What the CCPA Is
The California Consumer Privacy Act is the most influential US state privacy law. It passed in 2018, took effect on 1 January 2020, and was expanded by the California Privacy Rights Act, approved by voters in November 2020, with most changes effective from 1 January 2023. People often say "CCPA" to mean the amended law as a whole.
The CPRA also created the California Privacy Protection Agency, which writes regulations and enforces the law alongside the Attorney General. Regulations on risk assessments, cybersecurity audits and automated decision-making technology were finalised in 2025 and phase in from 2026.
This entry explains the law for growth and product teams. It is not legal advice.
Who It Applies To
The CCPA applies to for-profit businesses that do business in California and meet at least one of three thresholds. The first is annual gross revenue above an amount set at 25 million US dollars in the statute and adjusted for inflation every two years. The second is annually buying, selling or sharing the personal information of 100,000 or more California consumers or households. The third is deriving half or more of annual revenue from selling or sharing personal information.
A mobile app with a meaningful California audience can cross the 100,000 threshold quickly, because device IDs and IP addresses count as personal information.
What Counts as Personal Information
Personal information is broad: anything that identifies, relates to, or could reasonably be linked with a consumer or household. That includes advertising IDs, IP addresses, device identifiers, browsing and app activity, purchase history, and inferences drawn from them. The CPRA added a category of sensitive personal information, such as precise geolocation, account log-in details and certain demographic data, with a right to limit its use.
Selling, Sharing and Opt-Outs
Two terms matter most for advertising. "Selling" means disclosing personal information to a third party for money or other valuable consideration. "Sharing" means disclosing it to a third party for cross-context behavioral advertising, even if no money changes hands. Sending device-level data to an ad network so it can target your users elsewhere can fall under sharing.
Consumers can opt out of both. Businesses that sell or share must offer a clear "Do Not Sell or Share My Personal Information" option, and must treat browser and device signals such as Global Privacy Control as valid opt-out requests. For consumers under 16, selling and sharing need opt-in consent, from a parent for those under 13.
Service providers and contractors, such as an MMP processing data on an app's behalf under a written contract, are treated differently from third parties. Disclosures to them for a business purpose are not a sale, provided the contract limits how they use the data.
Consumer Rights
California residents can ask to know what personal information a business collects and how it is used, to delete it, to correct it, to opt out of sale and sharing, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. Your measurement setup should let you locate a user's data, including data held by service providers, and act on requests within the deadlines.
How Linkrunner Supports CCPA Programs
Linkrunner displays a CCPA badge on its Trust Center and offers a data processing agreement at /legal/dpa. PII hashing is an opt-in SDK setting, the IDFA is collected only with ATT consent, and postbacks to ad networks are mapped per network, so you control which events are sent where. Review with your legal team which of those flows count as sharing for your app.
The CCPA and Other US State Laws
California is no longer alone. Since the CCPA, many other US states have passed comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others, with more taking effect each year. They share the broad pattern of notice, consumer rights and opt-outs for targeted advertising and sale of data, but differ in thresholds, definitions, how they treat opt-out preference signals and whether they cover employee or business contact data.
For app teams, the practical approach is to build one set of controls that meets the strictest common requirements: clear notices, an easy way to opt out of targeted advertising and sale, respect for Global Privacy Control where the law requires it, and a process to answer access and deletion requests. Then check each state's differences with counsel.
Measurement setups should make this easy. Know which partners receive device-level data, be able to stop sending data for users who opt out, and keep a record of what was sent where.