CCPA

Data & Tracking

Also: California Consumer Privacy Act · CPRA

What it isCalifornia's consumer privacy law

GivesRights to know, delete and opt out

ReachCan apply to Australian businesses too

Quick definition

The CCPA, or California Consumer Privacy Act, is a privacy law giving California residents rights over their personal data, including the right to know what is collected, to have it deleted and to opt out of its sale. Its later amendment, the CPRA, strengthened those rights. It matters beyond California because it can apply to any business that handles the data of California residents, which can include Australian companies selling into the United States.

Where it shows up in the data

Consumer rights

The law gives Californians rights to know what is collected, to delete it, to opt out of its sale or sharing and to be free from discrimination for exercising those rights.

Extraterritorial reach

It can apply to any qualifying business handling Californian residents' data, so location outside California, including Australia, does not automatically exempt you.

Opt-out of sale

A defining feature is the requirement to let consumers opt out of the sale or sharing of their data, which reshaped how many businesses handle data sharing.

What it actually means

The CCPA gives California residents a set of rights over their personal information: to know what a business collects and why, to request deletion, to opt out of the sale or sharing of their data and to not be discriminated against for exercising those rights. The CPRA amendment added more, including rights around sensitive data and a dedicated enforcement agency. The reason it matters outside California is its extraterritorial reach. The law can apply to any business that meets certain thresholds and handles Californian residents' data, so an Australian ecommerce brand or SaaS company selling into the US market can fall under it. Compliance centres on transparency, honouring rights requests and giving a clear way to opt out of data sale or sharing.

The CCPA is a Californian law with a global reach. Where your customers live matters more than where your business does.

How it shows up

CCPA compliance shows up as a privacy policy that discloses data practices, a process for handling data access and deletion requests and a clear opt-out of sale or sharing on the site (often labelled Do Not Sell or Share My Personal Information).

The Australian context

For Australian businesses the CCPA is relevant when selling into the US market. It sits alongside the domestic Privacy Act, and the practical move is a single high privacy standard that satisfies the strictest jurisdiction you operate in rather than a patchwork.

Where people get this wrong

Assuming a US law cannot apply to youThe CCPA can reach a business handling Californian residents' data regardless of where the business is based, so selling into the US can bring you into scope.

Building a separate regime per privacy lawRunning a bespoke scramble for each jurisdiction is fragile. A single high privacy standard that satisfies the strictest market you touch is more robust and simpler.

Treating opt-out as optionalThe right to opt out of data sale or sharing is central to the CCPA. Not offering a clear, working opt-out is a common and visible failure.

Common questions

What is the CCPA?

It is the California Consumer Privacy Act, a law giving California residents rights over their personal data, including to know what is collected, to have it deleted and to opt out of its sale. The CPRA amendment strengthened it.

Does the CCPA apply to Australian businesses?

It can. The law has extraterritorial reach and may apply to any qualifying business that handles Californian residents' data, so an Australian company selling into the US market can fall under it.

How do you comply with the CCPA?

Disclose your data practices clearly, honour consumer rights requests to access and delete data and provide a genuine opt-out of data sale or sharing. Running one high privacy standard usually covers it.

Debrief

Get the next one

No spam. No fluff. Just the next article, straight to your inbox.

Keep exploring

About New Rebellion

New Rebellion is a marketing intelligence consultancy. We build tools, score Australian businesses on how their marketing actually performs, and publish Debrief every day. This dictionary is part of how we work in the open.

How we think →