When financial institutions and other businesses collect data from California residents through their websites, they must comply with California law. For many businesses, this includes complying with the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). These are two of California’s newest data security laws, and they apply to “covered businesses” throughout the United States.

Collectively, the CCPA and CPRA establish extensive data protection obligations for covered businesses. While these laws cover sensitive personal information similar to that covered under many other states’ data protection laws, they cover other types of data as well. If a financial institution, service provider, health care provider, or any other covered business fails to meet its data security obligations under the CCPA or CPRA, the business can face enforcement action from the California Attorney General; and, in cases involving data breaches, they can face consumer class action litigation as well.

“California law creates extensive data privacy compliance obligations for businesses throughout the United States. The CCPA and CPRA in particular establish broad consumer rights and associated legal obligations for covered businesses. Covered businesses that fail to meet these obligations can face costly fines, and they can also face consumer class action lawsuits in some cases.” – James Bell, Senior Trial Attorney Oberheiden P.C.

While many consumer data privacy laws only protect sensitive information such as social security numbers, passport numbers, and credit and debit card numbers, the CCPA and CPRA are significantly broader in scope. As amended by the CPRA, the CCPA applies to numerous types of private information, and it establishes numerous privacy and security obligations for covered businesses. Companies that are not fully prepared to both maintain and demonstrate compliance can face substantial liability exposure—including exposure to liability for statutory damages.

The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) Work Together to Provide Strong Protections for California Residents

The California Consumer Privacy Act (CCPA) is a relatively new law. Enacted in 2018, it took effect in 2020. California voters approved the California Privacy Rights Act (CPRA) that same year, and the CPRA took full effect in 2023.

The CPRA is an amendment to the CCPA. As such it both modifies and supplements the CCPA’s original language. This means that covered businesses must ensure compliance with both laws—as complying with original CCPA language that has been supplanted by the CPRA could still lead to liability.

The Broad Definition of “Personal Information” Under the CCPA and CPRA

One of the ways that the CPRA modified the CCPA was by amending the definition of “personal information” covered under the statute. While the CCPA’s definition was already extremely broad, the CPRA makes this definition broader still. As originally enacted, the CCPA covered, “information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”

Following the enactment of the CPRA, the statute still covers these types of data, but it also includes enhanced protections for “sensitive personal information.” This includes personal information that reveals:

• “A consumer’s social security, driver’s license, state identification card, or passport number;
• “A consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account;
• “A consumer’s precise geolocation;
• “A consumer’s racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership;
• “The contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication;
• “A consumer’s genetic data;” or,
• “A consumer’s neural data,” which is defined as, “information that is generated by measuring the activity of a consumer’s central or peripheral nervous system, and that is not inferred from nonneural information.”

Thus, the scope of the data covered under the CCPA and CPRA is significantly broader than that covered by many other laws, including the Telephone Consumer Protection Act (TCPA) and Fair Credit Reporting Act (FCRA), among others. Complying with other privacy laws related to tracking consumers’ online activity will not necessarily be sufficient to maintain compliance with the new privacy rights granted to California residents under the CCPA and CPRA. With this being the case, companies that are subject to the CCPA and CPRA must take the necessary steps to protect consumers’ personal information covered under these statutes—as failing to do so could lead to government enforcement action or class action litigation.

California Consumers’ Notice, Opt-Out, and Request Rights

Along with establishing data protection requirements for covered businesses, the CCPA and CPRA also grant broad rights to California consumers. Some examples of these rights include:

• Consumer Notices – California residents have the right to receive several forms of notice regarding the collection of their personal information. This includes, but is not limited to, notices contained in covered businesses’ website privacy statements.
• Opt-Out Rights – The CCPA and CPRA grant California residents opt-out rights regarding personal data collection in varying circumstances.
• Consumer Requests – Under the CCPA and CPRA, California residents have the right to request various pieces of information from covered businesses. This includes, but is not limited to, information about their data collection and sharing practices.

Again, these are just examples. Violations of California residents’ notice, opt-out, and request rights are common sources of consumer complaints. With this in mind, covered businesses must implement practical strategies for managing their compliance obligations in these areas. This includes managing technology transactions that result in the collection of covered personal information as well as managing policies and procedures for responding to consumer requests in a timely and appropriate manner.

Covered Businesses’ Other Obligations Under the CCPA and CPRA

Along with meeting their obligations related to the consumer rights we just discussed, covered businesses must consistently maintain compliance with various other obligations under the CCPA and CPRA as well. Crucially, while covered businesses are expected to follow the regulatory guidance published by the California Privacy Protection Agency (CPPA), this is not sufficient on its own, and the CPPA makes clear that its regulatory guidance is not a substitute for an independent assessment of a company’s compliance obligations.

Among the most significant additional obligations established under the CCPA and CPRA are those pertaining to data breaches. When data breaches implicate consumer privacy issues under these laws, covered businesses can face class action lawsuits under the CCPA’s private right of action provisions. This is in addition to facing enforcement action by the California Attorney General.

For-Profit Businesses (Including Data Brokers) Can Face Substantial Liability for CCPA and CPRA Violations

The CCPA and CPRA apply to for-profit entities that fall within the CCPA’s definition of a covered “business.” A covered business is any entity in California or elsewhere that directly or indirectly collects California residents’ personal information, determines (or participates in determining) the purposes or means of processing this information, and either:

• Has annual gross revenue in excess of $26.625 million (adjusted annually for inflation);
• Annually collects for its own business purposes, sells, or shares the personal information of at least 100,000 consumers or households; or,
• Derives at least 50% of its annual revenue from selling or sharing consumers’ personal information.

These are independent requirements—meaning that even if a business does not meet the annual revenue threshold, it is still subject to statutory compliance if it meets either of the other two criteria (or vice versa). This means that numerous businesses throughout the United States must maintain compliance in order to avoid liability exposure.

Liability exposure under the CCPA and CPRA comes in two primary forms. Covered businesses can face enforcement litigation involving the CPPA and California Attorney General; and, in cases involving data security breaches, they can also face class action lawsuits.

Enforcement Litigation Involving California Government Agencies

The CPPA and California Attorney General have been aggressively enforcing the CCPA and CPRA in recent years. The Attorney General’s Office maintains a list of significant enforcement actions on its website—and, as this list illustrates, targeted businesses can face millions of dollars in liability exposure.

Enforcement actions can (and do) involve violations of all substantive provisions of the CCPA and CPRA. As a result, covered businesses need to prioritize compliance in all areas, and they must be prepared to affirmatively demonstrate compliance to the California Attorney General when necessary.

Class Action Lawsuits Involving Data Security Breaches

The CCPA’s private right of action provision allows California residents to sue for data security breaches in many cases. While California residents can sue for their actual damages, they can also sue for statutory damages that apply on a per-incident basis. With each individual exposure of a consumer’s protected information constituting a separate “incident,” companies’ liability exposure in class action litigation under the CCPA and CPRA has the potential to be substantial as well.

Combined with the ability to seek statutory damages, the breadth of the CCPA and CPRA has resulted in a substantial amount of litigation under these statutes in recent years. For companies targeted by plaintiffs’ firms in California, engaging defense counsel with extensive experience in this type of litigation is essential for mitigating the liability risks involved.