Who is exempt from the CCPA?

The California Consumer Privacy Act (CCPA) does not apply to every organization or every type of personal information.

Common exemptions and exclusions include:

• Nonprofit organizations, which are generally outside the scope of the CCPA.

• Government agencies and public entities.

• Certain medical and health information that is already regulated under laws such as HIPAA or California medical privacy laws.

• Certain consumer credit information regulated under federal credit reporting laws.

• Certain personal information handled by financial institutions that are subject to applicable federal privacy laws.

These exemptions are often limited to specific organizations, activities, or types of data rather than providing a complete exemption from all CCPA obligations.

Businesses should therefore determine whether an exemption applies to the organization itself or only to certain personal information they process.