Privacy & regulation · also called CCPA, CPRA, California Consumer Privacy Act, California Privacy Rights Act
CCPA / CPRA
The CCPA, as amended by the CPRA, is California's consumer privacy law giving residents rights to know, delete, correct and opt out of the sale or sharing of their personal information.
The California Consumer Privacy Act took effect on 1 January 2020. Voters then approved the California Privacy Rights Act in November 2020, which amended and expanded it from 2023 and created a dedicated regulator, the California Privacy Protection Agency, alongside the Attorney General.
For advertising, the key concepts are "sale" and "sharing". Sharing specifically covers disclosing personal information for cross-context behavioural advertising, meaning ads targeted using activity across other businesses' sites and apps. Businesses must offer a "Do Not Sell or Share My Personal Information" option and honour opt-out preference signals such as Global Privacy Control. Consumers can also limit use of sensitive personal information, which includes precise geolocation.
The definition of personal information is broad, including IP addresses, cookie and device IDs and inferences. In 2022 the Attorney General announced a $1.2 million settlement with Sephora, partly for failing to honour GPC signals. Many other US states have since passed similar laws, and the IAB IAB Global Privacy Platform helps ad tech signal choices across them.
Think of it like this
CCPA is like a California rule that every shop must post a sign saying what it does with your details, and must stop passing them on if you ask.
An example
A California resident visits a retailer's site with GPC switched on in her browser. The retailer must treat it as an opt-out, stop sending her data to ad partners for cross-context targeting and signal the choice downstream.
Related terms
Global Privacy Control (GPC)
Global Privacy Control (GPC) is a browser or extension setting that automatically tells every website a user visits that they do not want their personal data sold or shared.
IAB Global Privacy Platform (GPP)
The IAB Global Privacy Platform (GPP) is an IAB Tech Lab standard that packages privacy and consent signals for many jurisdictions, like US states and the EU, into one string.
Behavioral targeting
Behavioral targeting shows ads to people based on their past online behaviour, such as sites visited, searches, purchases or app use, collected over time and often across different services.
PII (personally identifiable information)
PII (personally identifiable information) is information that identifies, or can be used to identify, a specific person, such as a name, email, phone number or government ID number.
Data broker
A data broker is a company that collects personal information about consumers from many sources, often without a direct relationship with them, and sells or licenses it to others.
Sources: California Attorney General: CCPA, California Attorney General: CCPA regulations