skip to content

CCPA

4 roadmaps34 questions

California's privacy law works on an opt-out model, giving consumers rights to know, delete, and stop the sale or sharing of their personal information, and it only binds businesses above certain thresholds. Interviewers ask because any product with US consumers ends up implementing it alongside GDPR.

part ofCompliance & governance standardsoverview, primer and where to startread it →
on this pageshow

explore

questions

page 2 of 2

Should a global product apply GDPR-style opt-in everywhere or run per-region defaults, and why does 'GDPR everywhere' still not make it CCPA compliant?

level: principalimportance: should knowfreq 30%

basics

~20 s

Either can work, but 'GDPR everywhere' is not a CCPA superset: California still needs its own notice contents, opt-out links or signal handling, a 45-day clock, a 24-month request log and under-16 sale rules, so a strict core needs California adapters.

open as a page

Under the CCPA, a fitness-tracker user switching to a rival device asks for her data — what does the portability requirement demand of the format?

level: middleimportance: nice to knowfreq 27%

basics

~20 s

Under Civil Code 1798.130(a)(3)(B)(iii), the specific pieces must be easily understandable and, to the extent technically feasible, in a structured, commonly used, machine-readable format she can transmit to another entity without hindrance, free of charge.

open as a page

Under the CCPA, what steps must the CPPA take before it can order a business to pay an administrative fine?

level: seniorimportance: nice to knowfreq 24%

basics

~20 s

Under the CCPA, the CPPA investigates on a complaint or its own initiative, serves notice at least 30 days before deciding probable cause, then holds an Administrative Procedure Act hearing and orders any fine, unless the parties agree a stipulated order (1798.199.45-1798.199.55).

open as a page

Under the CCPA, when is an out-of-state company 'doing business in California', and when does the wholly-outside-California exemption in 1798.145 apply?

level: seniorimportance: nice to knowfreq 26%

basics

~20 s

The Civil Code never defines 'does business in the State of California', so nexus turns on facts such as selling to, marketing to and collecting data from Californians. Separately, 1798.145(a)(1)(G) frees conduct only when every aspect happens wholly outside California.

open as a page

showing 31–34 of 34