The California Consumer Privacy Act (CCPA), effective as of January 1, 2020, will regulate the collection, use, sale and disclosure of personal information about California consumers and households.
The CCPA will (1) require businesses to provide detailed notices of personal information processing activities, (2) grant a variety of rights to individuals, including a right to access, right to opt out of the sale of personal information, and right to delete personal information, and (3) prohibit discrimination against consumers on the basis of exercising their rights under CCPA. Personal information is defined as any information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California consumer or household.
The CCPA covers for-profit entities that:
- have gross revenues exceeding $25 million per year, or
- buy, receive, sell or share personal information of 50,000 or more consumers, households or devices per year, or
- derive at least half of annual revenue from the sale of personal information.
Stanford is a non-profit entity. However, depending on interpretive guidance from California authorities, the CCPA could apply at least indirectly to some university activities (e.g., where Stanford collaborates with for-profit institutions for research and marketing purposes).
