CCPA vs CalOPPA

The California Consumer Privacy Act (CCPA) and the California Online Privacy Protection Act (CalOPPA) are both California state laws designed to protect the personal information of California residents. Let’s look at the similarities and differences between them.

CCPA

The California Consumer Privacy Act came into effect on 1 January 2020, strengthening privacy rights and protections for California residents.

Who Does It Apply To?

CCPA applies to any business that collects personal information from California residents and meets one or more of the following:

• Has gross annual revenue over $25 million
• Buys, receives, or sells the personal information of 50,000 or more California residents, households, or devices
• Derives 50% or more of its annual revenue from selling the personal information of California residents

Key Requirements for Business

Privacy policy updates: disclose California residents’ new privacy rights: the right to know what information is collected and how it’s used and shared; the right to delete their personal information (with some exceptions, such as where it’s needed to comply with legal obligations or complete a transaction); the right to opt out of the sale of their information; and the right to non-discrimination for exercising any of these rights.

Disclose categories of personal information collected: notify consumers, at or before collection, of the categories of information collected and why, and keep this information current in your privacy policy (updated at least every 12 months).

“Do Not Sell My Personal Information”: provide a clearly visible link on your homepage taking users to an opt-out page.

Financial incentives: you can offer incentives in exchange for personal information, as long as the terms are disclosed to the consumer.

Records: keep records of consumer requests and your responses for two years.

Parental or guardian consent: you can’t sell the personal information of consumers under 16 unless the consumer (aged 13–16) has authorised the sale themselves, or a parent/guardian has authorised it for consumers under 13.

CalOPPA

The California Online Privacy Protection Act came into effect in 2004 and was amended in 2013 to reflect new disclosure requirements around online tracking. It was the first state law to make posting a privacy policy mandatory for websites and online services.

Who Does It Apply To?

If you own a website or online service that collects and maintains personally identifying information from a California resident, CalOPPA applies to you. Personally identifying information includes things like name, address, email address, phone number, and social security number.

Key Requirements for Business

You must post your privacy policy conspicuously: either directly on your homepage, via a homepage link containing the word “Privacy,” or via hyperlink text with “PRIVACY” in capitals or a larger font than the surrounding text. You’re also required to actually adhere to what your policy says, as California’s Department of Justice puts it, the law “requires them to say what they do and do what they say.”

Recommendations for your privacy policy:

• Readability: use an easy-to-read format, plain English, and avoid technical jargon.
• Online tracking / Do Not Track: clearly label your stance on tracking (for example, “California Do Not Track Disclosures”), explain how you respond to Do Not Track signals, and disclose whether third parties may collect personal information on your site.
• Data use and sharing: disclose all your uses of collected data, and link to third parties’ privacy policies where possible.
• Individual choice and access: disclose the choices consumers have regarding the collection, use, and sharing of their information.
• Accountability: provide clear contact details for any questions or concerns.

Conclusion

Both CCPA and CalOPPA are California state laws that apply to businesses collecting data from California residents, but CCPA only requires compliance if your business meets its specific revenue or data-volume thresholds, while CalOPPA applies more broadly to any site collecting personal information from Californians. Both require a privacy policy, though each has its own specific content requirements.

Neither law requires your business to be based in California: if you have users or customers who are California residents, you need to comply. Generate your CalOPPA and CCPA compliant privacy policy using our free generator.

The information in this article is for informational purposes only and should not be construed as legal advice on any matter, and does not create a lawyer-client relationship.