California Privacy Law: What a Business Actually Has to Do
California's consumer privacy framework — the CCPA as amended by the CPRA — gives California residents rights over their personal information and places obligations on businesses that handle it. Many businesses outside California are covered, because the trigger is handling Californians' data, not being located there.
This is a practical overview, not legal advice. Thresholds and enforcement positions change; verify current specifics before acting.
Are you covered
A for-profit business doing business in California is covered if it meets any one of:
- annual gross revenue above a specified threshold (adjusted periodically — check the current figure)
- buying, selling or sharing the personal information of 100,000 or more California consumers or households annually
- deriving 50% or more of annual revenue from selling or sharing personal information
Two things people get wrong. The revenue threshold is total revenue, not California revenue — a business with modest California exposure can still be covered. And "consumer" includes employees and job applicants resident in California, so an employer with Californian staff has obligations even with no California customers.
The rights you must honour
- Know — what personal information you collect, the sources, the purpose, and who you disclose it to
- Access — a copy of the specific pieces you hold
- Delete — removal, subject to exceptions
- Correct — fix inaccurate information
- Opt out of sale or sharing — including sharing for cross-context behavioural advertising
- Limit use of sensitive personal information
- Non-discrimination — no penalty for exercising rights
You must provide at least two methods for submitting requests, including a toll-free number for businesses operating offline, and respond within defined timeframes (generally 45 days, extendable).
The part that catches people: "sale" and "sharing"
"Sale" is defined broadly — disclosing personal information for monetary or other valuable consideration. "Sharing" specifically covers disclosure for cross-context behavioural advertising, whether or not money changes hands.
This is why advertising and analytics pixels matter. A site running advertising tags that pass identifiers to an ad platform is very likely "sharing", even though nobody wrote an invoice. That triggers:
- a "Do Not Sell or Share My Personal Information" link, clearly posted
- honouring the Global Privacy Control browser signal as a valid opt-out
- a mechanism that actually stops the sharing when someone opts out
The common failure is a compliant-looking link that does not change tag behaviour. If opting out does not stop the pixel firing, you have published a control that does not work — which is worse than not publishing it.
Sensitive personal information
A defined subset gets extra treatment: precise geolocation, racial or ethnic origin, religious beliefs, union membership, mail and message contents, genetic and biometric data, health information, and sexual orientation.
Consumers can limit its use to what is necessary to provide the service. If you collect any of it, you need the "Limit the Use of My Sensitive Personal Information" mechanism and a way to honour it.
The operational reality of a deletion request
The legal text is short; the work is not. To delete someone, you must know every system holding their data:
- the CRM, and its archived or deleted-record retention
- marketing automation and email platforms
- support ticketing, including attachments and conversation history
- billing and accounting — much of which you must retain for tax purposes
- call recordings and transcripts, including AI-derived summaries
- backups
- analytics platforms
- third parties you have disclosed to, who must also delete
Two practical points. Backups are generally handled by documenting that deleted records will not be restored into production, rather than restoring every backup to purge one record. And service providers must be instructed — your obligation extends to them.
Which means the real prerequisite is a data inventory. Without one, every request becomes an investigation, and 45 days goes quickly.
What to have in place
A data map. What personal information you collect, where it is stored, why, how long, and who it goes to. Everything else depends on this.
A privacy notice that matches reality. Categories collected, purposes, retention periods, disclosures, and the rights available. Updated at least annually.
Request intake and workflow. Two methods, identity verification, a tracked process, and evidence of response within the deadline.
Opt-out mechanisms that work. The link, Global Privacy Control honoured, and tags that actually stop.
Service provider contracts with the required terms. This is a contractual requirement, not a best practice.
Retention schedules. You must disclose how long you keep each category, which means deciding — and "indefinitely" is not a schedule.
Training for anyone who might receive a request. A request sent to a sales inbox still counts as received.
A sensible starting order
- Confirm whether you are covered, including on the employee-data path.
- Build the data inventory. This is the bulk of the work and everything else depends on it.
- Fix the privacy notice to describe what the inventory shows.
- Stand up request intake and a documented workflow.
- Audit your site's tags and make the opt-out actually effective.
- Review service provider contracts for required terms.
- Set retention schedules and implement deletion.
- Train the people who answer phones and inboxes.
The businesses that handle this well are not the ones with the most legal advice. They are the ones that did the data inventory properly — because once you genuinely know where personal information lives, every obligation becomes a process rather than an investigation.
