California CPRA Requirements

Start with coverage. The main business definition applies to a for-profit entity that does business in California, determines the purposes and means of processing, and crosses at least one statutory threshold: preceding-year annual gross revenue above $25 million, as adjusted under the statute; buying, selling, or sharing the personal information of at least 100,000 consumers or households in a year; or deriving at least 50 percent of annual revenue from selling or sharing personal information. The statute also has rules for certain related entities, joint ventures or partnerships, and voluntary certification.

Personal information is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked directly or indirectly with a consumer or household. It can include device identifiers, browsing activity, inferences, and pseudonymous profiles, not only names and contact details. Publicly available, deidentified, and aggregate consumer information are excluded only when their statutory conditions are met.

Give notice at or before collection, use and retain personal information only as reasonably necessary and proportionate to the disclosed compatible purposes, and keep the privacy policy current. The policy and request methods must cover the rights that apply, including know or access, deletion, correction, sale or sharing opt-out, and limitation of qualifying uses and disclosures of sensitive personal information.

A business that sells or shares personal information must provide the required choice mechanism and honor qualifying opt-out preference signals. If it sells or shares the personal information of a consumer it has actual knowledge is under 16, the opt-in rules apply, with the consumer consenting at ages 13 through 15 and the parent or guardian consenting below 13.

Use written agreements when personal information is sold, shared, or disclosed to a service provider or contractor. The agreement must state the limited purpose, restrict use, require the same level of protection, allow reasonable compliance checks, require notice of inability to comply, and allow the business to stop and remediate unauthorized use.

For deletion, correction, know, ADMT-access, and ADMT-appeal requests, confirm receipt within 10 business days and respond within 45 calendar days. One extension of up to 45 additional calendar days is available when necessary if the business gives notice and explains the delay. Sale-or-sharing opt-outs and sensitive-personal-information limits have a different deadline: comply as soon as feasibly possible and no later than 15 business days.

The rulemaking completed in September 2025 and became effective January 1, 2026. It updated existing CCPA regulations and added requirements for risk assessments, annual cybersecurity audits, and consumer rights relating to ADMT used for significant decisions. Each article has a separate scope test and compliance schedule.

Risk assessments apply before specified processing that presents significant risk to consumers' privacy and must document the purpose, categories and context, benefits, negative impacts, safeguards, and approval. Existing covered processing continuing after the effective date must be assessed by December 31, 2027, and information for assessments conducted in 2026 and 2027 is first submitted by April 1, 2028.

Cybersecurity-audit deadlines phase in by annual gross revenue: April 1, 2028 for businesses over $100 million, April 1, 2029 for businesses from $50 million through $100 million, and April 1, 2030 for businesses below $50 million, provided the business otherwise meets the audit trigger.

Automated decisionmaking technology (ADMT) is technology that processes personal information and uses computation to replace or substantially replace human decisionmaking. Article 11 applies when a business uses ADMT to provide or deny financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or healthcare services. Advertising alone is not a significant decision. A covered use that began before January 1, 2027, must comply by January 1, 2027.

Sale and sharing are distinct statutory concepts. A sale is making personal information available to a third party for money or other valuable consideration. Sharing covers making it available to a third party for cross-context behavioral advertising, whether or not money changes hands. Both definitions have conditional exclusions. A recipient cannot be treated as a service provider or contractor for cross-context behavioral advertising services.

Sensitive personal information is a defined subset that includes specified government identifiers and account credentials, precise geolocation, listed origin and belief data, union membership, certain communication contents, genetic and neural data, qualifying biometric and health data, sex-life or sexual-orientation information, and information about consumers the business actually knows are under 16. The right to limit applies to uses and disclosures outside specified permitted purposes rather than to every processing operation involving that information. Publicly available information, deidentified information, and aggregate consumer information also have defined conditions.

Exemptions often attach to information or activity, not the entire organization. Analyze CMIA, HIPAA, GLBA, FCRA, and other statutory provisions against the specific data and processing. Keep Delete Act data-broker registration and DROP duties separate from the CCPA requirements inventory.

Create a requirements register that identifies the controlling provision, trigger, affected entity and processing, owner, required action, response or compliance date, evidence location, exception, and test result. Link the entry to the data inventory and the public notice that describes the processing.

Evidence should show how each control operates. Keep dated request records, opt-out and GPC test results, system deletion and correction records, recipient instructions, executed contracts, retention jobs, risk-assessment approvals and submissions, cybersecurity-audit reports and certifications, and ADMT notices and request outcomes.