CCPA Compliance Tool & Platform

The law targets for-profit organisations that do business in California, decide the purposes and means of the processing, and cross one of three thresholds: annual gross revenue above 25 million dollars (a figure adjusted periodically for inflation), buying, selling or sharing the personal information of 100,000 or more Californian consumers or households a year, or drawing half or more of annual revenue from selling or sharing that information. No physical presence in the United States is required.

No, though it takes you a long way. The two texts differ at the root: the GDPR requires a lawful basis before any processing, whereas the CCPA works mainly on an opt-out model, where the consumer must be able to object after the fact. The CCPA adds notions the GDPR does not carry, such as the household, sharing for cross-context behavioural advertising, and the right to limit the use of sensitive personal information. In return it imposes neither a DPO nor restrictions on international transfers. The record of processing built for the GDPR remains the best starting point.

Many organisations are convinced they sell nothing and are wrong, because the definition is deliberately wide. Selling means disclosing personal information to a third party for monetary or any other valuable consideration. The CPRA added sharing, which covers disclosure for cross-context behavioural advertising even when no money changes hands. In practice most advertising trackers on a website fall into one category or the other, which triggers the duty to offer an opt-out and to honour opt-out preference signals sent by the visitor's browser, such as the Global Privacy Control.

Three clocks, easily confused. A verifiable request (access, deletion, correction) has to be acknowledged within ten business days, with an explanation of how it will be handled, then answered within forty-five calendar days of receipt, extendable once by a further forty-five days where the complexity warrants it and the consumer is told. The count starts when the request arrives, not when it has been verified. A request to opt out of sale or sharing runs on its own clock: no verification, but action within fifteen business days.

No. The CCPA is a Californian state law, not a certifiable standard: no body issues a CCPA certificate. What gets examined is your actual practice, by the California Attorney General and by the California Privacy Protection Agency created by the CPRA. That agency has also adopted rules requiring risk assessments for processing that presents a significant risk to consumer privacy, and periodic cybersecurity audits for certain businesses, phased in over several years.

The fine can reach 2,500 dollars per violation, and 7,500 dollars where the violation is intentional or involves the personal information of a consumer the business knows to be under sixteen. Each affected consumer can count as a separate violation, which changes the scale on a mass incident. The CPRA removed the automatic cure period businesses used to enjoy before the regulator. On top of that sits a private right of action, limited to breaches of certain unencrypted personal information, with statutory damages of 100 to 750 dollars per consumer per incident.

Because a consumer request is not an isolated ticket: you need to know which systems hold the data, which recipients it went to, whether it is still being shared with advertising partners, and then prove the response went out on time. A spreadsheet loses those links the moment a processing activity changes, warns nobody while the clock runs, and keeps no timestamped record of what was done. A dedicated tool holds the counter, ties each request to the systems involved and keeps evidence that stands up to scrutiny. In Vailor, the CCPA is added on request: its requirements join the controls you already maintain.