Also known as: California Consumer Privacy Act · CPRA · California privacy law
The CCPA, as amended by the CPRA, is California's consumer privacy law, granting residents rights to know what personal information businesses collect about them, to delete it, to correct it, and to opt out of its sale or sharing.
The most consequential structural difference from GDPR is the consent model: CCPA is largely opt-out, requiring businesses to honour a request to stop selling data, whereas GDPR generally requires a lawful basis before processing begins.
The 'sale' definition is deliberately broad and covers many arrangements businesses would not colloquially describe as selling, including some ad-tech data sharing. Enforcement of Global Privacy Control signals has made opt-out increasingly automated at the browser level.
GDPR
The GDPR (General Data Protection Regulation) is the European Union's data protection law, which governs how personal data of people in the EU may be collected and processed, and grants individuals rights over their data regardless of where the processing organisation is based.
Data Subject Rights
Data subject rights are the legal entitlements individuals hold over their personal data, typically including the rights to access, correct, delete, port, and object to the processing of information held about them.
Third-Party Cookie
A third-party cookie is a cookie set by a domain other than the one shown in the address bar, historically the primary mechanism allowing advertising networks to track individual users across unrelated websites.
Data Broker
A data broker is a company that collects personal information from public records, commercial transactions, apps, and online activity, then aggregates and sells it to other organisations — typically without any direct relationship with the individuals concerned.