CCPA / CPRA.

## What it is The California Consumer Privacy Act (CCPA), effective January 1, 2020, is the first comprehensive US state consumer privacy law. Amended by the California Privacy Rights Act (CPRA) with substantive provisions effective January 1, 2023, it is now enforced by the California Privacy Protection Agency (CPPA) alongside the California Attorney General. ## Who it applies to For-profit businesses that do business in California, collect California consumers' personal information, and meet at least one of: - Annual gross revenues exceeding USD $25 million (2023 threshold; adjusted for inflation) — [VERIFY current threshold] - Buy, sell, or share the personal information of 100,000 or more consumers or households - Derive 50 percent or more of annual revenue from selling or sharing consumers' personal information ## Consumer rights - **Right to know** what personal information is collected, used, shared, or sold - **Right to delete** personal information held by businesses (with exceptions) - **Right to correct** inaccurate personal information (added by CPRA) - **Right to opt out** of the sale or sharing of personal information - **Right to limit** use and disclosure of sensitive personal information (added by CPRA) - **Right to non-discrimination** for exercising CCPA rights - **Right to portability** — receive personal information in a portable, machine-readable format ## Key business obligations - Provide a clear "Do Not Sell or Share My Personal Information" link on the homepage - Honour Global Privacy Control (GPC) signals as opt-out requests - Update privacy policies annually with specific CCPA disclosures - Execute contracts with service providers and contractors specifying processing limits - Conduct annual cybersecurity audits and risk assessments (CPRA — regulations still being finalized by CPPA) ## Breach notification and private right of action CCPA does not create a general breach reporting deadline of its own; California's separate breach notification statute (Cal. Civ. Code § 1798.82) applies. However, CCPA § 1798.150 creates a **private right of action** allowing consumers to sue for statutory damages of USD $100 to $750 per consumer per incident, or actual damages (whichever is greater), when nonencrypted and nonredacted personal information is exposed due to a business's failure to implement and maintain reasonable security procedures. Attorney General notification is required for breaches affecting more than 500 California residents. ## Penalties Civil penalties up to USD $2,500 per unintentional violation and USD $7,500 per intentional violation or violation involving a minor's information. Enforcement by the CPPA (administrative) and Attorney General (civil). The 30-day cure period was eliminated by CPRA for most violations (with some CPPA discretion). ## How LeakTrace aligns LeakTrace's monitoring focuses on the reasonable-security exposures that trigger CCPA § 1798.150 private actions — credential leaks, misconfigured public infrastructure, unencrypted data exposure. Evidence documentation supports both breach notification obligations and defence of "reasonable security" claims.