leginfo.legislature.ca.gov
Referenced sections
- Official statutory text for the business definition, consumer rights, exemptions, enforcement, and limited private right of action.
By Sorena AIPublished Updated
CPRA
California Privacy Rights Act
California / guide to scope, consumer rights, sensitive information, , contracts, 2026 regulations, deadlines, and evidence.
- Regulator
- Control focus
- Signal support
- New rules effective
Understand California Privacy Rights Act
The amended the California Consumer Privacy Act; it did not create a separate compliance regime. Use this guide to decide whether the applies, identify the and recipient roles, map consumer rights, and phase the regulations effective January 1, 2026.
Start with the current threshold, California nexus, related entities, and exemptions by data set. Then map notices, requests, sale or sharing, sensitive personal information, opt-out preference signals, contracts, retention, risk assessments, cybersecurity audits, and to the people who act, the systems they change, the deadline, and the retained evidence.
Read this artifact as compliance after the amendments. Delete Act data-broker duties are adjacent California law: is live, and brokers begin processing platform requests on August 1, 2026.
CPRA quick scan
CPRA applicability scope
Use the $26.625 million 2025-adjusted revenue threshold, the 100,000-consumer-or-household test, or the sale/share-revenue test; document exemptions by data set.
CPRA workflow operations
Connect notice, request, , , retention, and vendor instructions to the systems and recipients that must act.
CPRA enforcement readiness
Treat the January 1, 2026 regulations as effective law. Track December 31, 2027 for existing-processing risk assessments, April 1, 2028 for the first risk submissions, the revenue-based audit phases, and applicable dates.
CPRA decisions
- 1
Does the CCPA, as amended, apply?
Confirm that the entity is a for-profit that collects consumer personal information or has it collected on its behalf, determines why and how that information is processed, and does business in California. Then check the current preceding-year revenue or processing threshold, related entities, voluntary certification, and data-specific exemptions.
- 2
Which right or recipient rule applies?
Separate access, deletion, correction, sale or sharing opt-out, limitation, , and service-provider, contractor, or third-party duties.
- 3
Which 2026 requirement is triggered?
Screen separately for risk assessments, annual cybersecurity audits, and used for significant decisions. The rules took effect January 1, 2026, but new and existing processing, revenue tiers, submissions, audit reports, certifications, and ADMT uses have different compliance dates.
Key milestones for California privacy operations
Track the 2018 , 2020 amendments, January 1, 2023 operative date, 2023 implementing regulations, and the cybersecurity-audit, risk-assessment, and regulations effective January 1, 2026. Later dates include January 1, 2027 for specified existing ADMT uses, December 31, 2027 for risk assessments of existing covered processing, April 1, 2028 for the first risk submissions, and phased audit dates through 2030. Data-broker and milestones are separate Delete Act duties.
Loading timeline...
Choose the next California privacy decision
New to California privacy? Start with applicability and the relationship between and . If scope is already documented, jump to rights, data-use controls, contracts, new 2026 regulations, deadlines, or comparisons.
Start here: scope and legal framework
Confirm that the covered law is the as amended by the , determine whether the threshold and California nexus are met, and record data-specific exemptions. Nonprofits and government agencies generally fall outside the business definition, while service providers, contractors, related entities, and voluntarily certified entities require separate checks.
Consumer rights and data-use controls
Build request, correction, , sale or sharing, , and retention controls around actual systems and data flows. For requests to know, delete, or correct, confirm receipt within 10 days and generally respond within 45 calendar days; an extension can bring the total to 90 days if the consumer is notified.
- US CPRA Consumer Rights Workflow Guide
- US CPRA DSAR and Correction Workflow Guide
- US CPRA Correction Rights Guide
- US CPRA Sensitive Personal Information Guide
- US CPRA Sensitive Personal Information Limits Guide
- US CPRA Sharing and Cross-Context Behavioral Advertising Guide
- US CPRA GPC Handling Guide
- US CPRA GPC Handling Workflow Guide
- US CPRA Retention Guide
Contracts and implementation evidence
Classify each recipient as a service provider, contractor, or third party. Put the required purpose limits and restrictions on selling, sharing, combining, retaining, using, and disclosing personal information into written contracts, then connect each role decision to the data flow and retained evidence.
Risk assessments, cybersecurity audits, and ADMT
Apply the regulations effective January 1, 2026: screen each trigger, distinguish new from existing processing, prepare the required reports and evidence, and track risk-assessment, submission, , audit, and certification dates separately.
Deadlines, enforcement, and adjacent data-broker law
Sequence effective and compliance dates, understand public enforcement and the limited private action, and keep Delete Act registry and duties distinct from the itself. DROP launched January 1, 2026; broker processing begins August 1, 2026.
Compare laws or answer a focused question
Compare California requirements with Colorado and Virginia, or use the FAQ for a direct answer on , , , audits, risk assessments, retention, and enforcement guidance.
Sources
cppa.ca.gov
Referenced sections
- Official plain-language explanation of the CCPA as amended, current scope thresholds, rights, business responsibilities, and phased requirements.
cppa.ca.gov
Referenced sections
- Official hub for the CCPA regulations, including the regulations effective January 1, 2026.
cppa.ca.gov
Referenced sections
- Official regulatory text for the cybersecurity-audit, risk-assessment, and ADMT duties effective January 1, 2026 and their phased compliance dates.
Next steps
Assign California privacy controls and evidence
Connect each applicable requirement, as amended by the , to the data flows, notices, request channels, vendors, risk assessments, audits, and uses the team operates.
- Record the preceding-year threshold calculation, California nexus, related-entity analysis, and each data-specific exemption before assigning controls; reassess after an acquisition, reorganization, new California activity, material data-flow change, or annual close.
- Map each consumer right and opt-out signal to the systems, recipients, deadlines, and evidence that prove the request was honored.
- Classify every recipient as a service provider, contractor, or third party and connect the role decision to the executed agreement and data flow.
- Track risk-assessment, cybersecurity-audit, and requirements by trigger and compliance date rather than labelling the 2026 regulations as proposed.
- Open Research Copilot
Answer threshold, exemption, rights, recipient-role, timing, and regulatory questions with cited official California sources.
- Open single source of truth
Keep threshold memos, request logs, tests, notices, contracts, assessments, audit reports, and approvals in one governed system.
- Talk through California privacy implementation
Review scope, current controls, phased 2026 duties, evidence gaps, and the next implementation steps.