CCPA Compliance Guide

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), is the most comprehensive state-level privacy law in the United States. Effective January 2020 with CPRA amendments taking effect January 2023, CCPA applies to for-profit businesses that collect personal information of California residents and meet certain revenue or data volume thresholds: annual gross revenues over $25 million, buying/selling/sharing personal information of 100,000+ consumers or households, or deriving 50%+ of annual revenue from selling or sharing personal information. For MENA businesses with US customers, CCPA is relevant because it applies based on the consumer's residence, not the business's location. CCPA uses an opt-out consent model, which differs significantly from the opt-in model required by GDPR and PDPL. Under CCPA, businesses can collect and use personal information without prior consent but must provide a clear 'Do Not Sell or Share My Personal Information' link and honor opt-out requests. Consumer rights include the right to know what personal information is collected, the right to delete, the right to opt-out of sale/sharing, the right to non-discrimination, the right to correct, and the right to limit use of sensitive personal information. Businesses must provide privacy notices, respond to consumer requests within 45 days, maintain records for 24 months, and implement reasonable security measures. The California Privacy Protection Agency (CPPA) enforces the law, with penalties of $2,500 per unintentional violation and $7,500 per intentional violation. Private right of action exists for data breaches. Arqam360's auto-regime detection identifies California visitors and applies the opt-out consent model automatically, defaulting analytics and preferences to enabled while providing clear opt-out mechanisms.