\u201cInformation<\/em> that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.\u201d<\/em><\/p>\n\n\n\n According to the CCPA, person information is a broad category<\/strong>\u00a0of all kinds of data ranging from the most straight-forward and intuitive personal data to things that might not at first sight seem like personal data at all.<\/p>\n\n\n\n A list of what is defined under the CCPA as personal information includes:<\/p>\n\n\n\n In the CCPA<\/a>, personal information has no format or medium limitation<\/strong>, which means that even pictures<\/strong> or sounds<\/strong> can qualify as personal information, if they fall under the definition in the law.<\/p>\n\n\n\n However, the definition in CCPA of personal information does not include de-identified\/anonymized information<\/strong>, as well as aggregate information<\/strong>\u00a0(i.e. information about multiple users that does not contain personally identifiable information) \u2013 with the exception of household data, which we\u2019ll look at in a minute.<\/p>\n\n\n\n Under the CCPA, personal information has no format or medium restrictions, which means that additional privacy practices and requirements can extend to<\/strong> pictures,\u00a0 sounds, or other data sources if they fall under the personal information definition under the law.<\/strong>\u00a0<\/p>\n\n\n\n The California Consumer Privacy Act (CCPA) is a state-level data privacy regulation in the United States that empowers consumers with more control over how their personal information is used by commercial entities. CCPA requirements<\/a> guide how organizations need to comply with the law.<\/p>\n\n\n\n Consumers\u2019 privacy rights included under the CCPA are:<\/p>\n\n\n\n Of note is that prior consent needs to be obtained from a parent or guardian before collecting or processing the data of known children (under 16 years of age). Additional rights were also introduced with the California Privacy Rights Act (CPRA)<\/a> in 2023, so it is important to be up to date on those as well for fully regulatory compliance.<\/p>\n\n\n\n The California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) that expanded and amended the CCPA, are two important regulations that impact how businesses handle the personal information of residents of California.<\/p>\n\n\n\n The CCPA, which went into effect on January 1, 2020, is designed to give California residents more control over their digital privacy and personal data. The law requires businesses to disclose what personal information they collect, how it is used, and to provide consumers with the ability to opt-out of the sale of their personal information.<\/p>\n\n\n\n The CPRA, which was approved by California voters in November 2020, builds upon the CCPA and expands privacy rights for consumers. It includes new requirements for businesses, such as providing consumers with the right to correct inaccurate personal information and limiting businesses' use of sensitive personal information.<\/p>\n\n\n\n The CCPA was in effect when the CPRA was passed, and enforcement of the latter also began in March 2024. The California Privacy Protection Agency (CPPA) is now the enforcement authority, taking over from the California Attorney General\u2019s office.<\/p>\n\n\n\n The California Privacy Rights Act (CPRA)<\/a> was passed in the general election on November 3, 2020.\u00a0<\/p>\n\n\n\n The CPRA amends and expands the existing data privacy regime under the CCPA, giving new rights to California residents, strengthening business requirements and creating a whole new government agency responsible for enforcement.<\/p>\n\n\n\n The California Privacy Rights Act (CPRA) came into effect on January 1, 2023, with a look-back period to January 2022. Enforcement was initially supposed to begin on July 1, 2023, but was delayed due to legal challenges. Enforcement began after that was resolved, on March 29, 2024.<\/p>\n\n\n\n Using data (that is in itself not personal data) to draw inferences for the purpose of creating profiles<\/strong> on consumers, consisting of consumer behavior, convictions, preferences, intelligence, abilities and characteristics can be considered by CCPA as personal information<\/strong>.<\/p>\n\n\n\n This expansive definition in the CCPA of PII is a crucial leap for US data privacy, because it directly relates to the billion-dollar ad tech industry of behavioral advertisement based on personal data collection that studies show Americans are worried about and want regulated<\/a>.<\/p>\n\n\n\n It means that using e.g. cookies<\/strong>, web beacons<\/strong> and social media plugins<\/strong> on your website can be a liability under the CCPA, if you or third parties either directly collect personal information through such means, or if you or third parties collect data that can be used to create identifiable profiles for the purpose of personalized advertisement.<\/p>\n\n\n\n What does the CCPA say about cookies?<\/a><\/p>\n\n\n\n In other words, if data has the potential<\/em> to ultimately result in the identification of an individual, it can be deemed personal information<\/strong> under the CCPA, since the law defines personal information as \u201creasonably capable<\/strong>\"<\/em> of being linked to an individual or a household.<\/p>\n\n\n\n In more words, CCPA\u2019s personal information<\/strong> definition includes not only data that identifies, but data that makes the identification possible<\/strong>.<\/p>\n\n\n\n This includes website cookies<\/strong>, browser history<\/strong> and website analytics<\/strong>, such as monitoring user behavior on a domain (how long their mouse hovers on what, scroll speed, clicks and more), since these could, through combination and inference, lead to the identification of an individual.<\/p>\n\n\n\n In the CCPA<\/a>, personal information also covers a subgroup of data called household information<\/strong>.<\/p>\n\n\n\n Household information<\/strong> has been discussed vigorously since the CCPA passed into law and criticized for its ambivalent nature.<\/p>\n\n\n\n The CCPA\u2019s personal information definition does not further specify what household data means or how it should be enforced.<\/p>\n\n\n\n However, the final CCPA regulations <\/a>define household as:<\/p>\n\n\n\n \u201da person or group of people who reside at the same address, share a common device or the same service provided by a business and are identified by the business as sharing the same group account or unique identifier.\u201d<\/em><\/p>\n\n\n\n Learn more about the final CCPA regulations and enforcement<\/a><\/p>\n\n\n\n Of note is that under the CPRA, \u201cdevices\u201d have been removed from the compliance requirements and thresholds for households.<\/p>\n\n\n If your business has a website, it is almost certain that you one way or another collect what is defined in the CCPA as personal information<\/strong>.<\/p>\n\n\n\n While almost all websites collect data, the CCPA applies to a limited number of organizations. It only protects the personal data of residents of California, processed by commercial entities that:<\/p>\n\n\n\n or<\/p>\n\n\n\n or<\/p>\n\n\n\n Given the broad definition in the CCPA of personal information, first and third party cookies can be deemed indirect identifiers<\/strong>, reasonably capable of identifying an individual through the collection of personal information such as browser history<\/strong>, cross-site tracking<\/strong>, IP addresses<\/strong>, other behavioral data that trackers and plugins on your website collect on your end-users.<\/p>\n\n\n\n The Cookiebot CMP solution enables data controllers to provide transparency about data collection and use, and enables CCPA website compliance<\/a> for businesses. <\/p>\n\n\n\n An important part of achieving CCPA compliance is for a business to know all of the data they collect and from where, how it\u2019s stored, who has access to it, and how it\u2019s used. For example, on the website: what cookies and trackers are in use, what data do they collect, which of them are set by third parties, and what do they do with that data? With the CCPA rights <\/strong>consumers now have, personal data is no longer a commodity that businesses can collect without limit, trade, share, or sell without any thought for the consumer. In California, personal information belongs to end users, who now have more control over who can access it, and for what purposes.<\/p>\n\n\n\n Any organization that is collecting data on California residents and meets compliance thresholds need to have reasonable security procedures in place to ensure that they adequately protect personal data they have collected. They also need to ensure processing of the data and sharing of it follows regulatory requirements. The law also requires such organizations to provide information about data collection and processing and user rights in a prominent place, most commonly via a CCPA privacy policy<\/a> on the website.\u00a0\u00a0<\/p>\n\n\n\n Our solution works to protect privacy and human autonomy on our digital infrastructures, and we are thrilled to see strong data privacy laws emerging around the world \u2013 from Europe to the US.<\/p>\n\n\n\n Our CMP is a compliance solution for CCPA and<\/em> GDPR \u2013 depending on what configuration you and your business needs and where in the world your end-users are located.<\/p>\n\n\n\n Cookiebot scans your website, uncovers all cookies and trackers in place and blocks them all from collecting personal information, until your end-users have given their consent to which trackers, they will allow activated, as is the strong privacy requirements of the European GDPR<\/a>.<\/p>\n\n\n\n We also support the CCPA requirement of having a Do Not Sell My Personal Information<\/strong> link on a business\u2019 website.<\/p>\n\n\n\nCCPA categories of personal information<\/h2>\n\n\n\n
\n
CCPA personal data<\/h2>\n\n\n\n
What is the CCPA?<\/strong><\/h2>\n\n\n\n
What are consumers\u2019 rights under the CCPA?<\/h3>\n\n\n\n
\n
California PII Laws<\/h2>\n\n\n\n
![\"CCPA\u2019s](\"https:\/\/www.cookiebot.com\/en\/wp-content\/uploads\/sites\/7\/2024\/04\/California-PII-laws.svg\")
CCPA enforcement has begun<\/h2>\n\n\n\n
The California Privacy Rights Act (CPRA) is now law<\/h3>\n\n\n\n
Personal information under CCPA<\/h2>\n\n\n\n
CCPA household data definition<\/h2>\n\n\n\n
\n Find all cookies and trackers on your domain that collect and process end users\u2019 personal information. <\/h2>\n <\/div>\n
Cookiebot CMP, CCPA and personal information<\/h2>\n\n\n\n
Compliance thresholds for the CCPA<\/h3>\n\n\n\n
\n
\n
\n
![\"Our](\"https:\/\/www.cookiebot.com\/en\/wp-content\/uploads\/sites\/7\/2024\/04\/CCPA-compliance.svg\")
CCPA compliance with Cookiebot CMP<\/h3>\n\n\n\n
![\"Cookiebot](\"\/media\/4337\/ccpa_main_en.png?width=500&\")