Use this comparison to separate China and California scope, roles, consumer choices, assessments, transfers, breach response, and enforcement.
PIPL requires a valid processing circumstance and, when processing relies on consent, adds separate consent for specified activities. CCPA/CPRA applies to qualifying businesses and centers notice, consumer requests, and opt-outs from sale or sharing.
China's Personal Information Protection Law (PIPL) and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) require separate analyses. PIPL can apply to processing in China and specified processing outside China involving people in China. CCPA/CPRA applies to a qualifying for-profit business doing business in California, including one with more than $26,625,000 in prior-year gross revenue under the adjustment effective 1 January 2025, one that annually buys, sells, or shares the personal information of at least 100,000 consumers or households, or one that earns at least half its annual revenue from selling or sharing personal information. Test both laws before reusing notices, contracts, request workflows, or transfer controls.
Comparison
China PIPL vs CCPA/CPRA
Compare coverage, roles, processing and choice rules, sensitive data, rights, assessments, breaches, China exports, and enforcement. Apply each law independently.
PIPL applies to processing personal information in China. It also reaches overseas processing intended to provide products or services to people in China, analyze or assess their behavior, or meet another condition set by law or regulation.
Article 3 establishes in-China scope and the overseas product-or-service, behavior-analysis, and further-law grounds.
A for-profit entity doing business in California is a business if it controls collection and purpose or means and meets a threshold: more than $26,625,000 in prior-year gross revenue under the adjustment effective 1 January 2025; at least 100,000 consumers' or households' personal information bought, sold, or shared annually; or at least 50% of annual revenue from selling or sharing personal information. Controlled entities with common branding and shared personal information, specified joint ventures, and voluntary certifiers can also qualify.
Sets the adjusted annual-gross-revenue threshold at $26,625,000 effective 1 January 2025.
Record the PIPL territorial ground and the exact CCPA business threshold or relationship. Coverage under one law says nothing about coverage under the other.
A personal information processor decides the purpose and method. An entrusted processor handles information under an agreement that states the purpose, duration, method, categories, protection measures, and parties' rights and duties; the processor must supervise it.
Articles 20-21 govern joint decision-makers, entrusted processing terms, sub-entrustment, supervision, and return or deletion.
A business determines purpose and means. Service-provider and contractor status depends on a qualifying written contract and use restrictions; a recipient that does not meet those terms may be a third party. The label in a vendor agreement does not control the statutory result.
Article 13 permits processing under consent or listed non-consent circumstances, including necessity to conclude or perform a contract with the individual, human-resources necessity under lawfully formulated employment rules and a lawfully concluded collective contract, legal duties, emergencies, specified news and public-interest activities, and reasonable processing of lawfully public information. When processing relies on consent, separate consent applies to specified disclosures, sensitive personal information, and overseas provision.
Articles 13-18 establish processing circumstances, consent and withdrawal, separate-consent overlays, and notice duties.
A business must give notice at or before collection, limit collection, use, retention, and sharing to what is reasonably necessary and proportionate, and honor applicable opt-outs from sale or sharing. Consent is required for some later incompatible uses and opt-in situations, but the CCPA is not organized around a general lawful-basis list.
Sensitive personal information is information that, if leaked or illegally used, can readily harm dignity or personal or property safety. PIPL lists biometrics, religious belief, specific identity, medical health, financial accounts, location tracking, and information of children under 14. Processing requires a specific purpose, sufficient necessity, strict safeguards, additional notice, a PIPIA, and, when processing relies on consent, separate consent.
Articles 28-32 define sensitive personal information, list examples including data of children under 14, and set purpose, necessity, notice, consent, and safeguard duties; Article 55 requires a PIPIA.
Sensitive personal information is a defined list that includes specified identifiers and credentials, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, certain communications, genetic data, and neural data, as well as some account, health, sex-life, sexual-orientation, and biometric data. The right to limit applies only to uses or disclosures outside listed permitted purposes and statutory exceptions.
Individuals have rights to know and decide, restrict or refuse processing, access and copy, correct, and delete, subject to statutory conditions. For an automated decision with a major effect on rights or interests, an individual may request an explanation and may refuse such a decision made solely through automation. Processors must provide a convenient request mechanism and may reject a request only with reasons; the individual may sue.
Articles 24 and 44-50 establish individual rights, automated-decision protections, request mechanisms, rejection reasons, and judicial recourse.
Consumers have rights to know or access, delete, correct, opt out of sale or sharing, limit specified sensitive-information use or disclosure, and receive equal treatment. A business generally has 45 days to answer a verifiable request to know, delete, or correct, with one additional 45-day extension when reasonably necessary and timely notice is given. Opt-out and limit requests follow separate rules and generally may not require verification.
Sections 1798.105-1798.135 establish consumer rights; section 1798.130(a)(2) sets the 45-day response period and possible 45-day extension.
Use one intake channel only if it preserves the correct identity standard, exception, deadline, appeal or explanation, and response record for each law.
Article 55 requires a PIPIA before processing sensitive personal information, using personal information in automated decision-making, entrusting processing, providing information to another processor, publicly disclosing it, exporting it, or carrying out other processing with a major effect on individuals. The assessment must address legality, necessity, effects, risks, and safeguards; the report and record must be kept for at least three years. Article 54 separately requires regular compliance audits.
Articles 54-56 require regular compliance audits, list pre-processing PIPIA triggers and content, and set a minimum three-year retention period.
California regulations effective January 1, 2026 require risk assessments for specified processing presenting significant risk, annual cybersecurity audits for businesses meeting the regulatory tests, and notices and rights for specified automated decisionmaking technology uses. The triggers and phased dates differ by duty; processing begun before 2026 and continuing afterward has a December 31, 2027 risk-assessment deadline.
The completed rulemaking took effect January 1, 2026 and implements risk-assessment, cybersecurity-audit, and automated decisionmaking technology requirements.
Reuse system descriptions and risk evidence, but keep separate legal triggers, required content, approval, retention, submission, and deadline records.
If personal information is or may be leaked, altered, or lost, the processor must immediately take remedial measures and notify the authorities and individuals with the information listed in Article 57. Individual notice may be omitted if the processor can effectively avoid harm, but an authority may still require it.
Article 57 sets remedial action and authority and individual notification duties for actual or possible leaks, alteration, or loss.
The CCPA does not create a general regulator-notification deadline equivalent to PIPL Article 57. Its limited private right of action covers specified nonencrypted and nonredacted personal information, or an email address with account-access credentials, subject to unauthorized access and exfiltration, theft, or disclosure resulting from a failure to maintain reasonable security. Statutory damages are $107-$799 per consumer per incident under the adjustment effective 1 January 2025, or actual damages, whichever is greater, subject to the statute's conditions. Other California breach-notification laws may apply separately.
Sets the adjusted statutory-damages range at $107-$799 per consumer per incident effective 1 January 2025.
Use the incident record to run PIPL notification, California security-breach liability, and any separate California breach-notice analysis; do not infer one result from another.
Before overseas provision, PIPL generally requires recipient notice, separate consent where consent is required, a PIPIA, and one Article 38 route unless a current exemption applies. Under the 2024 provisions, non-critical-information-infrastructure operators generally use a standard contract or certification when they export personal information of at least 100,000 but fewer than 1 million individuals, excluding sensitive personal information, or sensitive personal information of fewer than 10,000 individuals, counted from 1 January of the current year. A CAC assessment is required for critical information infrastructure operators, important data, personal information of at least 1 million individuals excluding sensitive personal information, or sensitive personal information of at least 10,000 individuals, subject to stated exemptions.
Use for current export exemptions, thresholds, three-year assessment validity and precedence over inconsistent older measures.
CCPA/CPRA has no national data-export mechanism equivalent to China's CAC routes. A disclosure can still be a sale or sharing, or be governed by service-provider or contractor terms, regardless of whether the recipient is in California, another state, or another country.
Sections 1798.100, 1798.120, and 1798.140 classify disclosures and define sale, sharing, service providers, contractors, and third parties without a PIPL-style export route.
Classify the California disclosure and separately select and document the China export route. A CCPA service-provider contract is not the CAC standard contract.
For a serious PIPL violation, the responsible authority may order correction, confiscate unlawful gains, and impose up to RMB 50 million or 5% of the prior year's turnover. It may also suspend related business or order suspension for rectification, notify competent authorities to revoke relevant permits or a business licence, and fine or disqualify directly responsible individuals. Lesser violations have a different penalty tier.
Article 66 establishes corrective orders and the ordinary and serious-violation penalty tiers, including the RMB 50 million or 5% ceiling.
The CPPA may seek an administrative fine of up to $2,663 per violation or $7,988 per intentional violation or violation involving personal information of a consumer the respondent actually knows is under 16 under the adjustment effective 1 January 2025. The Attorney General may seek civil penalties at the same adjusted per-violation amounts under the statute. The limited private action for specified security breaches is separate.
California uses per-violation administrative and civil penalty provisions and a limited private action.
Scope trigger
China PIPL
PIPL applies to processing personal information in China. It also reaches overseas processing intended to provide products or services to people in China, analyze or assess their behavior, or meet another condition set by law or regulation.
Article 3 establishes in-China scope and the overseas product-or-service, behavior-analysis, and further-law grounds.
California CCPA/CPRA
A for-profit entity doing business in California is a business if it controls collection and purpose or means and meets a threshold: more than $26,625,000 in prior-year gross revenue under the adjustment effective 1 January 2025; at least 100,000 consumers' or households' personal information bought, sold, or shared annually; or at least 50% of annual revenue from selling or sharing personal information. Controlled entities with common branding and shared personal information, specified joint ventures, and voluntary certifiers can also qualify.
Sets the adjusted annual-gross-revenue threshold at $26,625,000 effective 1 January 2025.
Operational implication
Record the PIPL territorial ground and the exact CCPA business threshold or relationship. Coverage under one law says nothing about coverage under the other.
Section 1798.140(d) supplies the California entity and threshold test that must be applied independently of PIPL Article 3.
Actors
China PIPL
A personal information processor decides the purpose and method. An entrusted processor handles information under an agreement that states the purpose, duration, method, categories, protection measures, and parties' rights and duties; the processor must supervise it.
Articles 20-21 govern joint decision-makers, entrusted processing terms, sub-entrustment, supervision, and return or deletion.
California CCPA/CPRA
A business determines purpose and means. Service-provider and contractor status depends on a qualifying written contract and use restrictions; a recipient that does not meet those terms may be a third party. The label in a vendor agreement does not control the statutory result.
California role and contract requirements do not replace PIPL Articles 20-23.
Collection and choice
China PIPL
Article 13 permits processing under consent or listed non-consent circumstances, including necessity to conclude or perform a contract with the individual, human-resources necessity under lawfully formulated employment rules and a lawfully concluded collective contract, legal duties, emergencies, specified news and public-interest activities, and reasonable processing of lawfully public information. When processing relies on consent, separate consent applies to specified disclosures, sensitive personal information, and overseas provision.
Articles 13-18 establish processing circumstances, consent and withdrawal, separate-consent overlays, and notice duties.
California CCPA/CPRA
A business must give notice at or before collection, limit collection, use, retention, and sharing to what is reasonably necessary and proportionate, and honor applicable opt-outs from sale or sharing. Consent is required for some later incompatible uses and opt-in situations, but the CCPA is not organized around a general lawful-basis list.
California notice and choice rules do not satisfy a PIPL separate-consent requirement.
Sensitive information
China PIPL
Sensitive personal information is information that, if leaked or illegally used, can readily harm dignity or personal or property safety. PIPL lists biometrics, religious belief, specific identity, medical health, financial accounts, location tracking, and information of children under 14. Processing requires a specific purpose, sufficient necessity, strict safeguards, additional notice, a PIPIA, and, when processing relies on consent, separate consent.
Articles 28-32 define sensitive personal information, list examples including data of children under 14, and set purpose, necessity, notice, consent, and safeguard duties; Article 55 requires a PIPIA.
California CCPA/CPRA
Sensitive personal information is a defined list that includes specified identifiers and credentials, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, certain communications, genetic data, and neural data, as well as some account, health, sex-life, sexual-orientation, and biometric data. The right to limit applies only to uses or disclosures outside listed permitted purposes and statutory exceptions.
The California category and limit right differ from PIPL Articles 28-30.
Individual rights
China PIPL
Individuals have rights to know and decide, restrict or refuse processing, access and copy, correct, and delete, subject to statutory conditions. For an automated decision with a major effect on rights or interests, an individual may request an explanation and may refuse such a decision made solely through automation. Processors must provide a convenient request mechanism and may reject a request only with reasons; the individual may sue.
Articles 24 and 44-50 establish individual rights, automated-decision protections, request mechanisms, rejection reasons, and judicial recourse.
California CCPA/CPRA
Consumers have rights to know or access, delete, correct, opt out of sale or sharing, limit specified sensitive-information use or disclosure, and receive equal treatment. A business generally has 45 days to answer a verifiable request to know, delete, or correct, with one additional 45-day extension when reasonably necessary and timely notice is given. Opt-out and limit requests follow separate rules and generally may not require verification.
Sections 1798.105-1798.135 establish consumer rights; section 1798.130(a)(2) sets the 45-day response period and possible 45-day extension.
Operational implication
Use one intake channel only if it preserves the correct identity standard, exception, deadline, appeal or explanation, and response record for each law.
California request scope and timing must be applied separately from PIPL Articles 44-50.
Assessments and governance
China PIPL
Article 55 requires a PIPIA before processing sensitive personal information, using personal information in automated decision-making, entrusting processing, providing information to another processor, publicly disclosing it, exporting it, or carrying out other processing with a major effect on individuals. The assessment must address legality, necessity, effects, risks, and safeguards; the report and record must be kept for at least three years. Article 54 separately requires regular compliance audits.
Articles 54-56 require regular compliance audits, list pre-processing PIPIA triggers and content, and set a minimum three-year retention period.
California CCPA/CPRA
California regulations effective January 1, 2026 require risk assessments for specified processing presenting significant risk, annual cybersecurity audits for businesses meeting the regulatory tests, and notices and rights for specified automated decisionmaking technology uses. The triggers and phased dates differ by duty; processing begun before 2026 and continuing afterward has a December 31, 2027 risk-assessment deadline.
The completed rulemaking took effect January 1, 2026 and implements risk-assessment, cybersecurity-audit, and automated decisionmaking technology requirements.
Operational implication
Reuse system descriptions and risk evidence, but keep separate legal triggers, required content, approval, retention, submission, and deadline records.
California's 2026 regulations set distinct triggers and phased compliance provisions.
Security incidents and private claims
China PIPL
If personal information is or may be leaked, altered, or lost, the processor must immediately take remedial measures and notify the authorities and individuals with the information listed in Article 57. Individual notice may be omitted if the processor can effectively avoid harm, but an authority may still require it.
Article 57 sets remedial action and authority and individual notification duties for actual or possible leaks, alteration, or loss.
California CCPA/CPRA
The CCPA does not create a general regulator-notification deadline equivalent to PIPL Article 57. Its limited private right of action covers specified nonencrypted and nonredacted personal information, or an email address with account-access credentials, subject to unauthorized access and exfiltration, theft, or disclosure resulting from a failure to maintain reasonable security. Statutory damages are $107-$799 per consumer per incident under the adjustment effective 1 January 2025, or actual damages, whichever is greater, subject to the statute's conditions. Other California breach-notification laws may apply separately.
Sets the adjusted statutory-damages range at $107-$799 per consumer per incident effective 1 January 2025.
Operational implication
Use the incident record to run PIPL notification, California security-breach liability, and any separate California breach-notice analysis; do not infer one result from another.
Section 1798.150 supplies the narrower CCPA private-action test.
Cross-border transfer
China PIPL
Before overseas provision, PIPL generally requires recipient notice, separate consent where consent is required, a PIPIA, and one Article 38 route unless a current exemption applies. Under the 2024 provisions, non-critical-information-infrastructure operators generally use a standard contract or certification when they export personal information of at least 100,000 but fewer than 1 million individuals, excluding sensitive personal information, or sensitive personal information of fewer than 10,000 individuals, counted from 1 January of the current year. A CAC assessment is required for critical information infrastructure operators, important data, personal information of at least 1 million individuals excluding sensitive personal information, or sensitive personal information of at least 10,000 individuals, subject to stated exemptions.
Use for current export exemptions, thresholds, three-year assessment validity and precedence over inconsistent older measures.
California CCPA/CPRA
CCPA/CPRA has no national data-export mechanism equivalent to China's CAC routes. A disclosure can still be a sale or sharing, or be governed by service-provider or contractor terms, regardless of whether the recipient is in California, another state, or another country.
Sections 1798.100, 1798.120, and 1798.140 classify disclosures and define sale, sharing, service providers, contractors, and third parties without a PIPL-style export route.
Operational implication
Classify the California disclosure and separately select and document the China export route. A CCPA service-provider contract is not the CAC standard contract.
California contract status does not satisfy PIPL Articles 38-40 or the 2024 CAC provisions.
Enforcement and maximum penalties
China PIPL
For a serious PIPL violation, the responsible authority may order correction, confiscate unlawful gains, and impose up to RMB 50 million or 5% of the prior year's turnover. It may also suspend related business or order suspension for rectification, notify competent authorities to revoke relevant permits or a business licence, and fine or disqualify directly responsible individuals. Lesser violations have a different penalty tier.
Article 66 establishes corrective orders and the ordinary and serious-violation penalty tiers, including the RMB 50 million or 5% ceiling.
California CCPA/CPRA
The CPPA may seek an administrative fine of up to $2,663 per violation or $7,988 per intentional violation or violation involving personal information of a consumer the respondent actually knows is under 16 under the adjustment effective 1 January 2025. The Attorney General may seek civil penalties at the same adjusted per-violation amounts under the statute. The limited private action for specified security breaches is separate.
California uses per-violation administrative and civil penalty provisions and a limited private action.
1
Section 1
How to use this comparison
Start with scope, then assign the legal role for each data flow. Under PIPL, the organization that decides the purpose and method is the personal information processor. California instead distinguishes a business, service provider, contractor, and third party. Similar vendor relationships can produce different roles and contract terms.
Next, document the processing rule and consumer control. PIPL Article 13 lists consent and non-consent circumstances; when processing relies on consent, separate consent applies to specified disclosures, sensitive personal information, and overseas provision. California requires notice at or before collection and, where applicable, opt-outs from sale or sharing and limits on certain uses or disclosures of sensitive personal information.
Run the assessment, incident, and transfer tests separately. A PIPL personal information protection impact assessment (PIPIA) is required before listed high-risk activities. California Privacy Protection Agency (CPPA) regulations effective January 1, 2026 add risk-assessment, cybersecurity-audit, and automated decisionmaking technology duties for covered activities and businesses, with phased compliance dates. China also has a separate export-route analysis; a California service-provider contract does not satisfy it.
Record why each entity is or is not covered, including the California threshold used.
Map each data flow to a PIPL processing circumstance and the applicable California notice or choice.
Keep separate request deadlines, exceptions, identity checks, and response records.
For China exports, count volumes from January 1 of the current year and check important-data and critical-information-infrastructure status before selecting an exemption, standard contract or certification, or Cyberspace Administration of China (CAC) security assessment.
Use for PIPL scope, processing bases, notice and consent, individual rights, processor duties, PIPIA, cross-border transfer duties, penalties, and effective date.
Sections 1798.100-1798.199.100 establish business scope, notices, consumer rights, role and contract rules, response timing, enforcement, and penalties.
Use for PIPL scope, processing bases, notice and consent, individual rights, processor duties, PIPIA, cross-border transfer duties, penalties, and effective date.
Article 3 establishes in-China scope and the overseas product-or-service, behavior-analysis, and further-law grounds.
PIPL Article 3 and CCPA section 1798.140(d) require separate territorial and entity analyses.
Show 16 more
Articles 20-21 govern joint decision-makers, entrusted processing terms, sub-entrustment, supervision, and return or deletion.
PIPL Articles 20-21 use role and contract rules distinct from California's statutory categories.
Articles 13-18 establish processing circumstances, consent and withdrawal, separate-consent overlays, and notice duties.
PIPL Articles 13-18 require their own processing-circumstance, consent, and notice analysis.
Articles 28-32 define sensitive personal information, list examples including data of children under 14, and set purpose, necessity, notice, consent, and safeguard duties; Article 55 requires a PIPIA.
PIPL Articles 28-32 and 55 create a category and duties distinct from California sections 1798.121 and 1798.140.
Articles 24 and 44-50 establish individual rights, automated-decision protections, request mechanisms, rejection reasons, and judicial recourse.
PIPL Articles 24 and 44-50 require a separate rights and response analysis.
Articles 54-56 require regular compliance audits, list pre-processing PIPIA triggers and content, and set a minimum three-year retention period.
PIPL Articles 54-56 control the China assessment and audit record.
Article 57 sets remedial action and authority and individual notification duties for actual or possible leaks, alteration, or loss.
Article 57 supplies the PIPL incident-notification test.
Articles 38-40 establish China export routes, overseas-recipient notice and separate consent, and security-assessment duties.
PIPL Articles 38-40 and the 2024 provisions control the China export analysis.
Article 66 establishes corrective orders and the ordinary and serious-violation penalty tiers, including the RMB 50 million or 5% ceiling.
Article 66 uses China-specific penalty tiers and remedies.
Sections 1798.100-1798.199.100 establish business scope, notices, consumer rights, role and contract rules, response timing, enforcement, and penalties.
Section 1798.140(d) defines a business and its revenue, 100,000-consumer-or-household, and 50%-of-revenue thresholds, plus covered relationships.
Section 1798.140(d) supplies the California entity and threshold test that must be applied independently of PIPL Article 3.
Show 14 more
Sections 1798.100(d) and 1798.140 define business, service provider, contractor, and third party and prescribe contract and use restrictions.
California role and contract requirements do not replace PIPL Articles 20-23.
Sections 1798.100, 1798.120-1798.121, and 1798.135 establish notice, proportionality, sale or sharing opt-out, and sensitive-information controls.
California notice and choice rules do not satisfy a PIPL separate-consent requirement.
Sections 1798.121 and 1798.140 define sensitive personal information and limit the right to specified uses and disclosures.
The California category and limit right differ from PIPL Articles 28-30.
Sections 1798.105-1798.135 establish consumer rights; section 1798.130(a)(2) sets the 45-day response period and possible 45-day extension.
California request scope and timing must be applied separately from PIPL Articles 44-50.
Section 1798.150 limits the CCPA private action to specified security breaches and sets statutory or actual damages and pre-suit conditions.
Section 1798.150 supplies the narrower CCPA private-action test.
Sections 1798.100, 1798.120, and 1798.140 classify disclosures and define sale, sharing, service providers, contractors, and third parties without a PIPL-style export route.
California contract status does not satisfy PIPL Articles 38-40 or the 2024 CAC provisions.
Sections 1798.150, 1798.155, and 1798.199.90 set the private-action, administrative-fine, and Attorney General civil-enforcement routes.
California uses per-violation administrative and civil penalty provisions and a limited private action.
Current official source for the CCPA business revenue threshold, statutory-damages range, and administrative and civil penalty amounts effective 1 January 2025.
Sets the adjusted business revenue threshold, statutory-damages range, and administrative and civil penalty amounts effective 1 January 2025.
Sets the adjusted annual-gross-revenue threshold at $26,625,000 effective 1 January 2025.
Show 2 more
Sets the adjusted statutory-damages range at $107-$799 per consumer per incident effective 1 January 2025.
Sets the adjusted administrative and civil penalty ceilings at $2,663 and $7,988 per violation effective 1 January 2025.
The completed rulemaking took effect January 1, 2026 and covers risk assessments, cybersecurity audits, and automated decisionmaking technology.
The completed rulemaking took effect January 1, 2026 and implements risk-assessment, cybersecurity-audit, and automated decisionmaking technology requirements.
California's 2026 regulations set distinct triggers and phased compliance provisions.
Use for assessment self-assessment, filing materials, review procedure and reapplication triggers; use the 2024 provisions for current exemptions, thresholds and validity.
Use for the CAC standard-contract form, pre-export PIPIA, contract effectiveness, filing and re-filing procedure; use the 2024 provisions for current exemptions and volume bands.