Use a launch-and-review checklist that starts with scope and data flows, then verifies notices, consumer choices, rights operations, contracts, retention, security, assessments, audits, ADMT, and evidence.
Ground decisions in the consolidated CCPA statute and the regulations effective through January 1, 2026; preserve the trigger, owner, evidence, deadline, and reassessment condition for each control.
Use this California Consumer Privacy Act (CCPA) checklist after deciding which legal entity is a and which information or activities remain outside a particular duty. The Civil Code and California Privacy Protection Agency (CPPA) regulations control the legal duties; the owner, evidence, approval, and testing fields below are practical implementation controls. Service providers and contractors should use the relevant request-assistance, contract, security, audit, risk-assessment, automated decisionmaking technology (ADMT), and restricted-use items rather than treating the whole checklist as their own business obligation.
Begin with a legal-entity decision and a data inventory. For each entity, test the current $26,625,000 Consumer Price Index (CPI)-adjusted revenue route, the 100,000-consumer-or-household route, the 50-percent sale-or-sharing revenue route, and applicable affiliate, joint-venture, partnership, or voluntary-certification routes. Then analyze exemptions by information and activity rather than treating regulated status, nonprofit status, or a vendor role as a universal answer.
The inventory must connect each category of personal information to representative data elements, sources, purposes, retention periods, collection points, recipients, sales, sharing, sensitive-information uses, consumer groups, and the notices shown to consumers. Include online and offline data, employees and applicants, pseudonymous profiles, software development kit (SDK) and tracking-tag events, and data held by service providers or contractors where relevant.
Sources (3)
Binding definition of a CCPA business, including the main thresholds and the affiliate, joint-venture, partnership, and voluntary-certification routes.
Official CPPA source for the $26,625,000 annual-gross-revenue threshold effective January 1, 2025 and the recurring odd-year CPI adjustment.
Nonbinding CPPA FAQs used to anchor checklist fields for consumer rights, request methods, response timing, and opt-out signals.
Businesses must generally designate at least two methods for you to submit your requests
Requests to know, delete, and correct require receipt confirmation within 10 business days and a substantive response within 45 calendar days, subject to a notified extension of up to 45 more days. From January 1, 2027, the covered ADMT-access and ADMT-appeal request paths also use these response periods. The 45-day clock runs from receipt, not verification. Sale-or-sharing opt-outs, sensitive-information limit requests, and ADMT opt-outs use separate non-verifiable paths and must not inherit an identity check merely because they share a portal.
Sources (1)
Nonbinding CPPA FAQs used to anchor checklist fields for consumer rights, request methods, response timing, and opt-out signals.
Businesses must generally designate at least two methods for you to submit your requests
The regulations effective January 1, 2026 add trigger-specific duties. Risk assessments apply to listed processing that presents significant privacy risk, including sale or sharing, most processing of sensitive personal information, specified ADMT and profiling, and training specified technologies with personal information. A narrow exception covers sensitive information processed solely and specifically for listed employee or independent-contractor compensation, work-authorization, benefits, legally required accommodation, and wage-reporting purposes. ADMT requirements for significant decisions begin January 1, 2027. Cybersecurity-audit certification dates are phased by revenue from April 1, 2028 through April 1, 2030.
Sources (2)
Articles 8-11 support the recordkeeping, risk-assessment, cybersecurity-audit, and ADMT checklist items and phased dates.
CPPA advisory used to support checklist review triggers for data minimization in consumer request handling.
Applying Data Minimization to Consumer Requests
Assign each checklist item to an owner and keep the calculation, notice, log, contract, test, assessment, audit, or approval that proves completion.
Turn Checklist into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
"Businesses must generally designate at least two methods for you to submit your requests"
"Applying Data Minimization to Consumer Requests"
Route CCPA requests by right, apply the correct verification and response rule, coordinate downstream action, and retain a clear decision record.
Classify CCPA recipients from their actual processing and contracts, then document the clauses, restrictions, monitoring, and opt-out consequences.
Track CCPA request clocks, annual duties, DROP dates, and phased 2026-2030 deadlines for risk assessments, ADMT, and cybersecurity audits.
Classify CCPA sales and sharing, provide valid opt-out methods, honor preference signals, stop disclosures within 15 business days, and notify recipients.
Implement CCPA sale-or-sharing opt-outs across links, GPC, consent state, ad tech, recipients, confirmation, privacy disclosures, and evidence.
Run CCPA data-subject requests from intake through verification, search, exception review, downstream action, response, and retained evidence.
Process CCPA opt-out preference signals across browsers, devices, profiles, accounts, offline data, conflicts, recipients, and confirmation controls.
See current CCPA fines, civil penalties, security-breach damages, adjustment rules, and the facts needed before estimating exposure.
Draft and maintain a CCPA privacy policy covering data practices, rights, request methods, GPC handling, minors, contacts, and the last-updated date.
Apply California's regulations effective January 1, 2026 for risk-assessment triggers, phased cybersecurity audits, ADMT rights, evidence, reviews, and CPPA submissions.
Compare the original CCPA with the CPRA amendments and learn why current California privacy work must use the CCPA as amended, not two separate laws.
Compare the California CCPA and EU GDPR by scope, roles, legal basis, rights, advertising transfers, contracts, security, deadlines, and enforcement.
Apply the CCPA entity-by-entity: test California nexus, for-profit control, current thresholds, related-entity routes, exemptions, and processing roles.
Build a CCPA operating model for entity scope, data mapping, notices, rights, opt-outs, contracts, retention, security, assessments, audits, ADMT, and evidence.
Review CCPA privacy interfaces for plain language, symmetry, minimal steps, neutral presentation, valid consent, and reliable opt-out operation.
Test whether a CCPA business is also a California data broker, then assign registration, metrics, DROP, deletion, downstream, and audit duties.
Verify CCPA know, delete, correct, and ADMT-access requests with request-specific, secure, minimized methods without adding friction to opt-outs.
Understand CPPA investigations, Attorney General civil actions, CCPA administrative orders, current penalties, and the limited security-breach private action.
Decide whether a CCPA financial-incentive rule applies, then document the notice, data-value method, opt-in, withdrawal, and nondiscrimination checks.
Implement Global Privacy Control under the CCPA across browsers, devices, accounts, ad technology, downstream recipients, and consumer notices.
Apply the CCPA opt-in rules for selling or sharing personal information of consumers under 16, including age bands, authorization, notices, and evidence.
Build a CCPA Notice at Collection for online and offline collection points, including categories, purposes, sale or sharing, retention, links, and change control.
Classify CCPA personal information and sensitive personal information, apply exclusions, and map each category to notices, rights, retention, security, sale, and sharing.
Direct answers on CCPA scope, rights, notices, opt-outs, GPC, minors, sensitive information, financial incentives, and data brokers.
Choose and maintain each CCPA consumer notice: privacy policy, collection, sale or sharing, sensitive-information limits, financial incentives, and ADMT.
Build and maintain a CCPA privacy policy covering online and offline practices, 12-month disclosures, consumer rights, request methods, and annual updates.
Plain-language CCPA requirements covering scope, minimization, notices, rights, opt-outs, contracts, security, records, risk assessments, audits, and ADMT.
CCPA scope and threshold reference covering the current $26,625,000 revenue threshold, the 100,000-consumer-or-household test, related entities, and exemptions.
Classify CCPA recipients and check the distinct contract terms for service providers, contractors, and third parties before disclosing personal information.
Check CCPA service-provider and contractor agreements for specific purposes, use restrictions, consumer-request support, subcontractors, and remediation.
Apply the CCPA business thresholds per legal entity, including the 2025 CPI-adjusted revenue amount, volume and sale-or-sharing tests, and control routes.
Decide whether a CCPA business is also a California data broker and track registration, privacy metrics, DROP deletion, vendor, and audit duties.
Check a CCPA privacy interface for clear language, symmetrical choices, unnecessary steps, and other designs that can invalidate consent.
Determine whether a transfer is a CCPA sale or sharing, provide the required opt-out path, honor preference signals, and propagate the choice.
Assess a loyalty, discount, payment, or service program under the CCPA and document notice, opt-in, withdrawal, and data-value requirements.
Implement Global Privacy Control as a CCPA sale and sharing opt-out across browsers, devices, known accounts, and relevant downstream systems.
Apply the CCPA's under-13 parent authorization and age-13-to-15 consumer opt-in rules for sale or sharing of personal information.
Place a CCPA notice where consumers encounter it before collection and disclose categories, purposes, retention, sale or sharing, and required links.
Classify personal and sensitive personal information under the current CCPA, including exclusions and the duties each category can trigger.
Apply the CCPA revenue, data-volume, and sale-or-sharing revenue thresholds, then check California nexus, control, joint ventures, roles, and exemptions.
A practical guide to CCPA privacy-policy content, placement, annual updates, consumer rights, request methods, and supporting evidence.
Required CCPA contract terms, role checks, subcontractor flow-downs, oversight rights, and evidence for service providers and contractors.
Choose a proportionate CCPA verification method for know, delete, and correct requests without collecting unnecessary identity data.
CCPA triggers, deadlines, evidence, retention, and submission duties for risk assessments and annual cybersecurity audits.