California CPRA Checklist

The scope record controls the rest of the checklist. Test each legal entity against California business activity, control of processing purposes and means, and the preceding-year thresholds. Record the statutory revenue amount and any inflation adjustment used for the review year rather than assuming the original $25 million figure is static. For the volume threshold, count consumers and households whose personal information the entity buys, sells, or shares; the threshold is not a general count of website visitors or records processed. Also test controlled or controlling entities that share common branding and consumer personal information, joint ventures or partnerships in which each business has at least a 40 percent interest, and any entity that voluntarily certified compliance.

Map exemptions by data set and activity, not by company label. The statute contains exclusions or exemptions for matters such as deidentified and aggregate consumer information, medical information governed by the Confidentiality of Medical Information Act, protected health information handled under HIPAA, specified information processed under the Gramm-Leach-Bliley Act or California Financial Information Privacy Act, and activities governed by the Fair Credit Reporting Act. Each has its own wording and limits; an organization subject to one sectoral law may still hold other personal information covered by the CCPA.

Inventory each category of personal information and sensitive personal information, its source, disclosed purpose, system, consumer population, recipient, sale or sharing status, retention period, and deletion method. Under the CCPA, a sale can involve monetary or other valuable consideration, while sharing is disclosure for cross-context behavioral advertising whether or not money changes hands. A service provider or contractor is a contract-bound recipient acting for limited business purposes; calling a recipient a vendor does not establish that status.

Check that the notice at collection appears at or before collection and identifies the categories collected, purposes, whether each category is sold or shared, and the retention period or criteria for each category. A later use must remain compatible with the disclosed purpose unless the business gives a compliant new notice. The privacy policy must explain applicable rights and submission methods, list required disclosures, and be updated at least once every 12 months.

Verify that the business offers the required submission methods. An exclusively online business with a direct relationship to the consumer may use an email address for delete, correct, and know requests. Other businesses need at least two methods, including a toll-free number; a business with a website must also provide a website method. A request submitted through a non-designated channel must be treated as submitted or the consumer must receive instructions for curing the deficiency.

For delete, correct, and know requests, confirm receipt within 10 business days and respond within 45 calendar days from receipt, even while verification is pending. One extension of up to 45 additional calendar days is available when necessary if the business gives notice and explains the delay within the first period. Match verification to sensitivity and harm: account holders generally reauthenticate, while a non-account holder's request for specific pieces of information requires a reasonably high degree of certainty. Do not collect more verification data than needed, and do not verify against the same data element the consumer says is inaccurate.

Branch the work by right. Delete from active systems, or deidentify or aggregate the information, and notify service providers, contractors, and relevant third parties; backup deletion may wait until restoration or later access. Correct inaccurate information in active systems, prevent a later vendor refresh from overwriting the correction, and instruct service providers and contractors. For requests to know, distinguish categories from specific pieces and withhold restricted information such as Social Security numbers, account credentials, and unique biometric data.

Businesses that sell or share personal information must provide compliant opt-out methods and process recognized opt-out preference signals such as Global Privacy Control as a request for that browser or device and, when known, the associated consumer. Stop sale or sharing as soon as feasibly possible and no later than 15 business days, then notify recipients that received the information during the interval as required. Do not require identity verification for an opt-out or limit request. A qualifying request to limit sensitive-personal-information use or disclosure has the same 15-business-day outer limit. Wait at least 12 months before asking a consumer to opt back in, except where the regulations allow otherwise.

Add separate branches for consumers under 16 when the business has actual knowledge that it sells or shares their personal information, authorized agents, nondiscrimination and financial-incentive review, and ADMT used for significant decisions. The 2026 regulations require covered ADMT uses that began before January 1, 2027, to comply with pre-use notice and access requirements, plus either the opt-out requirement or an applicable exception such as a qualifying human appeal, by January 1, 2027.

Classify each recipient before disclosure. Contracts with service providers, contractors, and third parties must state the limited purpose, applicable use restrictions, same-level privacy protection, compliance duties, notice if the recipient can no longer comply, and the business's monitoring and remediation rights. A contract label alone does not create service-provider or contractor status.

Confirm that collection, use, retention, and sharing are reasonably necessary and proportionate to the disclosed purposes. The notice at collection must state a retention period or criteria for each category, and the business must not retain information longer than reasonably necessary for the disclosed purpose. Retain the approved schedule, legal holds, deletion-run evidence, backup rules, and exception decisions. Maintain reasonable security procedures appropriate to the nature of the personal information and test whether contracts and operational controls support them.

Screen separately for the regulations effective January 1, 2026. A risk assessment is required before selling or sharing personal information, processing sensitive personal information outside the narrow employee-administration exception, using ADMT for a significant decision, specified profiling in employment, education, or sensitive locations, and specified training of ADMT or identity technologies. Review it at least every three years and update it within 45 calendar days after a material change. Covered processing already underway before January 1, 2026, must be assessed by December 31, 2027.

Cybersecurity-audit scope uses a separate test. It covers a business deriving at least 50 percent of revenue from sale or sharing, or a revenue-threshold business that processed at least 250,000 consumers or households, or sensitive personal information of at least 50,000 consumers, in the preceding year. First audit reports phase in on April 1, 2028, 2029, or 2030 based on annual gross revenue and the regulatory schedule. ADMT used for a significant decision must meet Article 11 by January 1, 2027. Record each trigger, measurement year, owner, first due date, recurring review, submission, certification, and retained evidence instead of using one '2026 complete' checkbox.