We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideUSRequirements

US CCPA Requirements

Use this reference to map each CCPA duty to its trigger, responsible actor, action, deadline, evidence, and exception.

The CCPA as amended by the CPRA is one regime. The regulations effective January 1, 2026 add phased risk-assessment, cybersecurity-audit, and duties for businesses that meet their specific triggers.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
4 sections2 primary sources
Overview

The CCPA, as amended by the CPRA, applies to covered for-profit businesses handling California residents' personal information and also assigns duties to , contractors, and third parties. Test entity coverage and data-specific exemptions first, then map each applicable duty to its trigger, owner, deadline, evidence, exception, and reassessment event.

Section 1

Core requirements for every covered business

A must limit collection, use, retention, and sharing to what is reasonably necessary and proportionate for disclosed purposes. It must give notice at or before collection and maintain a privacy policy describing online and offline practices, consumer rights, and request methods. Exemptions under sections 1798.145 and 1798.146 often attach to specified information or activities, so an exempt dataset does not necessarily remove the entity or its other processing from scope.

The business must provide and operate the rights that apply to the data and activity: know, delete, correct, opt out of sale or sharing, limit specified uses or disclosures of sensitive personal information, and receive equal treatment. Current regulations also govern access to and opt-out from covered .

  • Maintain a data inventory linking categories, sources, purposes, retention periods, recipients, sales, sharing, sensitive-information uses, applicable exemptions, and the legal entity acting in each role.
  • Present required disclosures in plain language and make methods for exercising rights easy to find and use.
  • Use reasonable security procedures and practices appropriate to the nature of the personal information.
  • Do not discriminate because a consumer exercised a CCPA right, subject to the statute's rules for financial incentives and price or service differences.
Section 2

Request, opt-out, and verification requirements

For requests to know, delete, correct, access , or appeal ADMT, confirm receipt within 10 business days and respond within 45 calendar days. A necessary extension can add up to 45 calendar days if the consumer receives timely notice and an explanation.

Verify know, delete, correct, and -access requests with a reasonable, documented method. Do not require identity verification for sale-or-sharing opt-outs, limit requests, or ADMT opt-outs. Sale-or-sharing and limit requests generally must be implemented as soon as feasible and no later than 15 business days.

  • Offer the request methods required for the way the business interacts with consumers, including authorized-agent procedures.
  • Process qualifying opt-out preference signals for the browser or device and associated profiles; extend the choice to the known consumer where required.
  • Propagate deletion, correction, opt-out, and limit instructions to , contractors, or third parties when the statute or regulations require it.
  • Record receipt, verification, decision, response, exception, downstream instruction, and completion date; retain request records for at least 24 months without using the log for unrelated purposes.
Section 3

Recipient contracts and restricted roles

A disclosure is not automatically outside sale or sharing because a contract calls the recipient a service provider. The contract and actual processing must satisfy the applicable service-provider or contractor definition and restrictions.

Contracts with , contractors, and third parties must identify limited purposes, restrict unauthorized use and disclosure, require the applicable level of CCPA protection, support consumer requests, and permit appropriate monitoring and remediation.

  • Map actual recipient uses before selecting a contract form.
  • Treat independent cross-context behavioral advertising as a sharing analysis, not ordinary service-provider processing.
  • Require notice if a recipient can no longer meet its obligations and preserve the business's right to stop and remediate unauthorized use.
  • Reclassify the relationship when purposes, instructions, onward disclosures, or product features change.
Section 4

Trigger-specific 2026 requirements

Risk assessments, cybersecurity audits, and duties use separate regulatory triggers. General CCPA coverage does not prove that every one applies.

Risk assessments began for new covered processing on January 1, 2026. Covered processing already underway before that date must be assessed by December 31, 2027. compliance for significant decisions begins January 1, 2027. Initial cybersecurity-audit certifications are phased by revenue from April 1, 2028 through April 1, 2030.

  • Assess the trigger before new high-risk processing or significant-decision begins.
  • Document safeguards and whether the benefits of covered processing outweigh the negative privacy impacts.
  • Keep audit scope, auditor independence, findings, remediation, and certification evidence together.
  • Track the CPPA's completed rules separately from preliminary topics that are not binding.
Recommended next step

Turn US CCPA Requirements into assigned work

Assign each applicable requirement to an owner and retain the notice, log, contract, test, assessment, audit, or approval that shows the control operated.

Assessment workflow
Open Assessment Autopilot for US CCPA

Turn Requirements into scoped questions, evidence fields, and review tasks.

Explore next step
Research workflow
Review US CCPA source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step
Talk to Sorena
Talk through implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step
Primary sources

References and citations

CCPA regulations effective January 1, 2026
cppa.ca.gov5 citations
Referenced sections
  • Current consolidated operational requirements and phased dates.
  • Current regulations for minimization, notices, consumer-right workflows, ADMT rights, and evidence records.
  • Sections 7021, 7025-7027, 7060-7063, and 7101 govern timing, opt-outs, verification, authorized agents, and records.
Show 2 more
  • Sections 7050-7053 govern contracts and duties for service providers, contractors, and third parties.
  • Articles 9-11 establish cybersecurity-audit, risk-assessment, and ADMT triggers, duties, and phased dates.
California Civil Code, Title 1.81.5
leginfo.legislature.ca.gov2 citations
Referenced sections
  • Binding CCPA requirements and exemptions.
  • Binding requirements for minimization, notices, rights, security, non-discrimination, contracts, and enforcement.

Related guides

CCPA Consumer Rights Workflow: Requests, Clocks, and Evidence

Route CCPA requests by right, apply the correct verification and response rule, coordinate downstream action, and retain a clear decision record.

CCPA Contract Classification: Service Provider or Third Party?

Classify CCPA recipients from their actual processing and contracts, then document the clauses, restrictions, monitoring, and opt-out consequences.

CCPA Deadlines and Compliance Calendar

Track CCPA request clocks, annual duties, DROP dates, and phased 2026-2030 deadlines for risk assessments, ADMT, and cybersecurity audits.

CCPA Do Not Sell or Share Guide

Classify CCPA sales and sharing, provide valid opt-out methods, honor preference signals, stop disclosures within 15 business days, and notify recipients.

CCPA Do Not Sell or Share: Implementation and Testing

Implement CCPA sale-or-sharing opt-outs across links, GPC, consent state, ad tech, recipients, confirmation, privacy disclosures, and evidence.

CCPA DSAR Workflow: Intake, Verification, and Response

Run CCPA data-subject requests from intake through verification, search, exception review, downstream action, response, and retained evidence.

Show all related guides (44)

CCPA Opt-Out Signal Workflow: Detect, Apply, and Test GPC

Process CCPA opt-out preference signals across browsers, devices, profiles, accounts, offline data, conflicts, recipients, and confirmation controls.

CCPA Penalties and Fines: Current Amounts

See current CCPA fines, civil penalties, security-breach damages, adjustment rules, and the facts needed before estimating exposure.

CCPA Privacy Policy Template: Required Content and Review

Draft and maintain a CCPA privacy policy covering data practices, rights, request methods, GPC handling, minors, contacts, and the last-updated date.

CCPA Risk Assessments, Cybersecurity Audits, and ADMT

Apply California's regulations effective January 1, 2026 for risk-assessment triggers, phased cybersecurity audits, ADMT rights, evidence, reviews, and CPPA submissions.

CCPA vs CPRA: What Changed and Which Rules Apply

Compare the original CCPA with the CPRA amendments and learn why current California privacy work must use the CCPA as amended, not two separate laws.

CCPA vs GDPR: Scope, Rights, Duties, and Evidence

Compare the California CCPA and EU GDPR by scope, roles, legal basis, rights, advertising transfers, contracts, security, deadlines, and enforcement.

US CCPA Applicability Test Guide

Apply the CCPA entity-by-entity: test California nexus, for-profit control, current thresholds, related-entity routes, exemptions, and processing roles.

US CCPA Compliance Checklist

A verifiable CCPA checklist for scope, data mapping, notices, rights, opt-outs, contracts, retention, security, risk assessments, audits, ADMT, and evidence.

US CCPA Compliance Guide

Build a CCPA operating model for entity scope, data mapping, notices, rights, opt-outs, contracts, retention, security, assessments, audits, ADMT, and evidence.

US CCPA Dark Patterns Guide

Review CCPA privacy interfaces for plain language, symmetry, minimal steps, neutral presentation, valid consent, and reliable opt-out operation.

US CCPA Data Broker Crossover Guide

Test whether a CCPA business is also a California data broker, then assign registration, metrics, DROP, deletion, downstream, and audit duties.

US CCPA DSAR Verification Guide

Verify CCPA know, delete, correct, and ADMT-access requests with request-specific, secure, minimized methods without adding friction to opt-outs.

US CCPA Enforcement and Penalties Guide

Understand CPPA investigations, Attorney General civil actions, CCPA administrative orders, current penalties, and the limited security-breach private action.

US CCPA Financial Incentives Guide

Decide whether a CCPA financial-incentive rule applies, then document the notice, data-value method, opt-in, withdrawal, and nondiscrimination checks.

US CCPA GPC Signal Guide

Implement Global Privacy Control under the CCPA across browsers, devices, accounts, ad technology, downstream recipients, and consumer notices.

US CCPA Minors Guide

Apply the CCPA opt-in rules for selling or sharing personal information of consumers under 16, including age bands, authorization, notices, and evidence.

US CCPA Notice at collection Guide

Build a CCPA Notice at Collection for online and offline collection points, including categories, purposes, sale or sharing, retention, links, and change control.

US CCPA Personal and Sensitive PI Categories Guide

Classify CCPA personal information and sensitive personal information, apply exclusions, and map each category to notices, rights, retention, security, sale, and sharing.

US CCPA Privacy Law FAQ

Direct answers on CCPA scope, rights, notices, opt-outs, GPC, minors, sensitive information, financial incentives, and data brokers.

US CCPA Privacy Notices and Disclosures Guide

Choose and maintain each CCPA consumer notice: privacy policy, collection, sale or sharing, sensitive-information limits, financial incentives, and ADMT.

US CCPA Privacy Policy Guide

Build and maintain a CCPA privacy policy covering online and offline practices, 12-month disclosures, consumer rights, request methods, and annual updates.

US CCPA Scope and Thresholds Guide

CCPA scope and threshold reference covering the current $26,625,000 revenue threshold, the 100,000-consumer-or-household test, related entities, and exemptions.

US CCPA Service Provider Contractor and Third Party Contracts Guide

Classify CCPA recipients and check the distinct contract terms for service providers, contractors, and third parties before disclosing personal information.

US CCPA Service Provider Contractor Contracts Guide

Check CCPA service-provider and contractor agreements for specific purposes, use restrictions, consumer-request support, subcontractors, and remediation.

US CCPA Thresholds Guide

Apply the CCPA business thresholds per legal entity, including the 2025 CPI-adjusted revenue amount, volume and sale-or-sharing tests, and control routes.

California Data Brokers: CCPA, Registration, and DROP Duties

Decide whether a CCPA business is also a California data broker and track registration, privacy metrics, DROP deletion, vendor, and audit duties.

CCPA Dark Patterns: Rules, Examples, and Review Checklist

Check a CCPA privacy interface for clear language, symmetrical choices, unnecessary steps, and other designs that can invalidate consent.

CCPA Do Not Sell or Share: Scope and Implementation

Determine whether a transfer is a CCPA sale or sharing, provide the required opt-out path, honor preference signals, and propagate the choice.

CCPA Financial Incentives: Notice, Consent, and Data Value

Assess a loyalty, discount, payment, or service program under the CCPA and document notice, opt-in, withdrawal, and data-value requirements.

CCPA Global Privacy Control (GPC): team obligations and technical implementation

Implement Global Privacy Control as a CCPA sale and sharing opt-out across browsers, devices, known accounts, and relevant downstream systems.

CCPA Minors: Opt-In Rules for Consumers Under 16

Apply the CCPA's under-13 parent authorization and age-13-to-15 consumer opt-in rules for sale or sharing of personal information.

CCPA Notice at Collection: Timing, Content, and Examples

Place a CCPA notice where consumers encounter it before collection and disclose categories, purposes, retention, sale or sharing, and required links.

CCPA Personal and Sensitive Information Categories

Classify personal and sensitive personal information under the current CCPA, including exclusions and the duties each category can trigger.

Does the CCPA apply to my business? Threshold guide

Apply the CCPA revenue, data-volume, and sale-or-sharing revenue thresholds, then check California nexus, control, joint ventures, roles, and exemptions.

What must a CCPA privacy policy include?

A practical guide to CCPA privacy-policy content, placement, annual updates, consumer rights, request methods, and supporting evidence.

What must CCPA service-provider contracts include?

Required CCPA contract terms, role checks, subcontractor flow-downs, oversight rights, and evidence for service providers and contractors.

What should teams do about consumer request verification under the CCPA?

Choose a proportionate CCPA verification method for know, delete, and correct requests without collecting unnecessary identity data.

When does the CCPA require risk assessments or cyber audits?

CCPA triggers, deadlines, evidence, retention, and submission duties for risk assessments and annual cybersecurity audits.