Hm, to be honest, this is my first time hearing about this and perhaps most of our customers from California did not hit the $25 million revenue barrier or selling data from any Californian resident as nobody ever mentioned about this before.
As all our products are already in compliance with GDPR, it wouldn't be that difficult to implement CCPA. From what I have gathered so far, it looks like:
1. You need to allow users to choose if they allow you to share their data. (which is already what most GDPR confirmation does)
2. CCPA allows vendors to provide value added service if the user chooses to share their data. (I don't see how this affects the software)
3. Customer needs to know what information the website has about them (Which they can already do with GDPR compatibility in our extensions)
4. Unlike rules for GDPR where data cannot be sold to others, CCPA seems to allow this with an exception. (After the access request, a company has 45 days to provide them a comprehensive report about what type of information they have, was it sold, and to whom, and if it was sold to third parties over the past 12 months, it must give the names and addresses of the third parties the data is sold to) . I believe nothing can be done from our end because this is more about the transaction that happens between the company and the buyer who purchased their data (invoice etc)
I guess the CCPA is targeted to companies who buy and sell data (in fact, it seems like that they are hitting on companies like Cambridge Analytica)