Law note · California
California Consumer Privacy Act, as amended by the California Privacy Rights Act (Proposition 24)
Governs private-sector for-profit businesses that meet the CCPA's revenue or data-volume threshold and determine the purposes and means of processing a California consumer's personal information. Duties run on a notice-and-purpose-limitation model rather than a consent-gated lawful basis, and are allocated among four defined roles: business, service provider, contractor, and third party.
The original CCPA (AB 375) became operative January 1, 2020; the California Privacy Rights Act (Proposition 24) substantially expanded it, and the amended law now in force became operative January 1, 2023. AB 1008 (2024) separately expanded the personal-information definition to reach data held in AI systems capable of outputting it.
What it asks of an app
- If your app is a for-profit business meeting the CCPA's revenue or data-volume threshold and it determines the purposes and means of processing a California consumer's personal information, honor the CCPA/CPRA's notice, opt-out, and non-discrimination duties before collecting, selling, or sharing that data.
- Disclose at or before collection the categories of personal information you collect, your purpose for collecting it, and the retention period or the criteria you use to set it.
- Limit your collection, use, retention, and sharing of a California consumer's personal information to what is reasonably necessary and proportionate to the purpose you disclosed.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach, high_risk_decisions, processes_voice, processes_biometrics
Primary source: Official codified statute text, California Legislative Information (leginfo.legislature.ca.gov)