Understanding California’s New Consumer Privacy Law

In July, the California legislature approved a new consumer privacy law that represents one of the most significant pieces of privacy legislation ever passed in the United States. 

The California Consumer Privacy Act of 2018 (CCPA), set to take effect in 2020, creates a host of obligations for businesses that collect personal information about consumers, households, or devices in California and meet certain threshold criteria. The CCPA imposes transparency obligations and requires businesses to provide disclosures about their information practices both before collecting personal information and in response to consumer requests. In addition, companies that "sell" personal information, a concept defined broadly under the law, must provide additional choices and disclosures to consumers, including the ability to stop the sale of their personal information. Although the CCPA includes a limited private right of action in connection with security breaches reportable under existing law, primary enforcement authority rests with the California Attorney General. We expect aspects of the CCPA to be amended or clarified through regulations before 2020. Businesses should begin to assess whether they are subject to the CCPA now, and, if so, begin to understand the law's mandates. For more information, please see our Client Update, All I Want for Christmas… Is a New Privacy Law?