{
  "code": "CCPA",
  "name": "California Consumer Privacy Act (CCPA)",
  "version": "2020",
  "issuing_body": "State of California",
  "description": "California law that provides consumers with more control over the personal information that businesses collect about them",
  "regions": ["us"],
  "industries": ["all"],
  "effective_date": "2020-01-01",
  "is_global": false,
  "requirements": [
    { "reference_code": "1798.100", "title": "Right to know about personal information collected, disclosed or sold", "requirement_type": "mandatory", "category": "Consumer Rights", "description": "A consumer shall have the right to request that a business disclose the categories and specific pieces of personal information it collects about the consumer." },
    { "reference_code": "1798.105", "title": "Right to delete personal information", "requirement_type": "mandatory", "category": "Consumer Rights", "description": "A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from the consumer." },
    { "reference_code": "1798.110", "title": "Right to know categories of personal information", "requirement_type": "mandatory", "category": "Disclosure",
      "children": [
        { "reference_code": "1798.110(a)(1)", "title": "Categories of personal information collected", "description": "Disclose the categories of personal information it has collected about that consumer.", "requirement_type": "mandatory" },
        { "reference_code": "1798.110(a)(2)", "title": "Sources of personal information", "description": "Disclose the categories of sources from which the personal information is collected.", "requirement_type": "mandatory" },
        { "reference_code": "1798.110(a)(3)", "title": "Business purpose for collection", "description": "Disclose the business or commercial purpose for collecting or selling personal information.", "requirement_type": "mandatory" }
      ]
    },
    { "reference_code": "1798.115", "title": "Right to know about personal information sold or disclosed", "requirement_type": "mandatory", "category": "Consumer Rights" },
    { "reference_code": "1798.120", "title": "Right to opt-out of sale of personal information", "requirement_type": "mandatory", "category": "Consumer Rights", "description": "A consumer shall have the right, at any time, to direct a business that sells personal information about the consumer to third parties not to sell the consumer's personal information." },
    { "reference_code": "1798.125", "title": "Right to non-discrimination", "requirement_type": "mandatory", "category": "Non-Discrimination", "description": "A business shall not discriminate against a consumer because the consumer exercised any of the consumer's rights." },
    { "reference_code": "1798.130", "title": "Methods for submitting requests", "requirement_type": "mandatory", "category": "Request Handling", "description": "Provide at least two designated methods for submitting requests for information required to be disclosed, including, at a minimum, a toll-free telephone number." },
    { "reference_code": "1798.135", "title": "Opt-out notice requirements", "requirement_type": "mandatory", "category": "Notice & Disclosure", "description": "A business that sells consumers' personal information to third parties shall provide notice to consumers and provide a clear and conspicuous link on the business's internet homepage titled 'Do Not Sell My Personal Information'." },
    { "reference_code": "1798.140", "title": "Definitions and Scope", "requirement_type": "mandatory", "category": "Scope", "description": "Applies to for-profit businesses that collect consumers' personal information and meet one of the thresholds: gross annual revenue over $25M, buy/sell/receive/share personal information of 50,000+ consumers annually, or derive 50%+ of annual revenues from selling consumers' personal information." },
    { "reference_code": "1798.150", "title": "Security requirements and breach liability", "requirement_type": "mandatory", "category": "Security", "description": "Implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information from unauthorized access, destruction, use, modification, or disclosure." },
    { "reference_code": "1798.155", "title": "Privacy notice requirements", "requirement_type": "mandatory", "category": "Notice & Disclosure", "description": "A business shall provide a clear and conspicuous privacy notice in its privacy policy listing all categories of personal information it has collected, used, disclosed, and sold." }
  ]
}