates regulatory exposure the moment a request comes in. Closing that gap takes the technical visibility, lineage, and dependency knowledge that source code analysis provides to trace personal data end to end, through application code, established systems, and pipelines, producing documentation that holds up when a regulator or a consumer's request asks the organization to prove its answer, not just state it.

Related Terms

• GDPR
• Personally identifiable information
• Data discovery

Frequently Asked Questions

What's the difference between CCPA and GDPR?

CCPA is a California state law, while GDPR is an EU wide regulation, and they define personal data, rights, and enforcement somewhat differently. CCPA centers on the right to know, delete, and opt out of the sale or sharing of personal information, while GDPR adds requirements like a documented lawful basis for every use of data. In practice, both require the same underlying capability: knowing where personal data lives and how it moves through your systems.

Do other US states have laws like CCPA?

Yes. Since CCPA passed, a growing number of other states have enacted their own comprehensive consumer privacy laws that follow a broadly similar model, giving residents rights to know, delete, and opt out of certain data practices. The specifics vary by state, but the operational requirement is consistent: businesses need to know what personal data they hold and be able to act on it accurately.

What does CCPA require if a customer asks us to delete their data?

A qualifying deletion request generally requires a business to delete the requestor's personal information from its own records and direct any service providers holding that data to do the same, subject to certain legal exceptions. Doing this correctly depends on knowing every system that holds a copy of that person's data, which is often harder than it sounds once data has moved through pipelines, backups, and downstream applications.