CCPA compliance

CCPA compliance refers to the set of obligations that businesses must follow under the California Consumer Privacy Act to protect the personal information of California residents. It requires companies to provide transparency around what data they collect, how it is used or shared, and to give consumers meaningful control over their personal information, especially through the right to opt out of the sale or sharing of their data. CCPA compliance involves updating internal processes, implementing the right disclosure and opt-out mechanisms, honoring GPC (Global Privacy Control) signals, and ensuring that consumer privacy choices are respected across all systems and vendors.

The CCPA applies to for-profit organizations that collect or process personal information from California residents and meet at least one of the following criteria:
• Generate over $25 million in annual gross revenue
• Buy, share, or receive the personal information of 100,000 or more consumers, households, or devices per year
• Earn 50% or more of their annual revenue from selling or sharing personal information

Even businesses located outside California must comply if they meet these thresholds. As the CPRA strengthened enforcement rules, organizations should also ensure they have proper governance, vendor controls, and user-rights processes in place.

To comply with the CCPA (and its CPRA amendments), businesses must implement transparency and consumer-rights controls across their data operations.

Key compliance requirements include:
• Clear privacy notices describing what personal information is collected, how it is used, and whether it is sold or shared
• A visible and accessible “Do Not Sell or Share My Personal Information” link or mechanism
• The ability to honor GPC (Global Privacy Control signals as valid opt-out requests
• Processes to limit the use of sensitive personal information
• Tools to manage, record, and enforce user rights requests, including access, deletion, and correction
• Strong vendor management controls to ensure third parties respect user choices
• Data governance and security measures aligned with CPRA’s expanded enforcement

Didomi enables organizations to meet these requirements through transparent consent and preference collection, automated rights management, and reliable syncing of user preferences across all platforms and vendors.