CCPA (California Consumer Privacy Act)

The CCPA / CPRA is California's privacy law and the most influential U.S. state privacy framework. Like GDPR, it grants rights of access, deletion, opt-out of sale, and limits on processing of sensitive categories. It applies to businesses meeting a revenue or data-volume threshold and processing California residents' data.

CCPA matters less to offshore hosts than GDPR because (a) the threshold is high enough that small offshore operators often fall under it, and (b) U.S. state privacy laws don't have the extraterritorial reach of GDPR. That said, hosts targeting U.S. customers and processing meaningful volumes of California residents' data should still publish a CCPA-compliant Privacy Policy with clear opt-out paths.