The California Consumer Privacy Act of 2018 and the CCPA regulations enacted thereunder (together, the "CCPA"), which entered into force on Jan. 1, 2020, is a California privacy law which extends new data privacy rights to California "consumers" (California residents), and requires businesses, among other things, to provide consumers with certain information regarding the business' privacy practices and the rights granted to consumers with respect to their personal information under the CCPA. These consumer rights include the "right to know" which information is processed by such businesses, the right to delete personal information collected by a business, the right to non-discrimination for exercising these rights, and most notably, the right to opt-out of a "sale" of personal information. However, not all disclosures of personal information by a business are regard a "sale", for example, transfers to "service providers" are not normally considered a "sale".
The CCPA applies to organizations which either has (i) annual gross revenues in excess of twenty-five million dollars; or which annually buys, receives, sells, or shares for commercial purposes, alone or in combination, the personal information of 50,000 or more consumers, households, or devices; or which derives 50% or more of their annual revenues from "selling" (as this term is defined in the CCPA) consumers’ personal information.
Under the CCPA, 'Personal information' means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, including information pertaining to a specific device (namely IoT enabled devices) provided it could be used to identify a particular consumer.