Become CCPA Compliant

The California Consumer Privacy Act of 2018 (CCPA) gives consumers more control over the personal information that businesses collect about them. Businesses are required to give consumers certain notices explaining their privacy practices.

This landmark law secures new privacy rights for California consumers, including:

  • The right to know about the personal information a business collects about them and how it is used and shared;
  • The right to delete personal information collected from them (with some exceptions);
  • The right to opt-out of the sale of their personal information; and
  • The right to non-discrimination for exercising their CCPA rights.


We can affordably help bring your website into compliance within just a few days. Get in touch with us to find out more about how we can help.

Businesses are required to give consumers certain notices explaining their privacy practices.

Frequently Asked Questions

The California Consumer Privacy Act (CCPA) is the first comprehensive privacy law in United States. It was signed into law at the end of June 2018 and provides a variety of privacy rights to California consumers. Businesses regulated by the CCPA will have a number of obligations to those consumers, including disclosures, General Data Protection Regulation (GDPR)-like rights for consumers, an “opt-out” for certain data transfers and an “opt-in” requirement for minors.

The CCPA goes into effect on January 1, 2020. However, enforcement by the Attorney General (AG) will not begin until July 1, 2020.

Many of the CCPA’s rights afforded to Californians are similar to the rights the GDPR provides, including the disclosure and consumer requests similar to data subject right (DSR) requests, such as access, deletion, and portability. As such, customer can look to our existing GDPR solutions to help them with their CCPA compliance.

To begin your CCPA journey, you should focus on five key steps:

  • Discover: Identify what Personal Information you have and where it resides.
  • Map: Determine how you are sharing Personal Information with third parties and identify if the third party is subject to an exception from the CCPA opt-out requirements.
  • Manage: Govern how the data is used and accessed.
  • Protect: Establish security controls to prevent, detect, and respond to vulnerabilities and data breaches.
  • Document: Document a data breach response program and ensure your contracts with applicable third parties are able to take advantage of the opt-out exceptions.

You need to understand what your organization’s specific obligations are under the CCPA and how you meet them, though Microsoft is here to help you on your journey.

The CCPA requires regulated businesses that collect, use, transfer, and sell personal information to, among other things:

  • Provide disclosures to consumers, prior to collection, regarding the categories and purposes of collection.
  • Provide detailed disclosures in a privacy policy regarding the sources, business purposes, and categories of personal information that is collected, including how those categories are sold or transferred to other entities.
  • Enable Consumer rights relating to access, deletion, and portability of the specific pieces of personal information that has been collected by you.
  • Enable a control that will permit consumers to opt out of the “sale” of the consumer’s data. However, certain transfers, like transfers to service providers, remain permitted.
  • For minors, under 16, enable an opt-in process so that no sale of the minor’s personal information can occur without actively opting in to the sale.
  • Ensure that consumers are not discriminated against for exercising any of their rights under CCPA.

The CCPA requires disclosure of the following:

  • Categories of personal information of the consumer that have been collected.
  • Categories of sources used in collection.
  • The business or commercial purposes for collecting.
  • The categories of third parties with whom the personal information is “shared”.
  • Categories of personal information that has been “sold” and the categories of “third parties” to whom each category of personal information was sold.
  • Categories of personal information that has been “disclosed for a business purpose” (that is, transferred but not a “sale”) and the categories of “third parties” to whom each category of personal information was transferred.
  • The specific pieces of personal information that has been collected about that consumer.

The definition of “sell” in the CCPA is incredibly broad, including “making personal information available to” a third party for monetary or other valuable consideration. Where a consumer has elected to “opt-out”, the business will be required to turn off the flow of personal information to any third party.

The CCPA does provide a number of carve-outs to this “sale” opt-out control. The three primary carve-outs are transfers (i) to a Service Provider, (ii) to an “exempted entity” or “contractor”, and (iii) at the direction of the consumer. Even if a consumer has elected to “opt-out”, personal information can continue to transfer to third parties who fit into those carve-outs.

To take advantage of the first two exemptions, businesses will have to ensure that the transfers are governed by written contracts containing the specific terms required by the CCPA.

In the context of CCPA, Businesses are individuals or entities that determine the purposes and means of the processing of consumer’s personal data, and Service Providers are individuals or entities that process information on behalf of a business. These are broadly synonymous with the terms Controllers and Processors used in GDPR.

The private right of action in the CCPA is limited to data breaches. Under the private right of action, damages can come in between $100 and $750 per incident per consumer. The California AG also can enforce the CCPA in its entirety with the ability to levy a civil penalty of not more than $2,500 per violation or $7,500 per intentional violation.

Personal information is any information relating to an identified or identifiable person. There is no distinction between a person’s private, public, or work roles. The defined term “personal information” roughly lines up with “personal data” under GDPR. However, CCPA also includes family and household data.

Examples of personal data include:


  • Name
  • Home address
  • Work address
  • Telephone number
  • Mobile number
  • Email address
  • Passport number
  • National ID card
  • Social Security Number (or equivalent)
  • Driver’s license
  • Physical, physiological, or genetic information
  • Medical information
  • Cultural identity


  • Bank details / account numbers
  • Tax file number
  • Credit/Debit card numbers
  • Social media posts

Online Artifacts

  • Social media posts
  • IP address (EU region)
  • Location / GPS data
  • Cookies
  • CCPA introduces parental consent obligations consistent with The Children’s Online Privacy Protection Act (COPPA) for children under the age of 13.
  • For children between 13 and 16 years old, CCPA imposes a new obligation to obtain opt-in consent from the child for any “sale” of their personal information.

In October 2019, a number of amendments were passed to the CCPA. One amendment clarified that the CCPA obligations do not apply to the personal information of employees of the business. However, legislators put a one-year sunset on that exemption. We expect California to legislate a new data protection law for employees in 2020.