We follow the defensible programmes that cover notices, rights, vendor terms, and all under the CCPA and CPRA.
What Are the CCPA and CPRA?
The California Consumer Privacy Act (CCPA) is a consumer privacy rights program that was introduced on 1 January 2020, enabling California consumers to have proactive control over their personal data. The California Privacy Rights Act (CPRA) was implemented on 1 January 2023. It strengthens the CCPA with stronger privacy rights, a private right to appeal, stricter data minimization & protection rules, and setting up the California Privacy Protection Agency (CPPA).
In 2026, a new and detailed compliance package is implemented, expanding the privacy policy disclosures, new automated decision-making (ADMT) and disclosure duties, strict record-keeping, and annual public reporting rules for giant businesses.
Who is Covered?
Every “for-profit” business in California meeting any of these thresholds is covered in it:
- Annual gross revenues exceed $25 million, or
- Buys, sells, or shares the personal information of 100,000 or more consumers or households annually, or
- Makes 50% or more of its annual revenues from selling or sharing consumers' personal information.
Any business located internally or outside California is covered if it meets either of the thresholds and gathers personal information on California residents.
Key Exclusions and Nuance
However, CCPA and CPRA cover businesses managing California residents' personal information broadly. Certain data types and organizations are governed as separate compliance requirements. Thereby, they are exempted from this threshold.
A. Data Protected under Other Laws
- Personal information managed by HIPAA-covered healthcare providers, health plans, and their business associates.
- Financial information gathered by banks, credit unions, insurance companies, and other financial institutions governed under the Gramm-Leach-Bliley Act (GLBA).
- Certain medical, clinical trial, and research data protected under applicable healthcare and research privacy laws.
B. Key Responsibilities of Service Providers, Contractors, and Third Parties
CCPA and CPRA cover the primary businesses, along with organizations that use personal information on behalf of businesses. Up next are compliance obligations implemented on the collection, uses, and protection for them:
- Service providers must harness personal information only for authorized business purposes.
- Contractors must follow restrictions per contractual privacy and security requirements and use data only as instructed.
- Third parties leveraging personal information must abide by restrictions applied on its use and must deliver privacy notices where applicable.
C. Employee and B2B Personal Information
A glance at revised provisions for employee and business-to-business (B2B) personal information under CPRA:
- Employee, job applicant, contractor, and business contact details are now governed under the CCPA and CPRA privacy rights.
- Businesses must feed B2B and employees with a privacy notice explaining what & why personal information is collected, how it is used, retained, and shared, and what privacy rights they have.
Consumer Rights
California consumers have the following rights:
- Right to know/access what piece of personal information has been collected, used, disclosed, and sold or shared.
- Right to delete any personal information collected from the consumer, which is categorized as an exception.
- Right to correct any specific inaccurate personal information that is added by CPRA.
- Right to opt out of sale or sharing, including the sharing of information for cross-context behavioral advertising.
- Right to restrict use and disclosure of sensitive personal information.
- Right to opt out of automated decision-making (ADMT).
- Right to non-discrimination ensures that businesses cannot penalize, deny benefits, or provide inferior quality service when consumers exercise their privacy rights.
- Right to appeal when an “appeal-in-writing” is denied.
How EMINENTURE Helps
- Scope Assessment: We strictly examine whether CCPA/CPRA applies, including thresholds, exemptions, and business or service-provider status.
- Data Mapping: We infallibly identify what data you collect, where it comes from, where it goes, and how long you keep it.
- Privacy Policy Updates: We protect B2B and data collection notices per our privacy policies.
- Consumer Rights Support: We address privacy requests, verification, responses, appeals, and required records.
- Opt-Out & GPC Support: We help leverage opt-out preferences across websites, apps, and advertising platforms.
- Vendor Management: It’s a must-have to review vendors, contracts, data-sharing practices, and third-party risks for us.
- ADMT & Sensitive Data Governance: We discover automated decision-making and sensitive personal information shared and manage related requirements.
- Enforcement Readiness: We strictly document, host employee training, and run breach-response processes for regulatory requirements.