CCPA Compliance
The California Consumer Privacy Act, now expanded by the CPRA, gives California residents real rights over their personal information — to know what's collected, to delete it, to correct it, to opt out of its sale or sharing, and to limit use of sensitive personal information. The law applies to a lot more companies than the ones that think of themselves as "in California," because it's triggered by doing business with California residents, not by where your headquarters sits.
The part companies skip
Most CCPA problems start with the same gap: a privacy policy that makes promises about data handling that the company can't actually back up, because nobody's mapped where personal information really lives. You can't honor a deletion request across all your systems if you don't know all the systems that hold the data. You can't answer an access request accurately if your customer data is scattered across a CRM, a marketing platform, a data warehouse, and three vendor tools, with no single source of truth.
How I build this out
I start with real data mapping — not a theoretical diagram, but tracing where personal information actually flows through your systems and vendors, including the service providers and third parties you share it with. From there, I help you build the operational side: a working process for handling consumer requests to know, delete, correct, and opt out, within the law's response windows, and a review of vendor contracts to make sure your service provider and third-party agreements actually include the required CCPA language.
I also look hard at the opt-out mechanics, since this is where enforcement attention has concentrated — whether your "Do Not Sell or Share My Personal Information" link actually works end to end, whether opt-out preference signals are honored, and whether sensitive personal information is being used in ways that require a separate opt-out. None of this is useful as a one-time project; I build the process so it keeps working as your vendor list and data flows change.
Who this is for
Businesses that collect California consumer data and have never done a real data mapping exercise, companies whose privacy policy has drifted away from what they actually do, and anyone who's gotten a consumer rights request and realized they don't have a real process to answer it.
If you want an honest look at where your CCPA program actually stands, get in touch.