ccpa

What it does

Guides an organization through the CCPA/CPRA applicability process, including entity type check, three thresholds for coverage, and downstream data recipient classifications (Service Provider, Contractor, Third Party). It also outlines consumer rights workflows (know, delete, correct, opt-out of sale/sharing, limit SPI, data portability, non-discrimination, and ADMT opt-out), response timelines, and the need to document determinations and reassess thresholds annually.

How it works

• Verifies entity type as a for-profit business operating in California.
• Assesses coverage by testing three thresholds: Annual gross revenue, Data volume, and Revenue from data monetization.
• Classifies downstream data recipients as Service Provider, Contractor, or Third Party, and notes whether each involves a sale.
• Documents determinations and schedules annual reassessment of revenue and data-volume thresholds and vendor classifications.
• Defines consumer rights with deadlines and handling principles, including Right to Know, Delete, Correct, Opt-Out of Sale/Sharing, Limit SPI, and ADMT-related opt-out deadline.
• Specifies general request-handling timelines: acknowledge within 10 business days, substantive response within 45 calendar days, with one possible 45-day extension; opt-out/limit requests within 15 business days.
• Details intake channels, identity verification levels for requests, and record-keeping requirements for large-scale consumers.
• Describes opt-out mechanics (including GPC) and the need to propagate opt-outs to service providers and contractors.
• Provides steps for right-specific workflows (Know, Delete, Correct, Opt-Out, Limit SPI) with explicit steps and timeframes.

When to use it

Use when evaluating whether CCPA/CPRA applies to a business, when performing data-miep classifications, and when handling consumer rights requests or preparing compliance documentation and gap assessments.

What it can touch

• It references tools and processes for handling PI, SPI, and vendor classifications, and requires propagation to service providers and contractors. It includes workflow steps that imply interaction with data systems (CRM, analytics, ad tech) and a consent/preference platform. It also mentions GPC signal handling.

Caveats

• Does not include licensing or enforcement risk beyond citing CPPA enforcement examples (Disney, PlayOn, Ford) and general deadlines.
• The material states deadlines and definitions but does not guarantee regulatory outcomes; users should verify against current CPPA guidance and regulatory updates.