For Turkish companies expanding into the US market, California's data privacy regulations are becoming increasingly important. The CCPA (California Consumer Privacy Act) and the CPRA (California Privacy Rights Act), which extends it, grant broad rights over their personal data to consumers residing in California. This article summarizes, for a Turkish reader already familiar with the KVKK, the basic logic of CCPA/CPRA, which businesses it covers, and where to begin.
What Are CCPA/CPRA?
The CCPA is a state regulation that gives California consumers the ability to learn about and control their personal data. The CPRA strengthens the CCPA by adding new rights and establishing a dedicated privacy agency for enforcement. Together they form California's personal-data protection framework. Like the KVKK, they are built on transparency, purpose limitation, and individual rights; however, the conceptual structure and terminology differ.
Which Businesses Does It Cover?
CCPA/CPRA can cover businesses that process the personal data of consumers residing in California and that exceed certain thresholds, wherever in the world those businesses are located. These thresholds generally depend on the business's annual revenue, the volume of consumer data it processes, or the share of revenue it derives from selling data. Being established in Turkey does not by itself place you outside the scope; what matters is your activity directed at California consumers and your scale.
Because the specific numeric values of the thresholds can be updated over time, it is important to base your scope assessment on the current text and on qualified legal advice.
Core Rights Granted to Consumers
CCPA/CPRA grants California consumers a set of rights. Understanding these rights determines which processes you need to build.
- Right to know: To learn what personal data is collected, how it is used, and with whom it is shared.
- Right to delete: To request the deletion of personal data, subject to certain exceptions.
- Right to correct: To request the correction of inaccurate personal data.
- Right to opt-out of sale/sharing: To object to the selling or sharing of personal data.
"Do Not Sell or Share My Personal Information"
One of the most visible requirements of CCPA/CPRA is that consumers can easily opt out of the sale or sharing of their data. To this end, covered businesses are expected to provide a clear "Do Not Sell or Share My Personal Information" link or a similar mechanism on their websites. Because the concepts of "sale" and "sharing" can be interpreted broadly, you should carefully assess whether your data transfers for advertising and analytics purposes fall within this scope.
Conceptual Comparison with the KVKK
For a team accustomed to the KVKK, mapping CCPA/CPRA onto familiar concepts makes the work easier. The table below offers a rough orientation; it does not claim exact legal equivalence.
| Topic | KVKK Approach | CCPA/CPRA Approach |
|---|---|---|
| Informing | Duty to inform | Right to know and privacy notice |
| Objection mechanism | Explicit consent and objection rights | Right to opt out of sale/sharing |
| Geographic link | Activity in Turkey | Activity directed at California consumers |
Practical Compliance Steps for Turkish Companies
If you think you may be in scope, follow a structured starting plan.
- Perform a scope assessment by determining your activity directed at California consumers and your data volume.
- Inventory the categories of personal data you collect and with whom you share them.
- Assess whether your data transfers for advertising and analytics count as "sale/sharing."
- Prepare a privacy notice on your website and, if needed, an opt-out of sale/sharing mechanism.
- Establish an intake and verification process to handle consumer rights requests.
- Define the responsible people and workflow to handle requests within the set timeframes.
Example Scenario
An Istanbul-based SaaS company starts selling its product to customers in the US, and some of its users reside in California. The team first performs a scope assessment: there is activity directed at California consumers, so they check against the current text whether they exceed certain thresholds. They then inventory the categories of data they collect and realize that data shared with marketing tools may fall within the scope of "sharing." They add a privacy notice and an opt-out of sale/sharing link to their website, and define an intake form and an identity-verification step to handle consumer rights requests. In this way, they begin managing compliance risks early as they enter the US market.
Frequently Asked Questions
I am established in Turkey - why would CCPA/CPRA concern me?
The regulation looks not at where the business is established but at whether you process the data of California consumers and at your scale. If you sell products or services to users in California, you may fall within scope if you exceed certain thresholds.
If I comply with the KVKK, am I also considered compliant with CCPA/CPRA?
No. Although the two frameworks share similar principles, they have different definitions, rights, and requirements. KVKK compliance provides a good foundation, but you must separately address the specific requirements of CCPA/CPRA.
Does "sale" only mean transferring data for money?
No. In CCPA/CPRA, the concepts of "sale" and "sharing" can be interpreted broadly and do not always require a direct flow of money. You should assess your data transfers for advertising and analytics purposes especially carefully in this respect.
Where do I find the exact revenue threshold?
Because the numeric values of the thresholds can be updated over time, we do not give a specific figure in this article. It is advisable to perform a scope assessment specific to your situation based on the current official text and qualified legal advice.
This content is for general informational purposes only and does not constitute legal advice.
If you want to manage your data inventory, privacy notices, and rights requests for both the KVKK and foreign regulations from a single panel, request a JUS. demo.