leginfo.legislature.ca.gov
Referenced sections
- Binding statutory text for business scope, definitions, consumer rights, sale and sharing, sensitive personal information, contracts, enforcement, exemptions, and the limited private action.
By Sorena AIPublished Updated
CCPA and CPRA
California Consumer Privacy Act
California guide covering current scope, rights, notices, opt-outs, contracts, risk assessments, cybersecurity audits, , data brokers, and phased deadlines.
- As amended by CPRA
- Global Privacy Control
- Consumer request operations
- Regulator
Understand California Consumer Privacy Act
Apply California's current privacy regime: the as amended by the and regulations effective January 1, 2026. Start with entity scope and processing roles, then assign notices, consumer rights, sale and sharing opt-outs, contracts, risk assessments, cybersecurity audits, , and enforcement work.
The did not create a separate replacement law; it amended the . Use this hub for the consolidated regime, while treating data-broker duties under the Delete Act as a related but separate applicability check.
Start with applicability and roles, then follow the grouped guides into notices, rights, contracts, evidence, deadlines, and enforcement.
Quick scan
Scope
Validate threshold and -role applicability with evidence.
Consumer rights
Handle requests to know, delete, correct, and opt out.
Contracts and disclosures
Align service provider contracts and privacy notices to legal requirements.
CCPA decisions
- 1
Whether the business is in scope
First confirm that the entity is a for-profit that collects consumer personal information or has it collected on its behalf, determines why and how that information is processed, and does business in California. Then test the current $26,625,000 preceding-year gross-revenue threshold, the 100,000-consumer-or-household test, the 50-percent sale-or-sharing revenue test, and related-entity or voluntary-certification routes.
- 2
What disclosures are required
Map each collection point and use to the notice at collection, privacy policy, sale or sharing opt-out, limit, and financial-incentive disclosures that apply.
- 3
How to honor consumer choice
Route know, delete, correct, limit, sale-or-sharing opt-out, and automated decisionmaking technology () requests; verify access, deletion, correction, and ADMT-access requests without verifying opt-out or limit requests.
Key milestones for California privacy operations
Separate historical and milestones from the rules now in force. Risk-assessment duties began January 1, 2026; processing begins August 1, 2026; compliance begins January 1, 2027; risk-assessment submissions and phased cybersecurity-audit certifications begin in 2028.
Loading timeline...
Choose the next California privacy decision
New to the ? Start with applicability, thresholds, roles, and data categories. If scope is already documented, jump directly to consumer rights, notices, opt-outs, contracts, evidence, deadlines, or enforcement.
Start here: scope, thresholds, and data
Decide whether the current applies to the entity and each data set. Nonprofits and government agencies generally fall outside the definition, while service providers, contractors, related entities, and voluntarily certified entities require separate checks. Record how personal and move through the product or service.
Consumer rights and required notices
Build the public disclosures and request workflows for access, deletion, correction, limitation, verification, retention, and annual privacy-policy updates. For requests to know, delete, or correct, confirm receipt within 10 days and generally respond within 45 calendar days; an extension can bring the total to 90 days if the consumer is notified.
- CCPA Consumer Rights Workflow: Requests, Clocks, and Evidence
- CCPA DSAR Workflow: Intake, Verification, and Response
- US CCPA DSAR Verification Guide
- US CCPA Privacy Notices and Disclosures Guide
- US CCPA Notice at collection Guide
- US CCPA Privacy Policy Guide
- CCPA Privacy Policy Template: Required Content and Review
- US CCPA Privacy Law FAQ
Sale, sharing, GPC, minors, and fair choice
Determine whether a disclosure is a sale for monetary or other valuable consideration or sharing for cross-context behavioral advertising, which can occur without payment. Honor and other qualifying opt-out preference signals, obtain the required form of consent for minors, and remove choice designs that impair consumer autonomy.
Contracts, recipients, and data brokers
Classify service providers, contractors, and third parties from actual processing and written contract terms, including purpose limits and restrictions on selling, sharing, combining, retaining, using, and disclosing personal information. Then screen separately for California data-broker and duties.
Implementation, evidence, and deadlines
Turn the assigned requirements into owners, evidence, retention rules, current risk-assessment and work, and phased cybersecurity-audit planning.
Enforcement and framework boundaries
Understand and Attorney General enforcement, the narrow private action for qualifying security incidents, and the limits of and GDPR comparisons.
Sources
cppa.ca.gov
Referenced sections
- Official plain-language guidance on the current amended CCPA, consumer rights, businesses, service providers and contractors, data brokers, complaints, and agency responsibilities.
cppa.ca.gov
Referenced sections
- Official source for the March 2023 regulations and rulemaking history; use it to distinguish those rules from the later amendments effective January 1, 2026.
cppa.ca.gov
Referenced sections
- Official status hub confirming adoption, approval, and effective dates for the 2025 rulemaking that added cybersecurity-audit, risk-assessment, and ADMT requirements.
cppa.ca.gov
Referenced sections
- Consolidated regulations for disclosures, request handling, opt-out preference signals, service-provider and third-party contracts, cybersecurity audits, risk assessments, and ADMT requirements and dates.
cppa.ca.gov
Referenced sections
- Official current threshold notice setting the business gross-revenue amount at $26,625,000 effective January 1, 2025.
Next steps
Assign CCPA controls and evidence
Record entity scope, data-flow classification, consumer choice, vendor duties, and dated evidence. Research unsettled facts against cited sources and assign confirmed obligations to the responsible teams.
- Start with one legal entity, product, collection point, disclosure, or vendor flow and record the facts that determine scope and role.
- Use cited research for threshold, exemption, sale or sharing, rights, automated decisionmaking technology (), data-broker, and enforcement questions that turn on specific facts.
- Keep notices, request logs, tests, contracts, risk assessments, audit records, approvals, and reassessment triggers in one governed evidence set.
- Reopen the decision when revenue, data volume, processing purpose, recipient role, interface, or applicable regulations change.
- Open Research Copilot
Answer scope, role, sale or sharing, rights, , risk, audit, data-broker, and timing questions with cited outputs.
- Open SSOT
Keep notices, request evidence, signal tests, contracts, assessments, audit records, and approvals connected to the same decisions.
- Review your California privacy operating model
Walk through entity scope, data flows, consumer journeys, vendor roles, evidence, and the next dated implementation steps.