The California Consumer Privacy Act (CCPA), in force since January 2020, gives California residents rights over personal information held by businesses. Strengthened by the California Privacy Rights Act (CPRA) in January 2023, which created the California Privacy Protection Agency (CPPA) as a dedicated regulator. The first comprehensive US state privacy law; eleven other states (Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Texas, Oregon, Montana, Delaware) had passed analogous laws by 2026.
What it means in practice
The CCPA gives California residents four core rights: the right to know what personal information a business collects and shares, the right to delete (with exceptions for legal obligations and security), the right to opt out of the sale or sharing of personal information, and the right to non-discrimination for exercising these rights. The CPRA added the right to correct inaccurate data and the right to limit use of “sensitive personal information” (precise geolocation, race, religion, health data, contents of communications). Operationally, every business meeting the size thresholds (around $25M revenue, or processing data of 100k+ households, or deriving 50% of revenue from selling personal information) must provide a privacy notice, an opt-out mechanism (the “Do Not Sell or Share My Personal Information” link), and a process for handling consumer requests within 45 days.
Who it affects, and how
Direct beneficiaries: California residents, who can issue deletion and opt-out requests against any covered business. Indirect beneficiaries: residents of every state where similar laws followed (the dozen above), plus residents of states without such laws who happen to interact with California-compliant businesses (most national businesses extend the controls to all customers rather than running parallel systems). For data-broker removal specifically, CCPA opt-out requests are the most legally enforceable mechanism in the US: a broker that ignores a properly filed CCPA request faces escalating administrative penalties from the CPPA, which has built an enforcement record since 2023.
What you can change today
Two actions for California residents and three for others. California: file CCPA deletion requests with each major data broker (Spokeo, Whitepages, BeenVerified, Intelius, plus the wholesale aggregators) using the opt-out form on each site, citing CCPA explicitly; the response window is 45 days and missed deadlines are reportable to the CPPA. Non-California: check whether your state has passed an analog (the IAPP maintains the canonical tracker at iapp.org/resources/article/us-state-privacy-legislation-tracker), file equivalent requests where the law applies, and file Global Privacy Control (GPC) signals through your browser to express opt-out preferences automatically across compliant sites.