What Is CCPA/CPRA?
The California Consumer Privacy Act (CCPA) is the most extensive state-level privacy law in the US, as revised by the California Privacy Rights Act (CPRA). It was first passed in 2018 and went into effect on January 1, 2020 with the CPRA reinforcing it in 2023.
Together, the CCPA and CPRA provide citizens of California with broad control over their personal data and place strict requirements on companies that gather, sell, or distribute their data. This means that any conditions offered to California users for clickwrap agreements must respect opt-out rights and contain privacy disclosures.
Who Does CCPA/CPRA Apply To?
All for-profit companies that gather personal data from Californians and satisfy any of these requirements are subject to CCPA/CPRA:
- Annual gross revenue exceeding $25 million.
- Buy, sell, or share the personal information of 100,000 or more California residents annually.
- Derive 50% or more of annual revenue from selling or sharing California residents' personal information.
The CCPA also applies to any company that controls or is controlled by a covered firm and has a shared brand. Even if your headquarters are not in California, you are still covered provided you meet the requirements and serve Californians.
CCPA/CPRA and Clickwrap Agreements
By enforcing requirements that go beyond terms acceptance sequences, CCPA/CPRA revolutionizes clickwrap design. The law requires specific opt-out mechanisms, notice at the point of collection, and separate consent pathways for sensitive data, rather than just asking users to "agree" to a privacy policy. A clickwrap that treats terms of service and privacy as a single checkbox is structurally illegal in California.
How CCPA/CPRA Affects Clickwrap Design
The right to opt out of the sale or sharing personal information is established by Section 1798.120, where clickwrap flows can't fulfill this entitlement; instead, a standalone mechanism that enables the customer to exercise the opt-out without accepting or rejecting any other conditions is needed. According to the laws of the California Privacy Protection Agency, this mechanism must be offered via a "Do Not Sell or Share My Personal Information" link that is visible and accessible on all pages where personal information is gathered.
Under Section 1798.125(b), businesses that offer financial incentives in exchange for personal information must obtain opt-in consent through a clearly described notice explaining the material terms of the program. This consent must be separate from the general clickwrap acceptance and cannot be a precondition of service.
The CPRA amendments introduced data minimization into the clickwrap scope, as by Section 1798.100(c), requiring that the collection and use of personal information be reasonably necessary and proportionate to the purpose disclosed at collection. A clickwrap that authorizes broad data collection can violate the minimization principle even if the consumer clicked "I agree."
Section 1798.120(c) prohibits the sale or sharing of personal information from consumers under 16 unless the consumer has affirmatively opted in.
What Must Be Shown Under CCPA/CPRA
According to Section 1798.100(b), customers must be given notice before the point of data collection outlining the types of personal data that will be gathered and how they will be used.
To comply with these restrictions, the following must be clearly displayed in your clickwrap agreement:
- Categories of personal information being collected, using the enumerated categories in Section 1798.140(v).
- The purpose for each category of information collected.
- Whether personal information is sold or shared, and with which categories of third parties.
- The retention period for each category of personal information, or the criteria used to determine retention.
- A conspicuous "Do Not Sell or Share" link, accessible without requiring the consumer to navigate away from the current page.
The CPPA's regulations further require that these disclosures be provided in a manner that is easy to read and understandable to consumers.
What Records You Must Keep Under CCPA/CPRA
Section 1798.130(a)(2) requires businesses to disclose, upon a verifiable consumer request, the specific pieces of personal information collected about the consumer and the purposes for which they were used. To respond to these requests accurately, the clickwrap agreement must maintain records that connect each consent event to the data practices it authorized.
A compliant consent record under CCPA/CPRA must capture:
- The consumer's identity - Email, user ID, or other attribute linking the acceptance to a specific individual.
- The version of the privacy notice and terms - Exact agreement presented at the time of consent, including the specific categories of information and purposes disclosed.
- The timestamp and method of the consent action - meeting the electronic record standards established by the ESIGN Act.
- The consumer's opt-out status - Whether the consumer exercised the "Do Not Sell or Share" right.
- Sensitive data consent status - Whether separate opt-in consent was obtained for sensitive personal information processing.
Businesses are required by Section 1798.130(a)(2) to provide consumers with the specific pieces of personal information gathered during the prior 12 months upon request in order to reconstruct what data practices were permitted at any given time within this interval.