The California Consumer Privacy Act (CCPA) is the strongest consumer privacy law in the United States. Even if you don't live in California, it's changed how many companies handle data nationally, and understanding your rights under it helps you exercise them.
What the CCPA Is
The CCPA went into effect January 1, 2020, and was strengthened by Proposition 24 (the CPRA) in 2023. It applies to for-profit businesses that collect personal information from California residents and meet at least one of these thresholds: annual gross revenue over $25 million, buying/selling/sharing the personal information of 100,000 or more consumers annually, or deriving 50% or more of annual revenue from selling consumers' personal information.
This covers most major data brokers and technology companies.
Your Rights Under CCPA
Right to Know. You can request a list of all personal information a company has collected about you, where it came from, what categories of third parties it's been shared with, and the business purpose for collecting it. Companies must respond within 45 days.
Right to Delete. You can request that a company delete personal information it has collected about you. There are exceptions (completing transactions, security purposes, legal obligations), but this right is meaningful for data broker opt-outs.
Right to Opt Out of Sale. You can tell companies not to sell your personal information to third parties. Covered companies must display a "Do Not Sell or Share My Personal Information" link on their website.
Right to Correct. Added by CPRA, you can request that a company correct inaccurate personal information it holds about you.
Right to Non-Discrimination. Companies cannot deny you services, charge you a different price, or provide lower-quality service because you exercised your privacy rights.
How to Exercise These Rights
Look for a "Do Not Sell or Share My Personal Information" link in the footer of any website. For data brokers, this is the starting point for opt-out requests. You can also submit a written request directly to a company's privacy contact (required to be listed in their privacy policy).
If You're Not in California
Many companies apply CCPA rights nationally because managing state-by-state compliance is complex. Additionally, other states have passed similar laws: Colorado (CPA), Virginia (VCDPA), Connecticut (CTDPA), and Utah (UCPA) all have privacy laws with similar opt-out rights. Check if your state has a privacy law at iapp.org/resources/article/us-state-privacy-legislation-tracker.
The Limits of CCPA
CCPA has real enforcement gaps. The California Privacy Protection Agency (CPPA) has limited enforcement capacity. Many small and mid-sized data brokers don't comply fully. Your rights are meaningful tools but require you to actively exercise them — they're not self-executing.