{"id":123175,"date":"2026-08-20T14:33:40","date_gmt":"2026-08-20T18:33:40","guid":{"rendered":"https:\/\/www.constantcontact.com\/blog\/?p=123175"},"modified":"2026-08-20T14:33:44","modified_gmt":"2026-08-20T18:33:44","slug":"ccpa","status":"publish","type":"post","link":"https:\/\/www.constantcontact.com\/blog\/ccpa\/","title":{"rendered":"CCPA Compliance: What Small Businesses Need to Know"},"content":{"rendered":"<!DOCTYPE html PUBLIC \"-\/\/W3C\/\/DTD HTML 4.0 Transitional\/\/EN\" \"http:\/\/www.w3.org\/TR\/REC-html40\/loose.dtd\">\n<html><body><ul class=\"wp-block-list has-color-11-background-color has-background has-medium-font-size\">\n<li><strong>CCPA basics:<\/strong> The California Consumer Privacy Act gives California residents rights over their personal information, including the rights to know, delete, opt out of sale or sharing, and correct inaccurate data.<\/li>\n\n\n\n<li><strong>Who must comply:<\/strong> For-profit businesses doing business in California that meet any one threshold: over $26.6 million in annual revenue (inflation-adjusted), buy\/sell\/share personal info of 100,000+ California consumers annually, or derive 50%+ of revenue from selling personal information.<\/li>\n\n\n\n<li><strong>CPRA update:<\/strong> The California Privacy Rights Act (effective January 1, 2023) amended the CCPA, adding the California Privacy Protection Agency, sensitive personal information protections, and two new consumer rights.<\/li>\n\n\n\n<li><strong>Response timelines:<\/strong> You have 45 days to respond to most consumer requests (extendable by another 45 days), and 15 business days to honor opt-out requests.<\/li>\n\n\n\n<li><strong>Penalties are real:<\/strong> Violations can cost up to $2,663 per unintentional violation and $7,988 per intentional violation (inflation-adjusted for 2025), plus consumers can sue for certain data breaches.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The CCPA, which is short for the <a href=\"https:\/\/leginfo.legislature.ca.gov\/faces\/billTextClient.xhtml?bill_id=201720180AB375\">California Consumer Privacy Act<\/a>, is a law designed to enhance privacy rights for consumers in California and to encourage transparency regarding how businesses collect and use personal information. The CCPA took effect on January 1, 2020, and was significantly amended by the California Privacy Rights Act (CPRA), which became effective January 1, 2023.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this article, you&rsquo;ll learn the basics of the CCPA, including who must comply, what rights consumers have, how the CPRA changed things, what penalties apply, and how the law compares to the GDPR.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>While not an exhaustive summary of the CCPA, or legal advice for your company to use in complying with the law, this article is intended to provide helpful background information on the CCPA to help you better understand the law and how it may apply to your business. You should consult your own legal counsel to determine if you are subject to the requirements of CCPA and for a full understanding of your obligations under the law.<\/strong><\/p>\n\n\n\n<h2 id=\"h-what-is-personal-information-under-the-ccpa\" class=\"wp-block-heading\">What is personal information under the CCPA?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The CCPA defines personal information as &ldquo;information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.&rdquo;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In short, if information can be traced back to, or is related in some way to, a consumer or household, it&rsquo;s likely to be considered personal information under the CCPA.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Similar to another well-known privacy law, the <a href=\"https:\/\/www.constantcontact.com\/blog\/gdpr-how-to-comply\/\">General Data Protection Regulation<\/a> (or the &ldquo;GDPR&rdquo;), this definition is very broad. Beyond what you might typically think of as personal information (such as name, address, email, and financial data), it also covers digital identifiers like IP addresses, geolocation, browsing history, and cookies. It can include information about an individual&rsquo;s physical, mental, social, economic, or cultural identity. The definition also extends to household-level information, even if it doesn&rsquo;t identify a specific person within that household.<\/p>\n\n\n\n<h3 id=\"h-sensitive-personal-information\" class=\"wp-block-heading\">Sensitive personal information<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The CPRA introduced a special category called sensitive personal information (SPI). This includes data that requires extra protection because of its potential to cause harm if misused.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sensitive personal information includes:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Government identifiers:<\/strong> Social Security number, driver&rsquo;s license, state ID, or passport number<\/li>\n\n\n\n<li><strong>Financial account details:<\/strong> Account login credentials, debit or credit card numbers combined with access codes<\/li>\n\n\n\n<li><strong>Precise geolocation:<\/strong> Location data accurate to within approximately 1,850 feet<\/li>\n\n\n\n<li><strong>Racial or ethnic origin<\/strong><\/li>\n\n\n\n<li><strong>Religious or philosophical beliefs<\/strong><\/li>\n\n\n\n<li><strong>Union membership<\/strong><\/li>\n\n\n\n<li><strong>Genetic or biometric data:<\/strong> Used for identifying a specific person<\/li>\n\n\n\n<li><strong>Health information<\/strong><\/li>\n\n\n\n<li><strong>Sex life or sexual orientation information<\/strong><\/li>\n\n\n\n<li><strong>Contents of mail, email, or text messages:<\/strong> Unless you&rsquo;re the intended recipient<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Consumers have the right to limit how businesses use and disclose their sensitive personal information.<\/p>\n\n\n\n<h2 id=\"h-who-has-obligations-under-the-ccpa\" class=\"wp-block-heading\">Who has obligations under the CCPA?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The CCPA applies to for-profit businesses doing business in California if they:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Are for profit (generally speaking, nonprofit organizations don&rsquo;t have to comply with CCPA unless they share branding with, or are controlled or owned by, a for-profit organization);<\/li>\n\n\n\n<li>Collect and control the processing of California consumers&rsquo; personal information;<\/li>\n\n\n\n<li>Do business in California, or target California consumers; and<\/li>\n\n\n\n<li>Meet any one of the following conditions:\n<ul class=\"wp-block-list\">\n<li>Have annual gross revenue in excess of $25 million (this threshold is <a href=\"https:\/\/cppa.ca.gov\/regulations\/cpi_adjustment.html\">inflation-adjusted<\/a> and currently sits at approximately $26.6 million, with biennial, every-two-year, adjustments),<\/li>\n\n\n\n<li>Annually buy, sell, or share personal information of 100,000 or more California consumers or households, or<\/li>\n\n\n\n<li>Derive fifty percent or more of their annual revenue from selling or sharing personal information.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h2 id=\"h-what-rights-do-consumers-have-under-the-ccpa\" class=\"wp-block-heading\">What rights do consumers have under the CCPA?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The CCPA was passed by California lawmakers to give California consumers more control over their personal information. The law defines a &ldquo;consumer&rdquo; as a natural person who is a resident of California, and it also applies to California residents who are traveling outside of the state. The CCPA ensures that consumers have:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Right to know:<\/strong> The right to be informed about what personal information is being collected about them, where it was sourced from, what it&rsquo;s being used for, and whether their personal information is sold or disclosed;<\/li>\n\n\n\n<li><strong>Right to delete:<\/strong> The ability to request deletion of their personal information;<\/li>\n\n\n\n<li><strong>Right to opt out:<\/strong> The ability to opt out of the sale or sharing of their personal information;<\/li>\n\n\n\n<li><strong>Right to access and portability:<\/strong> The ability to request access to their personal information in a portable format;<\/li>\n\n\n\n<li><strong>Right to correct:<\/strong> The right to request correction of inaccurate personal information (added by the CPRA);<\/li>\n\n\n\n<li><strong>Right to limit use of sensitive personal information:<\/strong> The right to direct a business to limit its use and disclosure of sensitive personal information (added by the CPRA); and<\/li>\n\n\n\n<li><strong>Right to non-discrimination:<\/strong> Protection against discrimination for exercising any of these rights.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Please note that not all of these rights listed above are absolute, and limitations or exceptions may apply in some cases. Businesses are required to provide a method to receive and respond to individual rights requests submitted by California consumers.<\/p>\n\n\n\n<h2 id=\"h-what-is-the-cpra-and-how-did-it-change-the-ccpa\" class=\"wp-block-heading\">What is the CPRA and how did it change the CCPA?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The California Privacy Rights Act (CPRA) was passed by California voters in November 2020 and took effect on January 1, 2023. Rather than replacing the CCPA, the CPRA amended and expanded it, adding new requirements and consumer protections.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here are the most significant changes the CPRA introduced:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>New enforcement agency:<\/strong> The <a href=\"https:\/\/cppa.ca.gov\/\">California Privacy Protection Agency (CPPA)<\/a> was created as a dedicated regulatory body to enforce the law, alongside the California Attorney General.<\/li>\n\n\n\n<li><strong>Two new consumer rights:<\/strong> The right to correct inaccurate personal information and the right to limit the use and disclosure of sensitive personal information.<\/li>\n\n\n\n<li><strong>Sensitive personal information category:<\/strong> A new classification for data that requires heightened protection, including Social Security numbers, precise geolocation, biometric data, and health information.<\/li>\n\n\n\n<li><strong>&ldquo;Do Not Sell or Share&rdquo; requirement:<\/strong> The opt-out link wording was updated from &ldquo;Do Not Sell My Personal Information&rdquo; to &ldquo;Do Not Sell or Share My Personal Information&rdquo; to cover cross-context behavioral advertising.<\/li>\n\n\n\n<li><strong>Updated business thresholds:<\/strong> The consumer data threshold increased from 50,000 to 100,000 California consumers or households.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The CPRA regulations are now in effect and continue to be refined by the CPPA. Staying current with these updates is an important part of maintaining compliance.<\/p>\n\n\n\n<h2 id=\"h-what-do-i-need-to-do-to-be-compliant-with-the-ccpa\" class=\"wp-block-heading\">What do I need to do to be compliant with the CCPA?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Under the CCPA, consumers can request that businesses do not sell or share their personal information. The definition of &ldquo;selling&rdquo; is broad: it covers selling, renting, releasing, disclosing, or otherwise making personal information available to third parties for monetary or other valuable consideration.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To honor these requests, you need to understand how you collect and share personal information across all contexts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here&rsquo;s a compliance checklist to help you get started:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Update your privacy notice:<\/strong> Make sure it accurately reflects your data collection, use, and sharing practices. Disclose the categories of personal information you collect and consumer rights under the CCPA.<\/li>\n\n\n\n<li><strong>Post the required opt-out link:<\/strong> If you &ldquo;sell&rdquo; or &ldquo;share&rdquo; personal information as defined by the CCPA, provide a link that says &ldquo;Do Not Sell or Share My Personal Information&rdquo; on your website&rsquo;s homepage and within your privacy notice.<\/li>\n\n\n\n<li><strong>Offer at least two request methods:<\/strong> Provide at least two methods for consumers to submit requests, including, at a minimum, a toll-free telephone number and a website address if you maintain one.<\/li>\n\n\n\n<li><strong>Respond to requests within required timelines:<\/strong> You must respond to verified consumer requests within 45 days (you can extend this by another 45 days if necessary, with notice to the consumer). Honor opt-out requests within 15 business days.<\/li>\n\n\n\n<li><strong>Review vendor and service-provider contracts:<\/strong> Ensure your contracts with third parties include appropriate data protection provisions.<\/li>\n\n\n\n<li><strong>Apply reasonable data security:<\/strong> Implement and maintain reasonable security measures to protect the personal information you collect and store.<\/li>\n\n\n\n<li><strong>Train staff who handle requests:<\/strong> Make sure employees who handle consumer inquiries know how to inform consumers about their rights and direct them to the right process.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">You should consult the <a href=\"https:\/\/leginfo.legislature.ca.gov\/faces\/billNavClient.xhtml?bill_id=201720180AB375\">CCPA website<\/a> and the CPRA regulations to gain a full understanding of these requirements. You can also check out these resources to understand how you must disclose Constant Contact&rsquo;s privacy practices to your contacts in your privacy notice: <a href=\"https:\/\/knowledgebase.constantcontact.com\/articles\/KnowledgeBase\/5536-constant-contact-privacy-policies-for-protecting-customers\">Constant Contact Privacy Practices<\/a>; <a href=\"https:\/\/knowledgebase.constantcontact.com\/articles\/KnowledgeBase\/27830-Set-A-Privacy-Policy-For-Your-Business\">Host a Privacy Policy for Your Organization<\/a>; and <a href=\"https:\/\/www.constantcontact.com\/legal\/about-constant-contact-faqs\">Frequently Asked Questions<\/a>.<\/p>\n\n\n\n<h2 id=\"h-what-are-the-penalties-for-ccpa-non-compliance\" class=\"wp-block-heading\">What are the penalties for CCPA non-compliance?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The CCPA has real teeth when it comes to enforcement. Both the <a href=\"https:\/\/cppa.ca.gov\/about_us\">California Privacy Protection Agency (CPPA)<\/a> and the California Attorney General can take action against businesses that violate the law.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here&rsquo;s what you could face for non-compliance:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Civil penalties for unintentional violations:<\/strong> Up to $2,500 per violation (<a href=\"https:\/\/cppa.ca.gov\/announcements\/2024\/20241217.html\">inflation-adjusted<\/a> to approximately $2,663, with biennial, every-two-year, updates)<\/li>\n\n\n\n<li><strong>Civil penalties for intentional violations:<\/strong> Up to $7,500 per violation (inflation-adjusted to approximately $7,988)<\/li>\n\n\n\n<li><strong>Violations involving minors under 16:<\/strong> The higher $7,988 penalty applies to violations involving children&rsquo;s personal information<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">In addition to civil penalties, the CCPA includes a private right of action for consumers affected by certain data breaches. If a business fails to implement reasonable security measures and a breach occurs, consumers can sue for:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Statutory damages:<\/strong> $100 to $750 per consumer per incident (inflation-adjusted to <a href=\"https:\/\/cppa.ca.gov\/announcements\/2024\/20241217.html\">$107 to $799<\/a> per consumer per incident, effective January 1, 2025)<\/li>\n\n\n\n<li><strong>Actual damages:<\/strong> If actual damages are greater than statutory damages, consumers can recover the higher amount<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">These penalties can add up quickly. If a breach affects thousands of consumers, the financial exposure can reach into the millions. This is general information, not legal advice; consult your own counsel to understand your specific risk.<\/p>\n\n\n\n<h2 id=\"h-ccpa-vs-gdpr-what-s-the-difference\" class=\"wp-block-heading\">CCPA vs. GDPR: what&rsquo;s the difference?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you&rsquo;re already familiar with the GDPR, you might wonder how the CCPA compares. While both laws aim to protect consumer privacy, they differ in scope, approach, and requirements.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><th>Aspect<\/th><th>CCPA (California)<\/th><th>GDPR (EU\/UK)<\/th><\/tr><tr><td><strong>Who it protects<\/strong><\/td><td>California residents<\/td><td>EU\/UK residents<\/td><\/tr><tr><td><strong>Who must comply<\/strong><\/td><td>For-profit businesses meeting specific thresholds<\/td><td>Any organization processing EU\/UK resident data<\/td><\/tr><tr><td><strong>Consent model<\/strong><\/td><td>Opt-out (consumers must request to stop sale\/sharing)<\/td><td>Opt-in (consent required before most processing)<\/td><\/tr><tr><td><strong>Right to delete<\/strong><\/td><td>Yes, with exceptions<\/td><td>Yes, with exceptions<\/td><\/tr><tr><td><strong>Right to correct<\/strong><\/td><td>Yes (added by CPRA)<\/td><td>Yes<\/td><\/tr><tr><td><strong>Data portability<\/strong><\/td><td>Yes<\/td><td>Yes<\/td><\/tr><tr><td><strong>Enforcement<\/strong><\/td><td>CPPA and California AG; private right of action for breaches<\/td><td>National data protection authorities<\/td><\/tr><tr><td><strong>Maximum penalties<\/strong><\/td><td>$7,988 per intentional violation; $107-$799 per consumer for breaches<\/td><td>Up to &euro;20 million or 4% of global annual revenue<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The biggest difference is the consent model. The GDPR requires opt-in consent before most data processing. The CCPA uses an opt-out approach: you can collect and use data unless the consumer requests you stop selling or sharing it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you&rsquo;re doing business with both California consumers and EU\/UK residents, you&rsquo;ll need to comply with both laws. Many GDPR practices (such as clear privacy notices and honoring data requests) will help with CCPA compliance too.<\/p>\n\n\n\n<h2 id=\"h-how-is-constant-contact-helping-me-comply-with-ccpa\" class=\"wp-block-heading\">How is Constant Contact helping me comply with CCPA?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Constant Contact is dedicated to ensuring that our products allow our customers to comply with their obligations under the CCPA. Where required, we will support you in fulfilling CCPA-related requests that you receive from your contacts.<\/p>\n\n\n\n<h2 id=\"h-i-m-a-customer-from-california-how-can-i-learn-more\" class=\"wp-block-heading\">I&rsquo;m a customer from California &ndash; how can I learn more?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you are a California consumer and exercise your CCPA rights as a Constant Contact customer, Constant Contact will respond in accordance with our <a href=\"https:\/\/privacy.constantcontact.com\/policies?name=customer-data-privacy-rights\">Privacy Notice<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The <a href=\"https:\/\/privacy.constantcontact.com\/policies?name=customer-data-privacy-rights\">Constant Contact Privacy Center<\/a> explains what information we collect about you as a Constant Contact customer and how we handle your personal information. This notice includes descriptions of how your personal information is used by Constant Contact.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">formation is used by Constant Contact.<\/p>\n\n\n\n<h2 id=\"h-how-can-i-access-correct-or-export-my-consumers-data\" class=\"wp-block-heading\">How can I access, correct, or export my consumers&rsquo; data?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You can view and update a contact&rsquo;s information on the contact profile page within your Constant Contact account.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Your contacts can also access and update their information and their marketing preferences by clicking the update profile link in the footer of each email that is sent to them by using the Constant Contact service. By default, the update profile form only shows a contact&rsquo;s email address. If you&rsquo;re storing more information about contacts, you can enable those fields to be visible to contacts as well. <a href=\"https:\/\/knowledgebase.constantcontact.com\/articles\/KnowledgeBase\/5778-update-profile-form\">Read more about how to customize the update profile form<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can <a href=\"https:\/\/knowledgebase.constantcontact.com\/articles\/KnowledgeBase\/33114-Export-Contacts-Out-of-Constant-Contact-and-into-a-Spreadsheet?lang=en_US\">export your contacts&rsquo; data<\/a> at any time. Follow the link to learn more.<\/p>\n\n\n\n<h2 id=\"h-what-if-you-have-more-questions-about-the-ccpa\" class=\"wp-block-heading\">What if you have more questions about the CCPA?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you have specific questions about the assistance we can offer with the CCPA, please <a href=\"https:\/\/community.constantcontact.com\/contact-support\">contact Support<\/a> or privacy@constantcontact.com.<\/p>\n\n\n\n<h2 id=\"h-recent-updates-and-what-s-next\" class=\"wp-block-heading\">Recent updates and what&rsquo;s next<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The CPRA regulations are now fully in effect, and the California Privacy Protection Agency continues to issue guidance and updates. California has also passed additional amendments to the CCPA framework, and the law continues to evolve. For businesses subject to the CCPA, staying informed about these developments is an ongoing responsibility.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Find more information on the <a href=\"https:\/\/leginfo.legislature.ca.gov\/faces\/billNavClient.xhtml?bill_id=201720180AB375\">CCPA website<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong><em>Remember:<\/em><\/strong> <em>the information above is meant to guide you through the process of understanding the CCPA and is not a substitute for legal advice. Find more information on the<\/em> <a href=\"https:\/\/leginfo.legislature.ca.gov\/faces\/billNavClient.xhtml?bill_id=201720180AB375\"><em>CCPA website<\/em><\/a><em>.<\/em><\/p>\n\n\n\n<h2 id=\"h-frequently-asked-questions\" class=\"wp-block-heading\">Frequently asked questions<\/h2>\n\n\n\n<h3 id=\"h-what-does-ccpa-compliance-mean\" class=\"wp-block-heading\">What does CCPA compliance mean?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">CCPA compliance means your business meets the requirements of the California Consumer Privacy Act. This includes providing required disclosures about your data practices, honoring consumer rights requests (such as requests to delete or opt out), posting the appropriate opt-out links, and responding to requests within the required timeframes.<\/p>\n\n\n\n<h3 id=\"h-who-must-comply-with-the-ccpa\" class=\"wp-block-heading\">Who must comply with the CCPA?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">For-profit businesses doing business in California must comply if they meet any one of three thresholds: annual gross revenue over $26.6 million (inflation-adjusted), buying\/selling\/sharing personal information of 100,000+ California consumers annually, or deriving 50%+ of annual revenue from selling personal information. Nonprofits are generally exempt unless affiliated with a covered for-profit entity.<\/p>\n\n\n\n<h3 id=\"h-is-the-ccpa-the-same-as-the-cpra\" class=\"wp-block-heading\">Is the CCPA the same as the CPRA?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No, but they&rsquo;re closely related. The CPRA (California Privacy Rights Act) is an amendment to the CCPA that took effect January 1, 2023. It expanded the CCPA by adding new consumer rights (including the rights to correct and limit use of sensitive data), creating the California Privacy Protection Agency, and updating various requirements. The laws work together, and businesses often refer to the combined framework as &ldquo;CCPA\/CPRA.&rdquo;<\/p>\n\n\n\n<h3 id=\"h-how-long-do-businesses-have-to-respond-to-a-consumer-request\" class=\"wp-block-heading\">How long do businesses have to respond to a consumer request?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">You must respond to most verified consumer requests within 45 days. You can extend this deadline by an additional 45 days if reasonably necessary, but you must notify the consumer of the extension within the first 45 days. For opt-out requests (Do Not Sell or Share), you must honor the request within 15 business days.<\/p>\n\n\n\n<h3 id=\"h-does-the-ccpa-apply-to-nonprofits\" class=\"wp-block-heading\">Does the CCPA apply to nonprofits?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Generally, no. The CCPA applies to for-profit businesses only. However, a nonprofit may need to comply if it shares common branding with a for-profit business, is controlled by a for-profit business, or controls a for-profit business that is subject to the CCPA. If you&rsquo;re unsure whether your nonprofit is covered, consult with legal counsel.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n<\/body><\/html>\n","protected":false},"excerpt":{"rendered":"<p>The CCPA, which is short for the California Consumer Privacy Act, is a law designed to enhance privacy rights for consumers in California and to encourage transparency regarding how businesses collect and use personal information. The CCPA took effect on January 1, 2020, and was significantly amended by the California Privacy Rights Act (CPRA), which [&hellip;]<\/p>\n","protected":false},"author":617,"featured_media":172698,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false,"post_signup_destination":"default"},"categories":[1494],"tags":[9827,8860],"content_type":[1462],"industry":[],"feature":[],"article_type":[],"coauthors":[8355],"class_list":["post-123175","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-small-biz-marketing","tag-compliance","tag-email-marketing","content_type-blog-article"],"acf":{"article_thumbnail":false,"show_last_modified_date":true,"show_trial_cta":false,"show_prefooter_cta":true,"ctct_related_features":false,"post_signup_destination":"default","homepage_featured":false,"show_featured_image":false,"show_table_of_contents":true,"region":false,"explore_post_button_text":"Explore this article with AI","explore_post_link":"","post_hreflangs":false},"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.1 (Yoast SEO v27.1.1) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>CCPA Compliance: What Small Businesses Need to Know<\/title>\n<meta name=\"description\" content=\"A plain-English guide to CCPA compliance, consumer rights, and how Constant Contact can help you comply.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.constantcontact.com\/blog\/ccpa\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CCPA Compliance: What Small Businesses Need to Know\" \/>\n<meta property=\"og:description\" content=\"A plain-English guide to CCPA compliance, consumer rights, and how Constant Contact can help you comply.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.constantcontact.com\/blog\/ccpa\/\" \/>\n<meta property=\"og:site_name\" content=\"Constant Contact\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/constantcontact\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-20T18:33:40+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-20T18:33:44+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.constantcontact.com\/blog\/wp-content\/uploads\/2019\/12\/Click-social-3.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1201\" \/>\n\t<meta property=\"og:image:height\" content=\"631\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Rachel Feser\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.constantcontact.com\/blog\/wp-content\/uploads\/2019\/12\/Click-social-3.png\" \/>\n<meta name=\"twitter:creator\" content=\"@jakelink\" \/>\n<meta name=\"twitter:site\" content=\"@constantcontact\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.constantcontact.com\/blog\/ccpa\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.constantcontact.com\/blog\/ccpa\/\"},\"author\":{\"name\":\"Jake Link\",\"@id\":\"https:\/\/www.constantcontact.com\/blog\/#\/schema\/person\/400f47ee66ee9ff06741bf7624a83c12\"},\"headline\":\"CCPA Compliance: What Small Businesses Need to Know\",\"datePublished\":\"2026-08-20T18:33:40+00:00\",\"dateModified\":\"2026-08-20T18:33:44+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.constantcontact.com\/blog\/ccpa\/\"},\"wordCount\":2600,\"publisher\":{\"@id\":\"https:\/\/www.constantcontact.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.constantcontact.com\/blog\/ccpa\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.constantcontact.com\/blog\/wp-content\/uploads\/2019\/12\/ccpa.png\",\"keywords\":[\"compliance\",\"email marketing\"],\"articleSection\":[\"Small Business Marketing\"],\"inLanguage\":\"en-US\",\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\/\/www.constantcontact.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.constantcontact.com\/blog\/ccpa\/\",\"url\":\"https:\/\/www.constantcontact.com\/blog\/ccpa\/\",\"name\":\"CCPA Compliance: What Small Businesses Need to Know\",\"isPartOf\":{\"@id\":\"https:\/\/www.constantcontact.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.constantcontact.com\/blog\/ccpa\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.constantcontact.com\/blog\/ccpa\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.constantcontact.com\/blog\/wp-content\/uploads\/2019\/12\/ccpa.png\",\"datePublished\":\"2026-08-20T18:33:40+00:00\",\"dateModified\":\"2026-08-20T18:33:44+00:00\",\"description\":\"A plain-English guide to CCPA compliance, consumer rights, and how Constant Contact can help you comply.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.constantcontact.com\/blog\/ccpa\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.constantcontact.com\/blog\/ccpa\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.constantcontact.com\/blog\/ccpa\/#primaryimage\",\"url\":\"https:\/\/www.constantcontact.com\/blog\/wp-content\/uploads\/2019\/12\/ccpa.png\",\"contentUrl\":\"https:\/\/www.constantcontact.com\/blog\/wp-content\/uploads\/2019\/12\/ccpa.png\",\"width\":796,\"height\":316},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.constantcontact.com\/blog\/ccpa\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.constantcontact.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CCPA Compliance: What Small Businesses Need to Know\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.constantcontact.com\/blog\/#website\",\"url\":\"https:\/\/www.constantcontact.com\/blog\/\",\"name\":\"Constant Contact\",\"description\":\"Small Business Online Marketing Solutions\",\"publisher\":{\"@id\":\"https:\/\/www.constantcontact.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.constantcontact.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.constantcontact.com\/blog\/#organization\",\"name\":\"ConstantContact\",\"url\":\"https:\/\/www.constantcontact.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.constantcontact.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.constantcontact.com\/blog\/wp-content\/uploads\/2026\/02\/constant-contact-share-logo-square.jpg\",\"contentUrl\":\"https:\/\/www.constantcontact.com\/blog\/wp-content\/uploads\/2026\/02\/constant-contact-share-logo-square.jpg\",\"width\":300,\"height\":275,\"caption\":\"ConstantContact\"},\"image\":{\"@id\":\"https:\/\/www.constantcontact.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/constantcontact\/\",\"https:\/\/x.com\/constantcontact\",\"https:\/\/www.instagram.com\/constantcontact\",\"https:\/\/www.linkedin.com\/company\/constant-contact\/\",\"https:\/\/www.pinterest.com\/constantcontact\/\",\"https:\/\/www.youtube.com\/user\/constantcontact\",\"https:\/\/en.wikipedia.org\/wiki\/Constant_Contact\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.constantcontact.com\/blog\/#\/schema\/person\/400f47ee66ee9ff06741bf7624a83c12\",\"name\":\"Jake Link\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.constantcontact.com\/blog\/#\/schema\/person\/image\/c0ddb67d26153748eb52de3a81813819\",\"url\":\"https:\/\/www.constantcontact.com\/blog\/wp-content\/uploads\/2019\/08\/Jake-Link-Headshot-96x96.jpg\",\"contentUrl\":\"https:\/\/www.constantcontact.com\/blog\/wp-content\/uploads\/2019\/08\/Jake-Link-Headshot-96x96.jpg\",\"caption\":\"Jake Link\"},\"description\":\"Former Senior Content Manager at Constant Contact. I like empowering small business owners and nonprofit professionals to reach their audiences with stories that motivate action.\",\"sameAs\":[\"https:\/\/www.jakelinkwebsite.com\/\",\"https:\/\/x.com\/jakelink\"],\"url\":\"https:\/\/www.constantcontact.com\/blog\/author\/jlink\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"CCPA Compliance: What Small Businesses Need to Know","description":"A plain-English guide to CCPA compliance, consumer rights, and how Constant Contact can help you comply.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.constantcontact.com\/blog\/ccpa\/","og_locale":"en_US","og_type":"article","og_title":"CCPA Compliance: What Small Businesses Need to Know","og_description":"A plain-English guide to CCPA compliance, consumer rights, and how Constant Contact can help you comply.","og_url":"https:\/\/www.constantcontact.com\/blog\/ccpa\/","og_site_name":"Constant Contact","article_publisher":"https:\/\/www.facebook.com\/constantcontact\/","article_published_time":"2026-08-20T18:33:40+00:00","article_modified_time":"2026-08-20T18:33:44+00:00","og_image":[{"width":1201,"height":631,"url":"https:\/\/www.constantcontact.com\/blog\/wp-content\/uploads\/2019\/12\/Click-social-3.png","type":"image\/png"}],"author":"Rachel Feser","twitter_card":"summary_large_image","twitter_image":"https:\/\/www.constantcontact.com\/blog\/wp-content\/uploads\/2019\/12\/Click-social-3.png","twitter_creator":"@jakelink","twitter_site":"@constantcontact","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.constantcontact.com\/blog\/ccpa\/#article","isPartOf":{"@id":"https:\/\/www.constantcontact.com\/blog\/ccpa\/"},"author":{"name":"Jake Link","@id":"https:\/\/www.constantcontact.com\/blog\/#\/schema\/person\/400f47ee66ee9ff06741bf7624a83c12"},"headline":"CCPA Compliance: What Small Businesses Need to Know","datePublished":"2026-08-20T18:33:40+00:00","dateModified":"2026-08-20T18:33:44+00:00","mainEntityOfPage":{"@id":"https:\/\/www.constantcontact.com\/blog\/ccpa\/"},"wordCount":2600,"publisher":{"@id":"https:\/\/www.constantcontact.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.constantcontact.com\/blog\/ccpa\/#primaryimage"},"thumbnailUrl":"https:\/\/www.constantcontact.com\/blog\/wp-content\/uploads\/2019\/12\/ccpa.png","keywords":["compliance","email marketing"],"articleSection":["Small Business Marketing"],"inLanguage":"en-US","copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/www.constantcontact.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/www.constantcontact.com\/blog\/ccpa\/","url":"https:\/\/www.constantcontact.com\/blog\/ccpa\/","name":"CCPA Compliance: What Small Businesses Need to Know","isPartOf":{"@id":"https:\/\/www.constantcontact.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.constantcontact.com\/blog\/ccpa\/#primaryimage"},"image":{"@id":"https:\/\/www.constantcontact.com\/blog\/ccpa\/#primaryimage"},"thumbnailUrl":"https:\/\/www.constantcontact.com\/blog\/wp-content\/uploads\/2019\/12\/ccpa.png","datePublished":"2026-08-20T18:33:40+00:00","dateModified":"2026-08-20T18:33:44+00:00","description":"A plain-English guide to CCPA compliance, consumer rights, and how Constant Contact can help you comply.","breadcrumb":{"@id":"https:\/\/www.constantcontact.com\/blog\/ccpa\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.constantcontact.com\/blog\/ccpa\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.constantcontact.com\/blog\/ccpa\/#primaryimage","url":"https:\/\/www.constantcontact.com\/blog\/wp-content\/uploads\/2019\/12\/ccpa.png","contentUrl":"https:\/\/www.constantcontact.com\/blog\/wp-content\/uploads\/2019\/12\/ccpa.png","width":796,"height":316},{"@type":"BreadcrumbList","@id":"https:\/\/www.constantcontact.com\/blog\/ccpa\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.constantcontact.com\/blog\/"},{"@type":"ListItem","position":2,"name":"CCPA Compliance: What Small Businesses Need to Know"}]},{"@type":"WebSite","@id":"https:\/\/www.constantcontact.com\/blog\/#website","url":"https:\/\/www.constantcontact.com\/blog\/","name":"Constant Contact","description":"Small Business Online Marketing Solutions","publisher":{"@id":"https:\/\/www.constantcontact.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.constantcontact.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.constantcontact.com\/blog\/#organization","name":"ConstantContact","url":"https:\/\/www.constantcontact.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.constantcontact.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.constantcontact.com\/blog\/wp-content\/uploads\/2026\/02\/constant-contact-share-logo-square.jpg","contentUrl":"https:\/\/www.constantcontact.com\/blog\/wp-content\/uploads\/2026\/02\/constant-contact-share-logo-square.jpg","width":300,"height":275,"caption":"ConstantContact"},"image":{"@id":"https:\/\/www.constantcontact.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/constantcontact\/","https:\/\/x.com\/constantcontact","https:\/\/www.instagram.com\/constantcontact","https:\/\/www.linkedin.com\/company\/constant-contact\/","https:\/\/www.pinterest.com\/constantcontact\/","https:\/\/www.youtube.com\/user\/constantcontact","https:\/\/en.wikipedia.org\/wiki\/Constant_Contact"]},{"@type":"Person","@id":"https:\/\/www.constantcontact.com\/blog\/#\/schema\/person\/400f47ee66ee9ff06741bf7624a83c12","name":"Jake Link","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.constantcontact.com\/blog\/#\/schema\/person\/image\/c0ddb67d26153748eb52de3a81813819","url":"https:\/\/www.constantcontact.com\/blog\/wp-content\/uploads\/2019\/08\/Jake-Link-Headshot-96x96.jpg","contentUrl":"https:\/\/www.constantcontact.com\/blog\/wp-content\/uploads\/2019\/08\/Jake-Link-Headshot-96x96.jpg","caption":"Jake Link"},"description":"Former Senior Content Manager at Constant Contact. I like empowering small business owners and nonprofit professionals to reach their audiences with stories that motivate action.","sameAs":["https:\/\/www.jakelinkwebsite.com\/","https:\/\/x.com\/jakelink"],"url":"https:\/\/www.constantcontact.com\/blog\/author\/jlink\/"}]}},"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/www.constantcontact.com\/blog\/wp-content\/uploads\/2019\/12\/ccpa.png","_links":{"self":[{"href":"https:\/\/www.constantcontact.com\/blog\/wp-json\/wp\/v2\/posts\/123175","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.constantcontact.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.constantcontact.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.constantcontact.com\/blog\/wp-json\/wp\/v2\/users\/617"}],"replies":[{"embeddable":true,"href":"https:\/\/www.constantcontact.com\/blog\/wp-json\/wp\/v2\/comments?post=123175"}],"version-history":[{"count":3,"href":"https:\/\/www.constantcontact.com\/blog\/wp-json\/wp\/v2\/posts\/123175\/revisions"}],"predecessor-version":[{"id":172699,"href":"https:\/\/www.constantcontact.com\/blog\/wp-json\/wp\/v2\/posts\/123175\/revisions\/172699"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.constantcontact.com\/blog\/wp-json\/wp\/v2\/media\/172698"}],"wp:attachment":[{"href":"https:\/\/www.constantcontact.com\/blog\/wp-json\/wp\/v2\/media?parent=123175"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.constantcontact.com\/blog\/wp-json\/wp\/v2\/categories?post=123175"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.constantcontact.com\/blog\/wp-json\/wp\/v2\/tags?post=123175"},{"taxonomy":"content_type","embeddable":true,"href":"https:\/\/www.constantcontact.com\/blog\/wp-json\/wp\/v2\/content_type?post=123175"},{"taxonomy":"industry","embeddable":true,"href":"https:\/\/www.constantcontact.com\/blog\/wp-json\/wp\/v2\/industry?post=123175"},{"taxonomy":"feature","embeddable":true,"href":"https:\/\/www.constantcontact.com\/blog\/wp-json\/wp\/v2\/feature?post=123175"},{"taxonomy":"article_type","embeddable":true,"href":"https:\/\/www.constantcontact.com\/blog\/wp-json\/wp\/v2\/article_type?post=123175"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.constantcontact.com\/blog\/wp-json\/wp\/v2\/coauthors?post=123175"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}