CCPA
CCPA (California Consumer Privacy Act) is California's data privacy law giving residents rights to know, delete, and opt-out of the sale of their personal information collected by mobile apps.
The California Consumer Privacy Act (CCPA), effective since January 2020 and strengthened by the California Privacy Rights Act (CPRA) in 2023, is a comprehensive state-level privacy law that grants California residents significant rights over their personal information collected by businesses, including mobile app developers. CCPA applies to companies that collect data from California residents and meet certain thresholds: annual gross revenues exceeding $25 million, buying, selling, or sharing personal information of 100,000+ California residents, or deriving 50% or more of annual revenue from selling or sharing consumer personal information.
Mobile apps must comply with CCPA by providing clear notice of data collection practices at or before the point of collection, honoring user requests to know what personal information is collected and how it’s used, implementing mechanisms to delete user data upon request, offering opt-out options for the sale or sharing of personal information (via a “Do Not Sell or Share My Personal Information” link), and ensuring that users who exercise privacy rights are not discriminated against. Unlike GDPR’s opt-in consent model, CCPA generally uses an opt-out approach for data sales, though specific consent is required for sensitive information and users under 16.
CCPA differs from GDPR in its geographical scope, enforcement approach, and consent model: CCPA protects California residents with an emphasis on transparency and opt-out rights, while GDPR covers EU residents with stricter opt-in consent requirements. CCPA’s definition of “sale” is broader than traditional monetary transactions, including data sharing with third parties for valuable consideration, affecting common advertising and analytics practices in mobile apps.