This page maps California requirements into scope triggers, accountable owners, controls, evidence records, deadlines, and escalation points.
Start with coverage and the data flow, then identify the notices, request methods, opt-outs, contracts, security controls, assessments, audits, and duties that apply.
The amended the CCPA, so the operative requirements come from the CCPA as amended and the CPPA regulations. A covered business must control what it collects and why, tell consumers what it does, honor applicable rights and opt-outs, govern recipients, limit retention, maintain reasonable security, and apply the separate triggers and phase-in dates in the regulations effective January 1, 2026.
1
Section 1
What are the core requirements for a covered business?
Start with coverage. The main business definition applies to a for-profit entity that does business in California, determines the purposes and means of processing, and crosses at least one statutory threshold: preceding-year annual gross revenue above $25 million, as adjusted under the statute; buying, selling, or sharing the personal information of at least 100,000 consumers or households in a year; or deriving at least 50 percent of annual revenue from selling or sharing personal information. The statute also has rules for certain related entities, joint ventures or partnerships, and voluntary certification.
Personal information is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked directly or indirectly with a consumer or household. It can include device identifiers, browsing activity, inferences, and pseudonymous profiles, not only names and contact details. Publicly available, deidentified, and aggregate consumer information are excluded only when their statutory conditions are met.
Give notice at or before collection, use and retain personal information only as reasonably necessary and proportionate to the disclosed compatible purposes, and keep the privacy policy current. The policy and request methods must cover the rights that apply, including know or access, deletion, correction, sale or sharing opt-out, and limitation of qualifying uses and disclosures of sensitive personal information.
A business that sells or shares personal information must provide the required choice mechanism and honor qualifying opt-out preference signals. If it sells or shares the personal information of a consumer it has actual knowledge is under 16, the opt-in rules apply, with the consumer consenting at ages 13 through 15 and the parent or guardian consenting below 13.
Use written agreements when personal information is sold, shared, or disclosed to a service provider or contractor. The agreement must state the limited purpose, restrict use, require the same level of protection, allow reasonable compliance checks, require notice of inability to comply, and allow the business to stop and remediate unauthorized use.
For deletion, correction, know, -access, and ADMT-appeal requests, confirm receipt within 10 business days and respond within 45 calendar days. One extension of up to 45 additional calendar days is available when necessary if the business gives notice and explains the delay. Sale-or-sharing opt-outs and sensitive-personal-information limits have a different deadline: comply as soon as feasibly possible and no later than 15 business days.
Notices: map each category to source, purpose, sale or sharing status, sensitive-information status, and retention period or criteria.
Rights: provide compliant intake methods, verify only where required, meet response times, act across systems and instructed recipients, and explain denials.
Choice: implement sale or sharing opt-outs, opt-out preference signals, sensitive-information limits, minor consent, and non-discrimination.
Governance: maintain recipient contracts, reasonable security, request records, staff training, retention controls, and evidence for every claimed exception.
Official CPPA rulemaking page for CCPA/CPRA updates on cybersecurity audits, risk assessments, automated decisionmaking technology, and insurance regulations.
Binding source for the business-coverage thresholds, consumer rights, sale, sharing, sensitive personal information, contracts, and statutory exceptions.
Current regulatory text for notices, request methods, the 10-business-day confirmation period, the 45-calendar-day response period, opt-outs, and sensitive-personal-information limits.
No later than 10 business days after receiving
2
Section 2
What changed with the regulations effective January 1, 2026?
The rulemaking completed in September 2025 and became effective January 1, 2026. It updated existing CCPA regulations and added requirements for risk assessments, annual cybersecurity audits, and consumer rights relating to used for significant decisions. Each article has a separate scope test and compliance schedule.
Risk assessments apply before specified processing that presents significant risk to consumers' privacy and must document the purpose, categories and context, benefits, negative impacts, safeguards, and approval. Existing covered processing continuing after the effective date must be assessed by December 31, 2027, and information for assessments conducted in 2026 and 2027 is first submitted by April 1, 2028.
Cybersecurity-audit deadlines phase in by annual gross revenue: April 1, 2028 for businesses over $100 million using 2026 revenue, April 1, 2029 for businesses from $50 million through $100 million using 2027 revenue, and April 1, 2030 for businesses below $50 million using 2028 revenue, provided the business otherwise meets the audit trigger.
Automated decisionmaking technology () is technology that processes personal information and uses computation to replace or substantially replace human decisionmaking. Article 11 applies when a business uses ADMT to provide or deny financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or healthcare services. Advertising alone is not a significant decision. A covered use that began before January 1, 2027, must comply by January 1, 2027.
Risk assessments: inventory triggering processing, complete the assessment before starting new covered processing, retain approval, and track Agency submission fields and dates.
: inventory uses that replace or substantially replace human decisionmaking for significant decisions, then implement pre-use notice, access, opt-out, and appeal requirements where applicable.
Do not treat a January 1, 2026 effective date as the first deadline for every business; record the article, trigger, existing-or-new processing status, and phase-in date.
Official CPPA rulemaking page for CCPA/CPRA updates on cybersecurity audits, risk assessments, automated decisionmaking technology, and insurance regulations.
Final regulatory text for risk-assessment timing, cybersecurity-audit phase-in and certification, and ADMT duties.
3
Section 3
Which boundaries and exemptions change the requirements?
Sale and sharing are distinct statutory concepts. A sale is making personal information available to a third party for money or other valuable consideration. Sharing covers making it available to a third party for cross-context behavioral advertising, whether or not money changes hands. Both definitions have conditional exclusions. A recipient cannot be treated as a service provider or contractor for cross-context behavioral advertising services.
Sensitive personal information is a defined subset that includes specified government identifiers and account credentials, precise geolocation, listed origin and belief data, union membership, certain communication contents, genetic and neural data, qualifying biometric and health data, sex-life or sexual-orientation information, and information about consumers the business actually knows are under 16. The right to limit applies to uses and disclosures outside specified permitted purposes rather than to every processing operation involving that information. Publicly available information, deidentified information, and aggregate consumer information also have defined conditions.
Exemptions often attach to information or activity, not the entire organization. Analyze CMIA, HIPAA, GLBA, FCRA, and other statutory provisions against the specific data and processing. Keep Delete Act data-broker registration and DROP duties separate from the CCPA requirements inventory.
Check whether the entity is a , service provider, contractor, third party, or data broker for the processing at issue.
Check whether the data is personal information, sensitive personal information, publicly available, deidentified, aggregate, or covered by a statutory exemption.
Check whether the disclosure is a sale, sharing, or permitted business-purpose disclosure supported by the required contract.
Check whether a consumer request may be denied or limited and record the exact exception, verification problem, impossibility, or disproportionate-effort basis.
Official CPPA rulemaking page for CCPA/CPRA updates on cybersecurity audits, risk assessments, automated decisionmaking technology, and insurance regulations.
Binding source for sale, sharing, sensitive personal information, recipient roles, statutory exemptions, and consumer-request limits.
4
Section 4
How should teams document requirements and evidence?
Create a requirements register that identifies the controlling provision, trigger, affected entity and processing, owner, required action, response or compliance date, evidence location, exception, and test result. Link the entry to the data inventory and the public notice that describes the processing.
Evidence should show how each control operates. Keep dated request records, opt-out and GPC test results, system deletion and correction records, recipient instructions, executed contracts, retention jobs, risk-assessment approvals and submissions, cybersecurity-audit reports and certifications, and notices and request outcomes.
Assign one accountable owner and one reviewer to each requirement.
Test the control against a real data flow or representative request and retain the result.
Record partial applicability and exceptions at the data-set or processing level.
Reassess after changes to entities, purposes, systems, recipients, advertising, retention, security risk, , or the governing text.
Official CPPA rulemaking page for CCPA/CPRA updates on cybersecurity audits, risk assessments, automated decisionmaking technology, and insurance regulations.
Binding statutory source for scope, consumer rights, data-use limits, opt-outs, contracts, exemptions, and enforcement.
Binding source for the business-coverage thresholds, consumer rights, sale, sharing, sensitive personal information, contracts, and statutory exceptions.
Binding source for sale, sharing, sensitive personal information, recipient roles, statutory exemptions, and consumer-request limits.
"satisfies one or more of the following thresholds"
Current regulatory text for notices, request methods, the 10-business-day confirmation period, the 45-calendar-day response period, opt-outs, and sensitive-personal-information limits.
Official CPPA rulemaking page for CCPA/CPRA updates on cybersecurity audits, risk assessments, automated decisionmaking technology, and insurance regulations.