In order to help businesses understand and benchmark industry practice, Greenberg Traurig attorneys analyzed the publicly available privacy policies of companies within the Fortune 500.[1] As of October 2022 – nearly two years after the CCPA took effect – 71% of companies had updated their privacy policies to account for the CCPA.[2] It is not clear whether the rate at which Fortune 500 companies updated their privacy policies is representative of the rate at which small, emerging, or mid-sized companies updated their privacy policies. As many smaller companies may not meet the de minimis threshold for complying with the CCPA, it is possible that fewer small companies have updated their privacy policies for the CCPA.

[1] Greenberg Traurig LLP reviewed the publicly available privacy policies and practices of 554 companies (the Survey Population). The Survey Population comprises companies that had been ranked within the Fortune 500 at some point in the past five years as well as additional companies selected from industries that are underrepresented in the Fortune 500. While the Survey Population does not fully match the current Fortune 500 as a result of industry consolidation and shifts in company capitalization, we believe that the aggregate statistics rendered from the Survey Population are representative of mature companies. Greenberg Traurig’s latest survey was conducted between September and October 2022.

[2] Note that whether a company updated its privacy policy for the CCPA is not necessarily indicative of whether the company is, or is not, complying with California privacy laws. For example, a company that has not updated its privacy policy for the CCPA, but is not subject to the statute (i.e., does not do business in California), would not be out of compliance.