Compliance Assessment
CCPA Compliance Services
We help businesses that handle Californians' personal information meet CCPA and CPRA requirements in a way that fits how they operate.
- Area
- Compliance Services
- Covers
- CPRA, California
How we approach CCPA and CPRA compliance
The CCPA, as amended by the CPRA, gives California consumers rights over their personal information and places specific obligations on businesses that collect, sell or share it.
What you get
What the engagement leaves you with.
Compliance measures matched to your business model and data practices
Implementation guidance that keeps disruption to operations low
Privacy processes designed to adapt as regulations change
Support from privacy professionals with detailed CCPA/CPRA knowledge
Frequently asked questions
Does the CCPA apply to my business?
The CCPA applies to for-profit businesses that do business in California and meet at least one of these thresholds: (1) have annual gross revenues over $25 million; (2) buy, receive, sell, or share personal information of 50,000 or more California consumers, households, or devices per year; or (3) derive 50% or more of annual revenue from selling California consumers' personal information. Note that the CPRA (California Privacy Rights Act) amended some of these thresholds effective January 1, 2023.
Do we need to update our vendor contracts for CCPA compliance?
Yes. The CCPA and CPRA require specific provisions in contracts with service providers, contractors, and third parties that handle personal information on your behalf. These agreements must limit how the vendor can use, retain, and disclose the personal information and include specific requirements for maintaining the security of the data.
What's the difference between CCPA and CPRA?
The California Privacy Rights Act (CPRA) is an amendment to the CCPA that expanded privacy protections. Key changes include: creation of a new enforcement agency, extended employee and B2B exemptions, establishing a new "sensitive personal information" category with additional protections, adding new consumer rights (correction, limitation of sensitive data use), and expanding business obligations around data retention and minimization.
What do 'selling' and 'sharing' mean under CCPA/CPRA?
Under the CCPA as amended by CPRA, "selling" refers to exchanging personal information for monetary or other valuable consideration. "Sharing" refers specifically to sharing personal information for cross-context behavioral advertising purposes. Consumers have the right to opt out of both selling and sharing of their personal information.
Related services
Review your CCPA obligations with us
Schedule a free consultation with our CCPA specialists. We will discuss whether the law applies to you, where your current practices stand and what needs to change.