A new privacy regulation similar to Europe’s Global Data Protection Regulation (GDPR) is looming for companies doing business in California, as that state’s Consumer Privacy Act takes effect at the beginning of 2020. A new survey shows businesses aren’t ready. 

The State of California passed sweeping privacy legislation in June 2018 calling for the strongest privacy measures of any state in the US, similar to the Global Data Protection Regulation (GDPR) in Europe.  

Even though companies have had over a year to prepare for the January 2020 deadline, it is clear that many, if not most, are woefully unprepared.

The California Consumer Privacy Act (CCPA) mandates several new privacy measures to be taken by companies doing business in the state. For example, if a business collects any personal information from customers, this must be disclosed in a clear privacy policy that specifies what data is being collected, how it is being collected, and what the data is being used for. Any sharing of customer data to third parties has to be clearly disclosed, and if the customer requests it, all personal data must be deleted. CCPA also requires that customers not be charged more if they exercise their privacy rights under the law.

Preparedness found wanting

However, there’s a problem: According to a survey released by PossibleNOW, which sells enterprise privacy management solutions, over half of US businesses say they don’t expect to be fully prepared by the time CCPA takes effect on New Year’s Day 2020.  

Respondents provided several reasons for not being ready, including:

35% said their primary reason is the cost of becoming compliant.

32% stated they were waiting to see how the CCPA will be enforced.

17% said they didn’t think their organization is large enough to face fines.

11% said the law is new to them and they are unsure of the requirements.

4% stated they didn’t think the law applies to them (in truth, some smaller companies are exempt from CCPA).

Penalties

According to PossibleNOW, the penalties for laggards could be stiff: for example, a company that is found in non-compliance related to 1,000 customers could face penalties ranging from $2.5 million to $7.5 million. And for the largest companies which rely heavily on user data – think the GAFA group (Google, Amazon, Facebook, Apple – all California-based companies), it’s easy to envision those costs going much higher than that.

The California governor’s office, which ultimately will be responsible for enforcing the new law, has not revealed yet whether it intends to offer lagging companies any additional time to comply with the regulation once 2020 rolls around. But relief or no relief, it is clear that companies will need to get on board soon if they want to continue to thrive in a state whose $3 trillion economy would rank as the fifth largest country in the world, larger than the UK, France or India. 

Latest reports from

Or to search over 50,000 other reports please visit

GlobalData Report Store

GlobalData is this website’s parent business intelligence company.