CCPA Compliance for Survey Data: What US Businesses Need to Know
The California Consumer Privacy Act (CCPA), as amended by the CPRA, applies to any business meeting certain revenue or data-volume thresholds that collects personal information from California residents — which includes most companies running surveys with any meaningful California customer base, regardless of where the company itself is headquartered.
Who the CCPA Applies To
The CCPA applies to for-profit businesses that do business in California and meet at least one of: over $25 million in annual gross revenue, buy/sell/share personal information of 100,000+ California consumers or households annually, or derive 50%+ of annual revenue from selling personal information. Many mid-sized companies with a national customer base fall into the first threshold without realizing it.
Consumer Rights Under CCPA
California residents have the right to know what personal information you've collected about them, the right to delete it, the right to correct inaccurate information, and the right to opt out of the sale or sharing of their data. Survey responses containing identifying information fall squarely within scope.
Practical Steps for Survey Programs
Include a clear privacy notice on any survey collecting personal information, honor deletion and access requests within CCPA's required timelines (typically 45 days), and avoid selling or sharing survey response data with third parties without appropriate consumer disclosure and opt-out mechanisms.
CCPA vs GDPR
The two frameworks share common principles (transparency, deletion rights, data minimization) but differ in enforcement mechanism and specific requirements. If you're already CCPA compliant, you're most of the way to GDPR compliance, but the two aren't identical — GDPR requires an affirmative lawful basis for processing, which CCPA does not.
Other State Privacy Laws to Watch
California was first, but Virginia, Colorado, Connecticut, Utah, and a growing list of other states have since passed their own privacy laws with broadly similar but not identical requirements. If you operate nationally, build your compliance program around the strictest applicable requirements rather than maintaining separate state-by-state processes, which becomes unmanageable as more states pass their own legislation.
CCPA compliance for survey data is largely about the same fundamentals as any good data practice: collect only what you need, be transparent about it, and make it easy for people to exercise their rights over their own information.
