California is a remarkable jurisdiction by any measure. It has the largest economy in the United States, represents the third largest state in the United States in terms of total area at 163,696 square miles, and stands as the fifth largest economy in the world with a gross domestic product at more than $2.7 trillion. And, now, thanks to its recently enacted California Consumer Privacy Act of 2018 (CCPA), it also has the most far-reaching privacy law in the United States.
CCPA is an unfamiliar type of law for the United States due, in large part, to its broad scope. It establishes a new privacy framework for businesses that fall within its jurisdiction by:
- Creating an expanded definition of “personal information”;
- Creating new data privacy rights for California consumers, including rights to know, access, delete, and opt out of the “sale” of their personal information;
- Imposing special rules for the collection and sale of personal information directly from minors; and
- Creating a new statutory damages framework for violators that fail to implement and maintain reasonable security procedures and practices to prevent data security breaches.
