Build one CCPA operating model linking entity scope, data inventory, notices, rights, and opt-outs, recipient contracts, retention, security, risk assessments, cybersecurity audits, automated decisionmaking technology (), and enforcement evidence.
Ground decisions in the consolidated CCPA statute and the regulations effective through January 1, 2026; preserve the trigger, owner, evidence, deadline, and reassessment condition for each control.
CCPA compliance starts with a per-entity scope decision and a current data inventory. Connect every collection point, use, disclosure, request, and consumer choice to an owner, control, deadline, and evidence record; a privacy policy alone does not prove that the control operates.
Divide the program into six connected workstreams: scope and governance; data mapping and minimization; notices and consumer choices; rights operations; recipient contracts and oversight; and security, risk assessments, cybersecurity audits, and automated decisionmaking technology ().
Each workstream needs a decision register. For every control, record the legal trigger, affected entities and systems, accountable owner, implementation evidence, exception, deadline, and event that requires reassessment.
Sources (2)
Current consolidated requirements for disclosures, request operations, contracts, recordkeeping, assessments, audits, and ADMT.
Voluntary IAB Tech Lab industry framework for publisher and ad-tech signaling and contractual workflows; it is not a source of CCPA legal duties.
The team able to change a process should own its control. Privacy or legal interprets ambiguous triggers, but product owns interface behavior, engineering owns signal and request propagation, procurement owns contract completion, security owns safeguards and audits, and support owns intake execution.
Evidence must show what operated, not only what policy said. Preserve dated notices, deployed interface captures, test results, request logs, vendor instructions, contract versions, retention jobs, assessment approvals, audit reports, and remediation records.
Sources (2)
Articles 3, 4, 8, 9, and 10 support request, contract, recordkeeping, audit, and assessment evidence.
Official enforcement advisory on applying the CCPA's data-minimization requirements to consumer-request handling.
Applying Data Minimization to Consumer Requests
The regulations effective January 1, 2026 added risk-assessment, annual cybersecurity-audit, and requirements. General CCPA coverage does not trigger all three automatically; each article has its own processing, revenue, or risk criteria.
Covered risk assessments began for new processing on January 1, 2026. Continuing pre-2026 processing must be assessed by December 31, 2027, and the first required submission for 2026-2027 assessments is due April 1, 2028. obligations for significant decisions begin January 1, 2027. Initial cybersecurity-audit certification deadlines are phased by revenue on April 1 of 2028, 2029, or 2030.
Sources (3)
Official status and effective-date source for the completed 2025 rulemaking.
Official informational FAQ confirming that the regulations were finalized, became effective January 1, 2026, and have phased compliance deadlines beginning in 2027 and 2028.
Binding transition provisions for risk assessments, cybersecurity audits, and ADMT.
A business that uses ADMT for a significant decision prior to January 1, 2027, must be in compliance with the requirements of this Article no later than January 1, 2027.
Review core scope, inventory, privacy policy, request methods, and evidence at least annually. Review a specific control sooner when its facts change.
Open a change review before a new collection purpose, recipient, ad-tech tag, financial incentive, sensitive-information use, significant-decision , acquisition, or data-broker activity goes live.
Sources (2)
Section 7101 requires at least 24 months of consumer-request records; other articles supply control-specific review triggers.
Voluntary IAB Tech Lab industry framework for publisher and ad-tech signaling and contractual workflows; it is not a source of CCPA legal duties.
Connect each CCPA trigger to the team that can change the process, the evidence showing it operated, and the event that reopens the decision.
Turn Compliance into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
"One acceptable method for consumers to opt-out of sales or sharing is via a user-enabled global privacy control, like the GPC."
"A business that uses ADMT for a significant decision prior to January 1, 2027, must be in compliance with the requirements of this Article no later than January 1, 2027."
"Applying Data Minimization to Consumer Requests"
"In doing so, the regulations make it easier for consumers to exercise their CCPA rights"
Route CCPA requests by right, apply the correct verification and response rule, coordinate downstream action, and retain a clear decision record.
Classify CCPA recipients from their actual processing and contracts, then document the clauses, restrictions, monitoring, and opt-out consequences.
Track CCPA request clocks, annual duties, DROP dates, and phased 2026-2030 deadlines for risk assessments, ADMT, and cybersecurity audits.
Classify CCPA sales and sharing, provide valid opt-out methods, honor preference signals, stop disclosures within 15 business days, and notify recipients.
Implement CCPA sale-or-sharing opt-outs across links, GPC, consent state, ad tech, recipients, confirmation, privacy disclosures, and evidence.
Run CCPA data-subject requests from intake through verification, search, exception review, downstream action, response, and retained evidence.
Process CCPA opt-out preference signals across browsers, devices, profiles, accounts, offline data, conflicts, recipients, and confirmation controls.
See current CCPA fines, civil penalties, security-breach damages, adjustment rules, and the facts needed before estimating exposure.
Draft and maintain a CCPA privacy policy covering data practices, rights, request methods, GPC handling, minors, contacts, and the last-updated date.
Apply California's regulations effective January 1, 2026 for risk-assessment triggers, phased cybersecurity audits, ADMT rights, evidence, reviews, and CPPA submissions.
Compare the original CCPA with the CPRA amendments and learn why current California privacy work must use the CCPA as amended, not two separate laws.
Compare the California CCPA and EU GDPR by scope, roles, legal basis, rights, advertising transfers, contracts, security, deadlines, and enforcement.
Apply the CCPA entity-by-entity: test California nexus, for-profit control, current thresholds, related-entity routes, exemptions, and processing roles.
A verifiable CCPA checklist for scope, data mapping, notices, rights, opt-outs, contracts, retention, security, risk assessments, audits, ADMT, and evidence.
Review CCPA privacy interfaces for plain language, symmetry, minimal steps, neutral presentation, valid consent, and reliable opt-out operation.
Test whether a CCPA business is also a California data broker, then assign registration, metrics, DROP, deletion, downstream, and audit duties.
Verify CCPA know, delete, correct, and ADMT-access requests with request-specific, secure, minimized methods without adding friction to opt-outs.
Understand CPPA investigations, Attorney General civil actions, CCPA administrative orders, current penalties, and the limited security-breach private action.
Decide whether a CCPA financial-incentive rule applies, then document the notice, data-value method, opt-in, withdrawal, and nondiscrimination checks.
Implement Global Privacy Control under the CCPA across browsers, devices, accounts, ad technology, downstream recipients, and consumer notices.
Apply the CCPA opt-in rules for selling or sharing personal information of consumers under 16, including age bands, authorization, notices, and evidence.
Build a CCPA Notice at Collection for online and offline collection points, including categories, purposes, sale or sharing, retention, links, and change control.
Classify CCPA personal information and sensitive personal information, apply exclusions, and map each category to notices, rights, retention, security, sale, and sharing.
Direct answers on CCPA scope, rights, notices, opt-outs, GPC, minors, sensitive information, financial incentives, and data brokers.
Choose and maintain each CCPA consumer notice: privacy policy, collection, sale or sharing, sensitive-information limits, financial incentives, and ADMT.
Build and maintain a CCPA privacy policy covering online and offline practices, 12-month disclosures, consumer rights, request methods, and annual updates.
Plain-language CCPA requirements covering scope, minimization, notices, rights, opt-outs, contracts, security, records, risk assessments, audits, and ADMT.
CCPA scope and threshold reference covering the current $26,625,000 revenue threshold, the 100,000-consumer-or-household test, related entities, and exemptions.
Classify CCPA recipients and check the distinct contract terms for service providers, contractors, and third parties before disclosing personal information.
Check CCPA service-provider and contractor agreements for specific purposes, use restrictions, consumer-request support, subcontractors, and remediation.
Apply the CCPA business thresholds per legal entity, including the 2025 CPI-adjusted revenue amount, volume and sale-or-sharing tests, and control routes.
Decide whether a CCPA business is also a California data broker and track registration, privacy metrics, DROP deletion, vendor, and audit duties.
Check a CCPA privacy interface for clear language, symmetrical choices, unnecessary steps, and other designs that can invalidate consent.
Determine whether a transfer is a CCPA sale or sharing, provide the required opt-out path, honor preference signals, and propagate the choice.
Assess a loyalty, discount, payment, or service program under the CCPA and document notice, opt-in, withdrawal, and data-value requirements.
Implement Global Privacy Control as a CCPA sale and sharing opt-out across browsers, devices, known accounts, and relevant downstream systems.
Apply the CCPA's under-13 parent authorization and age-13-to-15 consumer opt-in rules for sale or sharing of personal information.
Place a CCPA notice where consumers encounter it before collection and disclose categories, purposes, retention, sale or sharing, and required links.
Classify personal and sensitive personal information under the current CCPA, including exclusions and the duties each category can trigger.
Apply the CCPA revenue, data-volume, and sale-or-sharing revenue thresholds, then check California nexus, control, joint ventures, roles, and exemptions.
A practical guide to CCPA privacy-policy content, placement, annual updates, consumer rights, request methods, and supporting evidence.
Required CCPA contract terms, role checks, subcontractor flow-downs, oversight rights, and evidence for service providers and contractors.
Choose a proportionate CCPA verification method for know, delete, and correct requests without collecting unnecessary identity data.
CCPA triggers, deadlines, evidence, retention, and submission duties for risk assessments and annual cybersecurity audits.