CCPA Sets America's Privacy Clock: One Year to January 2020

California passed the California Consumer Privacy Act in a hurry in June 2018. It was a deal struck to keep a stricter measure off the ballot, which explains both its speed and its rough edges. The law takes effect January 1, 2020. That is eleven months from this posting.

The substance will feel familiar in shape and new in vocabulary. Consumers gain the right to know what personal data a business collects about them and why. They can request deletion. They can opt out of the ‘sale’ of their data. Businesses owe disclosure duties, request-handling on statutory clocks, and a homepage link whose name will define the year: ‘Do Not Sell My Personal Information.’

Readers who did the GDPR work are starting from strength. Readers who skipped it on the grounds that Europe was far away should hear this plainly. The skipping era is ending, one state at a time. The question was never whether American privacy law would follow Europe’s. It was only in what accent.

The word ‘sell’ is doing more work than it appears

The provision that will surprise marketing teams is the statute’s definition of ‘sell.’ It is not the invoice-and-payment deal the plain word suggests. It reaches any exchange of personal data for ‘monetary or other valuable consideration.’

That sweeps in a big share of the adtech routine. The third-party cookies and pixels that feed ad platforms. The audience-matching uploads. The data flowing to analytics and marketing vendors where the ‘consideration’ is the service itself.

Whether any given tag counts as a sale is the kind of question that keeps privacy counsel employed. The statute has real gaps, and the Attorney General’s rules are still being drafted. But one thing is clear now, without waiting for the lawyers. You cannot classify data flows you have not inventoried. The tag census (every third-party script, what it collects, where it sends) is the document every ‘is this a sale?’ review will need. Teams that kept the census current will answer in an afternoon. Teams that did not will learn, again, that the inventory is the whole game.

What transfers from GDPR, and what diverges

• Transfers well: the data inventory and records of processing, since CCPA’s disclosure duties can be answered right from them. The vendor-contract review muscle, since the statute has its own service-provider terms and the GDPR paperwork is the template. The request-handling plumbing, since access and deletion workflows built for European rights extend to Californian ones with settings, not new builds. Most of all, the habit: someone owns privacy, processes exist, and the annual review is on the calendar.

• Diverges, and needs counsel: the consent model flips. GDPR asks for a lawful basis first. CCPA lets you collect but makes you honor the opt-out. The applicability tests differ too, based on revenue, records volume, and data selling. The ‘household’ idea in access rights has no European twin. And the private right of action attaches to breaches, which moves security practices straight into legal exposure for California data.

• The scoping question: should a national site build California-only handling, or extend the rights to everyone? The math usually answers it. Running two tiers of rights for one audience costs more than honoring the stricter tier for all. That is before you count the optics of telling non-Californians they matter less.

The baseline argument, restated

So the advice holds, now with a second statute behind it. Build one privacy-respecting baseline, set above the strictest rule that applies, rather than a per-law patchwork.

The patchwork (a GDPR layer for Europeans, a CCPA layer for Californians, defaults for everyone else) triples the engineering. It confuses the staff who run it. It drifts as each layer changes on its own schedule. And it delivers an experience that visibly ranks your visitors’ rights by their billing addresses.

The baseline costs more than the minimum this quarter and less than the patchwork by about the second statute. The second statute is here. More are visibly drafting behind it: state legislatures studying California’s template, federal proposals, and the international spread. Every new acronym finds the baseline teams already compliant in substance, shopping only for wording. It finds the patchwork teams funding another project. This January, with eleven months of runway, is the cheapest the baseline will ever be.

The year’s calendar

The work runs in the order the GDPR effort taught and the deadline confirms. The data inventory and tag census this quarter, since everything else stands on them. The sale analysis and vendor-contract review with counsel through the spring, tracking the Attorney General’s rules as they firm up.

The rights-handling extension and the Do Not Sell link built and tested by fall. That last item is interface work as much as legal work, and we will have opinions about doing it honestly. Then staff training and a documentation pass in the final quarter, so January 1 arrives as a checklist item rather than a scramble.

For the GDPR-prepared, most quarters are light. For everyone, the frame worth repeating: privacy is becoming plumbing. Ordinary infrastructure that every serious organization runs, audited on a calendar, boring by design. Install it once, properly, and the next acronym becomes a settings change. The alternative, redoing the plumbing every year under deadline pressure, is how teams end up hating both the law and their own websites. Eleven months. The inventory first. Same as last time, same as next time.