[Privacy & Consent](/categories/privacy-and-consent) November 3, 2026

# What does CCPA stand for? The California privacy law

CCPA stands for the California Consumer Privacy Act. See who must comply, the rights it gives, how it differs from the CPRA and what it means for tags.

![](/images/65d75b0ae8d69ef95785a5d6_david-pombar.webp)

**[David Pombar](/author/david-pombar)** Swiss army knife at Trackingplan

6 min read · 1411 words

> **TL;DR** CCPA stands for the ** California Consumer Privacy Act**, a state law signed in 2018 and in force since January 1, 2020. It gives California residents the right to know, delete and correct the personal information a business holds about them, and to opt out of its sale or sharing. The CPRA amended it in 2023, and the CPPA enforces it. For a website, the part that breaks most often is the opt-out: a pixel that keeps sending data after the visitor said no.

CCPA is one of those acronyms that shows up in a privacy policy footer, a cookie banner and a legal ticket in the same week. It stands for the California Consumer Privacy Act. What it asks of your site is less obvious than its name, so this post covers what each letter means, who has to comply, and where it touches your tags.

## What CCPA stands for

**California Consumer Privacy Act.** It is a California state law, signed on June 28, 2018 as Assembly Bill 375 and [in force since January 1, 2020](https://en.wikipedia.org/wiki/California_Consumer_Privacy_Act). The California Attorney General describes it as a law that "gives consumers more control over the personal information that businesses collect about them" ([CCPA, State of California Department of Justice](https://oag.ca.gov/privacy/ccpa)).

Each word narrows what it covers:

-   **California:** it protects California residents. The business can be anywhere.
-   **Consumer:** any natural person who lives in California, even when temporarily outside the state. Not only your customers: a visitor who never buys is a consumer too.
-   **Privacy:** of personal information, which is broader than names and emails (more on that below).
-   **Act:** a statute in the California Civil Code, with regulations that spell out how to apply it.

![The four letters of CCPA spelled out as California, Consumer, Privacy and Act, each with what it covers, above a timeline: CCPA signed in June 2018, in force in January 2020, CPRA approved in November 2020, CPRA amendments in January 2023, and amounts adjusted for inflation in January 2025.](/images/what-does-ccpa-stand-for-letters.webp)

What each letter covers, and the five dates that shaped the law you comply with today.

## CCPA, CPRA and CPPA

Three acronyms, one law. They get mixed up because they differ by a single letter.

| Acronym | Stands for | What it is |
| --- | --- | --- |
| **CCPA** | California Consumer Privacy Act | The law, from 2018 |
| **CPRA** | California Privacy Rights Act | Proposition 24, approved in November 2020, which amended the CCPA from January 1, 2023 |
| **CPPA** | California Privacy Protection Agency | The agency the CPRA created to enforce the law, alongside the Attorney General |

When someone says "CPRA compliance" today, they mean compliance with the CCPA as the CPRA amended it. There is one law to follow. The agency behind it has [its own explainer](/blog/cppa-en).

![The dome and pediment of the California State Capitol in Sacramento against a deep blue sky, with the United States and California flags flying above it](/images/what-does-ccpa-stand-for-capitol.jpg)

The California State Capitol in Sacramento, where the CCPA was passed in 2018. Image: Radomianin, Wikimedia Commons, public domain

## Who has to comply

The CCPA applies to for-profit businesses that do business in California and meet any one of three thresholds ([Attorney General FAQ](https://oag.ca.gov/privacy/ccpa)):

1.  Annual gross revenue above $25 million, adjusted for inflation: **$26,625,000** since January 1, 2025 ([CPPA announcement](https://cppa.ca.gov/announcements/2024/20241217.html)).
2.  Buying, selling or sharing the personal information of **100,000 or more** California residents or households.
3.  Deriving **50% or more** of annual revenue from selling or sharing California residents' personal information.

The second threshold is the one marketing teams underestimate. A site with ad pixels that reaches 100,000 California residents a year can meet it without selling anything in the everyday sense of the word. Nonprofits and government agencies are generally out of scope.

## The rights it gives

California residents can ask a business covered by the law to:

-   **Know** what personal information it collects about them, and how it is used and shared.
-   **Delete** the personal information collected from them, with some exceptions.
-   **Correct** inaccurate personal information (since 2023).
-   **Opt out** of the sale or sharing of their personal information, including through the Global Privacy Control (GPC), a signal the browser sends.
-   **Limit** the use and disclosure of sensitive personal information (since 2023).
-   **Not be discriminated against** for using any of these rights.

The first three are handled by a request process. The opt-out is different: it has to work on every page, for every visitor, in real time. That makes it a tracking problem as much as a legal one.

## Personal information is more than an email

Under the CCPA, personal information is anything that "identifies, relates to, or could reasonably be linked with" a person or a household. The Attorney General's examples include internet browsing history, geolocation data and inferences used to build a profile of someone's preferences ([CCPA FAQ](https://oag.ca.gov/privacy/ccpa)).

That covers most of what analytics and advertising tags send: a page URL, a click ID, a device identifier, a purchase. And "sharing" has a precise meaning: sharing for cross-context behavioral advertising, which the Attorney General defines as targeting ads based on someone's activity across many websites. That is what an ad pixel does.

## What the CCPA means for your tracking

For a website, the CCPA turns into three things to get right:

-   **A "Do Not Sell or Share My Personal Information" link**, which businesses that sell or share must show. The [CCPA cookie banner](/blog/ccpa-cookie-banner) post covers the user experience.
-   **The GPC signal honored as an opt-out**, without the visitor having to click anything.
-   **Tags that stop after the opt-out.** This is where it fails in practice. A release moves a tag out of its consent trigger, a new campaign adds a pixel that never checks the opt-out state, a server-side container forwards a conversion the browser already blocked.

None of these failures shows up in a dashboard. The banner still appears, the link still works, and the advertising pixel keeps sending data after the visitor said no. You find out when someone audits the requests.

That is what Trackingplan watches on web and server-side traffic. It reads the consent state on every hit and flags any tag that fires after a rejection, keeps sending after consent is withdrawn, or fires before the visitor has chosen. Each finding comes with the hits, the destination and the cookies involved, which is the evidence a privacy lead needs. In the product's words: "GDPR, ePrivacy and CCPA-ready evidence trails." See how it works for [privacy and legal teams](/landings/privacy).

## Fines and enforcement

Since January 1, 2025, administrative fines go up to **$2,663 per violation** and ** $7,988 per intentional violation**, or when the violation involves the data of consumers known to be under 16 ([CPPA announcement](https://cppa.ca.gov/announcements/2024/20241217.html)). The Attorney General and the CPPA enforce the law.

Individuals cannot sue for most violations. The exception is a data breach caused by a failure to keep reasonable security, with statutory damages now between $107 and $799 per consumer per incident.

Per-violation fines add up on a site that sends the same request on every page view. That is why the opt-out matters more than its size on the page suggests. For the full list of obligations, read [CCPA compliance requirements](/blog/ccpa-compliance-requirements).

## Frequently asked questions

### What does CCPA stand for?

CCPA stands for the California Consumer Privacy Act, a California state law from 2018 that gives California residents rights over the personal information businesses collect about them: to know, to delete, to correct, to opt out of its sale or sharing, to limit the use of sensitive information, and not to be discriminated against for using those rights.

### What is the difference between the CCPA and the CPRA?

The CPRA, the California Privacy Rights Act, is not a separate law to comply with. Approved by voters as Proposition 24 in November 2020, it amended the CCPA from January 1, 2023: it added the rights to correct and to limit sensitive personal information, extended the opt-out to sharing for cross-context behavioral advertising, and created the California Privacy Protection Agency (CPPA) to enforce the law.

### Does the CCPA apply to companies outside California?

Yes. It applies to for-profit businesses that do business in California and meet one of three thresholds: annual gross revenue above the adjusted amount ($26,625,000 since January 2025), buying, selling or sharing the personal information of 100,000 or more California residents or households, or deriving half or more of their annual revenue from selling or sharing it. Where the company is based does not matter.

### Is the CCPA the same as the GDPR?

No. The GDPR asks for a legal basis, often consent, before personal data is processed. The CCPA lets businesses collect personal information with notice, and gives residents the right to opt out of its sale or sharing. A site that serves both the EU and California needs both: consent before tracking for EU visitors, and a working opt-out, including the Global Privacy Control signal, for California residents.

Part of[Privacy compliance for analytics: the complete guide](/blog/privacy-compliance-for-analytics-complete-guide-2026-en)

On this page

1.  [*01*What CCPA stands for](#what-ccpa-stands-for)
2.  [*02*CCPA, CPRA and CPPA](#ccpa-cpra-and-cppa)
3.  [*03*Who has to comply](#who-has-to-comply)
4.  [*04*The rights it gives](#the-rights-it-gives)
5.  [*05*Personal information is more than an email](#personal-information-is-more-than-an-email)
6.  [*06*What the CCPA means for your tracking](#what-the-ccpa-means-for-your-tracking)
7.  [*07*Fines and enforcement](#fines-and-enforcement)
8.  [*08*Frequently asked questions](#frequently-asked-questions)

**Stop babysitting tags**

Trackingplan audits your real user data around the clock and flags issues before they cost you.

[Start free trial →](https://app.trackingplan.com/signup)

![](/images/65d75b0ae8d69ef95785a5d6_david-pombar.webp)

**David Pombar** Swiss army knife at Trackingplan

Read more from David, a Senior Product Strategist with 18+ years in digital product development and an atypical error detection knack.

Share Copy link [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.trackingplan.com%2Fblog%2Fwhat-does-ccpa-stand-for) [X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.trackingplan.com%2Fblog%2Fwhat-does-ccpa-stand-for&text=What%20does%20CCPA%20stand%20for%3F%20The%20California%20privacy%20law)

Read next

[All Blog →](/blog)

-   [
    
    14 minPrivacy & ConsentAugust 6, 2026
    
    ### CCPA Compliance Requirements: A Guide for Data Teams
    
    Master CCPA compliance requirements with actionable guidance on consumer rights, data mapping, analytics pixels, and enforcement. Built for data and marketing
    
    by **David Pombar**](/blog/ccpa-compliance-requirements)
-   [
    
    16 minPrivacy & ConsentJuly 17, 2026
    
    ### CCPA Cookie Banner: Easy 2026 Compliance Guide
    
    Master your CCPA cookie banner setup with our 2026 compliance guide. Learn best practices and ensure your website is fully compliant.
    
    by **David Pombar**](/blog/ccpa-cookie-banner)
-   [
    
    9 minPrivacy & ConsentJuly 21, 2026
    
    ### CPPA: California's Privacy Enforcement Agency Explained
    
    Discover how the CPPA safeguards your privacy rights in California, enforcing laws and providing vital consumer services. Learn more now!
    
    by **David Pombar**](/blog/cppa-en)

Trackingplan

## See everything. Miss nothing.

Your implementations audited around the clock with real-time, real-user data. Real-time alerts about errors or changes in your data, campaigns, pixels, privacy and consent. Let AI flag issues before they cost you.

[Start free trial →](https://app.trackingplan.com/signup) [Book a demo](/demo)