The California Consumer Privacy Act (CCPA) has been amended a number of times since its enactment in 2018. One of the latest amendments to the CCPA, California’s Assembly Bill No. 1824, recently took effect Jan. 1, 2025, and changed the CCPA in the context of mergers and acquisitions (M&A), and other types of corporate transactions. Under this amendment, any business acquiring personal information of a consumer from another business as an asset through a merger, acquisition, bankruptcy, or other types of transactions in which the transferee assumes control of all, or part, of the transferor must comply with opt-out of “sale” and “sharing” requests California residents made to the seller before their personal information is transferred to the buyer.

The CCPA is the first comprehensive data privacy law in the United States and applies to for-profit entities if they conduct business in California (even if they are not physically located in the state), collect California residents’ personal information, determine how and why the information should be processed, and meet one of the following thresholds: (1) have annual gross revenue in excess of $25 million (adjusted to $26,625,000 starting Jan. 1, 2025); (2) buy, sell, or share the personal information of 100,000 or more California residents or households; or (3) derive 50% or more of their annual revenue from selling or sharing California residents’ personal information. The CCPA may also apply to entities that share common branding and control with a company that meets the above requirements, certain joint ventures or partnerships made up of these businesses, and businesses that voluntarily certify to be subject to the CCPA.