--- title: "CCPA Requirements" canonical_url: "https://www.sorena.io/artifacts/us/ccpa/requirements" source_url: "https://www.sorena.io/artifacts/us/california-consumer-privacy-act/requirements" author: "Sorena AI" description: "Translate California law into control statements that can be implemented, tested, and audited." published_at: "2026-02-21" updated_at: "2026-02-21" keywords: - "CCPA requirements" - "California privacy requirements" - "CCPA controls" - "do not sell or share requirements" - "CCPA" - "Requirements" - "California privacy" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # CCPA Requirements Translate California law into control statements that can be implemented, tested, and audited. *Requirements* *CCPA* ## California CCPA Requirements Grounded in the California statute, CPPA regulations, and current California enforcement themes. A California requirement matrix should be specific enough to drive notice content, consumer interfaces, contract drafting, and technical testing. ## Scope and disclosure requirements The first requirement domain covers threshold analysis, business status, notice at collection, privacy policy content, and sale or sharing disclosures. - Threshold decision with documented calculations and annual reassessment - Notice at collection before or at the point of collection - Privacy policy disclosures for categories, purposes, recipients, and rights - Accurate opt out and financial incentive notices where relevant *Recommended next step* *Placement: after the requirement breakdown* ## Turn California CCPA Requirements into an operational assessment Assessment Autopilot can take California CCPA Requirements from turning the requirements into assigned actions to a reusable workflow inside Sorena. Teams working on California CCPA can keep owners, evidence, and next steps aligned without copying this guide into separate documents. - [Open Assessment Autopilot for California CCPA Requirements](/solutions/assessment.md): Start from California CCPA Requirements and turn the guidance into owned tasks, evidence requests, and review checkpoints. - [Talk through California CCPA](/contact.md): Review your current process, evidence gaps, and next steps for California CCPA Requirements. ## Consumer choice and request requirements The second domain covers requests to know, delete, correct, opt out, and limit where the current rules require it. It also covers GPC and identity verification controls. - 45 day request workflow with documented extension logic - Proportionate verification for delete, correct, and know requests - No burdensome verification for opt out of sale or sharing - GPC support and downstream suppression logic where applicable ## Vendor, security, and evidence requirements The final domain covers service provider, contractor, and third party agreements, reasonable security, and evidence retention. - Service provider, contractor, and third party contract terms that match the regulations - Due diligence and remediation rights for vendor misuse - 24 month request records and wider programme evidence retention - Reasonable security linked to incident readiness and private claim exposure ## Primary sources - [CPPA regulations](https://cppa.ca.gov/regulations/?ref=sorena.io) - Official California regulations hub. - [California privacy statute effective January 1, 2026](https://cppa.ca.gov/regulations/pdf/ccpa_statute_2026.pdf?ref=sorena.io) - Current statutory text as reflected in CPPA materials. - [CPPA FAQ](https://cppa.ca.gov/faq.html?ref=sorena.io) - Official California FAQ. - [CPPA CCPA updates](https://cppa.ca.gov/ccpa_updates.html?ref=sorena.io) - Rulemaking and effective date updates. ## Related Topic Guides - [CCPA Applicability Test | California Scope Test](/artifacts/us/california-consumer-privacy-act/applicability-test.md): Test whether a business is in scope under the current California threshold model. - [CCPA Checklist | California Privacy Compliance Checklist](/artifacts/us/california-consumer-privacy-act/checklist.md): Track the California controls that must actually exist in policy, product, and vendor operations. - [CCPA Compliance Program | California Operating Model](/artifacts/us/california-consumer-privacy-act/compliance.md): Build a California privacy programme that survives regulator questions and product change. - [CCPA Consumer Rights Workflow | 45 Day Request Handling](/artifacts/us/california-consumer-privacy-act/consumer-rights-workflow.md): Run California rights operations with clear timing, verification, and downstream instructions. - [CCPA Deadlines and Compliance Calendar](/artifacts/us/california-consumer-privacy-act/deadlines-and-compliance-calendar.md): Use the dates that actually shape California privacy work. - [CCPA Enforcement and Penalties | CPPA and AG Exposure Guide](/artifacts/us/california-consumer-privacy-act/enforcement-and-penalties.md): Understand how California enforcement usually starts and what evidence the agency will ask for. - [CCPA FAQ | Practical California Privacy Answers](/artifacts/us/california-consumer-privacy-act/faq.md): Answer the California privacy questions that usually stall implementation. - [CCPA Penalties and Fines | California Exposure Summary](/artifacts/us/california-consumer-privacy-act/penalties-and-fines.md): Know the penalty ranges, then work backward to the controls that reduce them. - [CCPA Privacy Notices and Disclosures | California Notice Architecture](/artifacts/us/california-consumer-privacy-act/privacy-notices-and-disclosures.md): Design the California notice stack so each disclosure appears in the right place and says the right thing. - [CCPA Privacy Policy Template | Required California Disclosures](/artifacts/us/california-consumer-privacy-act/ccpa-privacy-policy-template.md): Write a California privacy policy that actually matches the statute and regulations. - [CCPA Scope and Thresholds | California Business Threshold Guide](/artifacts/us/california-consumer-privacy-act/scope-and-thresholds.md): Use the real California threshold tests instead of rough privacy folklore. - [CCPA Service Provider and Contractor Contracts](/artifacts/us/california-consumer-privacy-act/service-provider-contractor-contracts.md): Draft California vendor contracts that work in practice, not only on paper. - [CCPA vs CPRA | What Actually Changed in California Privacy](/artifacts/us/california-consumer-privacy-act/ccpa-vs-cpra.md): A practical CCPA vs CPRA delta guide grounded in the current California statute, CPPA regulations, and official agency guidance. - [CCPA vs GDPR | California and EU Privacy Comparison](/artifacts/us/california-consumer-privacy-act/ccpa-vs-gdpr.md): Compare California CCPA obligations with the GDPR without assuming the two models are interchangeable. - [Do Not Sell or Share Implementation | CCPA and GPC Guide](/artifacts/us/california-consumer-privacy-act/do-not-sell-share-implementation.md): Implement California opt out controls that actually work across websites, apps, and partner pipelines. --- [Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/us/california-consumer-privacy-act/requirements