Skip to main content

California Consumer Privacy Act (CCPA)

Jump straight to Avatar compliance regarding CCPA

The California Consumer Privacy Act (CCPA) is a data privacy law that grants California residents enhanced rights over their personal information. It applies to businesses operating in California or serving California residents.

Who Must Comply?​

A business must comply with CCPA if it meets at least one of the following criteria:

  • Annual gross revenue exceeds $25 million.
  • It processes the personal data of 50,000+ consumers, households, or devices per year.
  • It derives 50% or more of its annual revenue from selling consumers’ personal data.

Consumer Rights under CCPA​

The CCPA provides California residents with several key privacy rights:

  • Right to Know: Consumers can request details about what personal data a business collects and how it is used.
  • Right to Delete: Consumers can request deletion of their personal data, with some exceptions.
  • Right to Opt-Out: Consumers can opt out of their data being sold to third parties.
  • Right to Non-Discrimination: Businesses cannot discriminate against users exercising their privacy rights.

Definition of Personal Information under CCPA​

Under CCPA, personal information includes:

  • Identifiers (name, address, email, IP address)
  • Commercial data (purchase history, transactions)
  • Biometric information
  • Internet activity (browsing history, search history)
  • Geolocation data
  • Employment or education data

Pseudonymization, Anonymization, and CCPA Compliance​

The CCPA does not apply to anonymized or de-identified data, as long as businesses ensure there is no reasonable way to re-identify individuals.

To be considered de-identified, data must not be linkable to a specific consumer and must be handled with technical safeguards preventing re-identification.

The Avatar method offers a privacy by design approach that specifically aim to prevent re-identification. It also offers a privacy evaluation toolkit to assess the residual re-identification risk. The use of the method and the synthetic data generated with it are therefore compatible with the CCPA regulation.