In order to help businesses understand and benchmark industry practice, Greenberg Traurig, LLP analyzed the privacy policies of companies within the Fortune 500. As of December 2020 – 12 months after the CCPA had gone into effect and six months after the CCPA became enforceable – 71.8% of the companies within the Fortune 500 had updated their privacy policies to account for the CCPA.1 It is not clear whether the rate at which Fortune 500 companies have updated their privacy policies is representative of the rate at which small, emerging, or mid-sized companies updated their privacy policies. As many smaller companies may not meet the de minimis threshold for being governed by the CCPA, it is possible that fewer smaller companies have updated their privacy policy for the CCPA.
1 Whether a company has updated its privacy policy for the CCPA is not necessarily indicative of whether the company is, or is not, complying with the CCPA. For example, a company that has not updated its privacy policy for the CCPA, but is not subject to the statute (i.e., does not do business in California), would not be out of compliance.