The California Consumer Privacy Act is at last getting the attention of businesses, but that does not necessarily mean compliance is widespread. After amendments to the law and draft regulations from the California attorney general, only some things seem to be clarified; the CCPA’s legal complexity is the top challenge to compliance with the first comprehensive consumer privacy law of its kind in the United States.

Yet, efforts are underway, as a majority of businesses have concluded a preemptive federal law is unlikely any time soon.

Throughout 2019, the IAPP and OneTrust have fielded surveys to U.S.-based subscribers of IAPP’s Daily Dashboard seeking to benchmark and track CCPA compliance efforts over time. We published the first survey results in April and the second in September. This series of reports benchmarks and tracks CCPA compliance efforts over time.

Series Overview

Ready or not, here it comes
This report presents early‑2019 survey findings showing that most organizations were unprepared for the CCPA, citing lack of time, bandwidth and the law’s complexity as top obstacles. It highlights how many companies were taking a “wait‑and‑see” approach, despite the fast‑approaching January 1, 2020 effective date and July 1, 2020 enforcement date.
View report

CCPA Readiness: Second Wave
This article reports mid‑2019 survey results indicating improved preparedness since the first wave, though only 2% of organizations considered themselves fully compliant. It emphasizes that the biggest challenges—limited time, legal complexity and resource constraints—remained unchanged even as businesses progressed toward CCPA deadlines.
View report

CCPA Readiness: Third Wave
This article provides late‑2019 survey findings showing significant progress in CCPA readiness, with preparedness scores rising to 6.49/10 just weeks before the law’s implementation. However, fewer than half of organizations expected to be fully compliant by January 1, 2020, with many targeting the July 1 enforcement date instead.
View report

Search resources

All IAPP resources

Filter results

Resource type

Subject

Industry

Law and regulation

Domain

The Schrems II Decision: The Day After

The Privacy Briefing: Looking the Board in the Eye

Dual Literacy in Privacy and Security — A Guide for Infosec Professionals

Building Data Privacy into Your Infosec Stack

Privacy, Exposure Notification and Contact Tracing

How to Build a Culture of Privacy

Building a Privacy Culture in Our Conflicted Age

Practical Primer on Privacy Preparedness

Building Ethical Decision Making into Legal Advice on Data Protection

Uncover the Benefits of IAPP Online Privacy Training

Like Your Water, Is Your Data Privacy Transparent Enough?

The Inaugural Ian Kerr Memorial Lecture

Strategic Vendor Risk Management for Privacy Pros

Avoiding the pitfalls of CCPA noncompliance

How to maximize your IAPP membership

Celebrating Data Privacy Day with the IAPP Engagement team

How technology is racing ahead of medical ethics and family relationships

CCPA Readiness Series

The 7 Principles of Privacy by Design in Practice

Measuring Privacy Operations Report 2019