Understanding the scope and impact of the California Consumer Privacy Act of 2018

The California Consumer Privacy Act of 2018 (CCPA or the Act) marks a groundbreaking development in US privacy law. While the CCPA ostensibly regulates business practices involving the personal information of Californian consumers, the size, population and economic importance of California means the CCPA will be felt by businesses far beyond California’s borders. Just as Europe’s General Data Protection Regulation (GDPR) required many multinationals to conform their personal information processing to Europe’s high standards in data privacy, the CCPA is poised to have a similar effect in the USA when it goes into effect in 2020. Large companies and businesses that rely on the collection and dissemination of personal information from Californian consumers will need to begin evaluating their exposure now so as to move their operations into compliance. As a result, the CCPA will begin to have a noticeable effect on the personal information collection and disclosure practices of certain dataintensive industries. Moreover, the CCPA is likely to serve as a testing ground and catalyst for other laws pertaining to personal information and data privacy concerns. Thus, it is important to understand the impact of the CCPA in California, in the USA and globally. This paper discusses the scope and impact of the CCPA and critically evaluates the CCPA’s anticipated impact on businesses across select industries. Next, this paper contextualises the CCPA with the GDPR, identifying key similarities and differences between the two regimes. Finally, this paper looks ahead at how the CCPA may affect state and federal law on privacy and personal information protection.