What is the CCPA?
Published 12 min read
The CCPA is California’s privacy law: cross any one of its three lines and every Californian you hold data on can ask what you have, have it corrected or deleted, and stop you selling or sharing it, on a clock.
The CCPA in short
- Full name
- California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 and following
- In force
- Operative 1 January 2020; CPRA amendments operative 1 January 2023
- Who it binds
- For-profit businesses doing business in California that meet one or more of three tests
- The three tests
- Revenue over $26,625,000; or 100,000 or more consumers or households bought, sold or shared; or 50 percent or more of revenue from selling or sharing
- Who it protects
- Consumers: natural persons who are California residents, staff included
- Enforced by
- California Privacy Protection Agency (CalPrivacy) and the Attorney General
- Request clock
- Confirm in 10 business days; respond in 45 calendar days; 90 at most
- Opt-out clock
- No later than 15 business days
- Request records
- Kept at least 24 months
- Fines
- Up to $2,663 per violation; $7,988 if intentional or involving consumers known to be under 16
Statute and regulations as posted by the CPPA, read 22 Oct 2026. Information, not legal advice.
Who the CCPA covers
The law binds a “business”: a for-profit entity that does business in California, decides why and how personal information is processed, and meets one or more of three tests. The statute does not define “does business in” California or ask for an office there, so a firm that sells to Californians from another state should run the tests rather than assume it is outside.
$26,625,000
Annual gross revenue over this figure in the preceding calendar year (CPI-adjusted from $25,000,000, effective 1 January 2025).
§ 1798.140(d)(1)(A)
100,000
Or more consumers or households whose personal information it buys, sells or shares each year, alone or in combination.
§ 1798.140(d)(1)(B)
50 percent
Or more of its annual revenues derived from selling or sharing consumers' personal information.
§ 1798.140(d)(1)(C)
Any one of the three is enough. Statute as posted by the CPPA, read 22 Oct 2026.
The revenue figure moves. The CPPA adjusts the CCPA’s dollar amounts for inflation on 1 January of every odd-numbered year, so the next change is due on 1 January 2027. The 100,000 and 50 percent tests do not move.
The definition also pulls in an entity that controls, or is controlled by, a covered business and shares its branding and its customers’ data; a joint venture of businesses each holding at least a 40 percent interest; and anyone who volunteers to be bound by certifying to the CPPA (§ 1798.140(d)(2)–(4)).
Who counts as a consumer
“‘Consumer’ means a natural person who is a California resident … however identified, including by any unique identifier.”
There is no carve-out for staff. The exemptions that kept employee and job-applicant data, and the contacts at the firms you buy from or sell to, mostly outside the law were written to lapse, and both became inoperative on 1 January 2023 (§ 1798.145(m)(4), (n)(3)). The HR files of staff who live in California, and the Californians on your B2B contact list, are consumer data like any other.
What sits outside it
- Medical information governed by California’s Confidentiality of Medical Information Act, and protected health information held by a HIPAA covered entity or business associate (§ 1798.145(c)).
- Personal information collected, processed, sold or disclosed under the federal Gramm-Leach-Bliley Act or the California Financial Information Privacy Act (§ 1798.145(e)).
- Most nonprofits and public bodies, because the definition of business starts from an entity run for profit (§ 1798.140(d)(1)).
These carve-outs cover the data, not always the firm. A clinic’s patient records may sit outside the CCPA while its website analytics and marketing list sit inside it.
Put your last calendar year’s revenue, your count of California consumers and households, and your data-sale revenue into the CCPA threshold calculator. If you also sell into other states, the which-laws check runs the same test against the other state laws.
The rights it gives Californians
The statute gives each right its own section, and each one lands on the business as a duty. Requests to know, delete and correct must be verified before you act on them. An opt-out of sale or sharing, and a request to limit sensitive personal information, must not be made to wait on a verifiable request (CCPA regulations § 7026(d), § 7027).
| Right | Section | What the business does |
|---|---|---|
| Know and access | § 1798.110 | Disclose the categories and the specific pieces of personal information collected about the person, where it came from, why, and who receives it. |
| Know what is sold or shared, and to whom | § 1798.115 | Disclose the categories sold or shared and the categories of third parties that received them. |
| Delete | § 1798.105 | Delete what was collected from the person, and tell service providers and contractors to delete it too, unless an exception applies. |
| Correct | § 1798.106 | Correct inaccurate personal information, taking into account its nature and the purposes of the processing. |
| Opt out of sale or sharing | § 1798.120 | Stop selling or sharing the person's personal information when told to, at any time. |
| Limit use of sensitive personal information | § 1798.121 | Keep sensitive personal information to the uses an average consumer would expect for the goods or services asked for. |
| No retaliation | § 1798.125 | Do not deny service, charge more or lower the quality because the person used any of these rights. |
Cal. Civ. Code, CCPA as posted by the CPPA (effective 1 Jan 2026), read 22 Oct 2026 | ||
A person can use these rights themselves or through an authorised agent (regulations § 7063), and the business answers free of charge (§ 1798.130(a)(2)). What it may do is decline a request it cannot verify, or keep data that falls under an exception, such as the reasons for keeping data listed in § 1798.105(d).
Give every right a named owner and a route: which inbox or form receives it, who verifies the person, who searches the systems, who signs the reply. A request that sits in a shared inbox for a week has used a sixth of its clock.
The duties it sets
The rights tell you what people can ask for. The duties are what a covered business has to have in place before anyone asks. These 9 apply broadly; the ones a small firm meets first are at the top.
A notice at or before collection
The categories of personal information (sensitive ones included), the purposes, whether each is sold or shared, and how long each is kept or the criteria for deciding.
§ 1798.100(a); regs § 7012
A privacy policy, updated at least once every 12 months
It describes the rights and how to use them, and shows the date it was last updated.
§ 1798.130(a)(5); regs § 7011
Two or more ways to send a request
At a minimum a toll-free telephone number; a business that operates exclusively online and has a direct relationship with the consumer need only provide an email address.
§ 1798.130(a)(1)
The opt-out links, and the signal either way
A business that sells or shares posts “Do Not Sell or Share My Personal Information” on its homepage (and “Limit the Use of My Sensitive Personal Information” where that applies) and still processes opt-out preference signals. Only a business that processes the signal in a frictionless manner, and meets the other conditions in § 7025(g), may leave the links off.
§ 1798.135; regs § 7025(e), (g)
Treat an opt-out preference signal as an opt-out
A business that sells or shares must process a qualifying browser signal as a valid request for that browser or device, and show on its site whether it did.
regs § 7025
Collect only what the purpose needs
Collection, use, retention and sharing must be reasonably necessary and proportionate to the purposes the data was collected for.
§ 1798.100(c)
Contracts with whoever receives the data
Selling to, sharing with or disclosing to a third party, service provider or contractor needs an agreement that limits the purposes and binds them to the same level of protection.
§ 1798.100(d)
Reasonable security
Security procedures and practices appropriate to the nature of the personal information.
§ 1798.100(e)
Records of requests for at least 24 months
Each request and how the business responded to it.
regs § 7101
Duties that reach only some businesses
- Risk assessments before processing that presents significant risk, which includes selling or sharing personal information and processing sensitive personal information (regulations § 7150(b)). For such processing that began before 1 January 2026 and continues after it, the assessment must be conducted and documented no later than 31 December 2027 (§ 7155(b)).
- Cybersecurity audits for businesses that meet § 7120. The first audit report is due 1 April 2028 if 2026 revenue was over $100 million, 1 April 2029 if 2027 revenue was $50 million to $100 million, and 1 April 2030 if 2028 revenue was under $50 million (§ 7121(a)).
- Automated decisionmaking technology: a business using it for a significant decision before 1 January 2027 must comply with the ADMT article by 1 January 2027 (§ 7200).
Work through the CCPA compliance checklist once a year, when the privacy policy is due its 12-month update anyway, and keep the dated printout with your request records.
The clocks that run on every request
Two calendars run side by side. Requests to know, delete and correct count in calendar days with a business-day confirmation at the front. Opt-outs are due “as soon as feasibly possible”, with 15 business days as the outer limit (§ 7026(f)(1)), so a site that can stop at once should not wait.
10
Business days to confirm receipt of a request to know, delete or correct, and say how it will be processed.
regs § 7021(a)
45
Calendar days to respond, counted from the day the request is received, however long verification takes.
§ 1798.130(a)(2)(A); regs § 7021(b)
90
Calendar days at most: one extension of up to 45 more, with notice and reasons inside the first 45.
regs § 7021(b)
15
Business days at most to stop selling or sharing after an opt-out; the same for a request to limit.
regs §§ 7026(f)(1), 7027(g)(1)
The 45 days start on the day the request is received, not on the day you finish verifying the person. An extension has to be announced, with the reason, before the first 45 days run out.
Keep a record of every request and how you answered it for at least 24 months. The record is what you show the CPPA if a consumer complains that you missed a date. To work out the dates for a request in front of you, enter the day it arrived in the DSAR deadline calculator.
Who enforces it, and the fines
Two public enforcers share the law. The California Privacy Protection Agency, which its own site now also calls “CalPrivacy”, investigates and fines through administrative actions (§ 1798.199.40(a)). The Attorney General brings civil actions in court (§ 1798.199.90). Both use the same CPI-adjusted amounts, effective 1 January 2025 and read 22 Oct 2026:
$2,663
Most per violation, as a CPPA administrative fine or an Attorney General civil penalty.
§§ 1798.155(a), 1798.199.90(a)
$7,988
Most per intentional violation, or per violation involving consumers the business knows are under 16.
§§ 1798.155(a), 1798.199.90(a)
$107 to $799
Per consumer per incident, or actual damages if greater, in a private action over certain data breaches.
§ 1798.150(a)(1)(A)
Each amount is a ceiling for each violation, not for each case. The CPPA may choose to give a business time to cure, weighing a lack of intent and any fix made before it was notified, but that is the agency’s decision, not a right the business holds (§ 1798.199.45(a)).
Consumers can sue in one situation only: their unencrypted and unredacted personal information was stolen or exposed because the business failed to keep reasonable security. Before suing for statutory damages they must give the business 30 days’ written notice (§ 1798.150(b)).
“Nothing in this title shall be interpreted to serve as the basis for a private right of action under any other law.”
The fine table matters less than the pattern of what gets enforced. Our page on CCPA penalties sets out the amounts beside the published enforcement actions.
How the CPRA changed it
The California Privacy Rights Act was Proposition 24, passed by voters in November 2020. It did not replace the CCPA; it rewrote it. The amended law became operative on 1 January 2023 and, apart from the right of access, applies to personal information collected on or after 1 January 2022.
| What Proposition 24 did | Where it sits now |
|---|---|
| Created the California Privacy Protection Agency to implement and enforce the law | § 1798.199.10 |
| Added the right to correct inaccurate personal information | § 1798.106 |
| Added sensitive personal information and the right to limit its use | §§ 1798.121, 1798.140(ae) |
| Framed the opt-out as one of sale and sharing, with sharing tied to cross-context behavioural advertising | §§ 1798.120, 1798.140(ah) |
| Raised the count test from 50,000 to 100,000 and took devices out of it (consumers or households only) | § 1798.140(d)(1)(B) |
| Wrote purpose and proportionality limits into the general duties | § 1798.100(c) |
| Extended the employee and business-to-business exemptions to 1 January 2023, after which they lapsed | § 1798.145(m), (n) |
| Extended the odd-year CPI adjustment from the revenue test to the fines and the breach damages | § 1798.199.95(d) |
Proposition 24 text and the CCPA as posted by the CPPA, read 22 Oct 2026 | |
So when someone says “CCPA” today they mean the law as the CPRA amended it, plus the CPPA’s regulations. For the amendment on its own, start with what the CPRA is.
Questions
When did the CCPA take effect?
It became operative on 1 January 2020. The CPRA’s amendments became operative on 1 January 2023.
Is the CCPA the same law as the CPRA?
One law, amended. The CPRA is the 2020 ballot measure that rewrote the CCPA, so the rules in force are the CCPA as amended by the CPRA, plus the CPPA’s regulations.
Does the CCPA apply to a small business?
Headcount does not decide it; the three tests do. A firm under the revenue figure is still covered if it buys, sells or shares the personal information of 100,000 or more consumers or households a year, or derives 50 percent or more of its annual revenues from selling or sharing it.
We do not sell data. Do we still need the “Do Not Sell or Share” link?
Only a business that sells or shares needs it. Posting the link does not excuse it from honouring opt-out preference signals; only a business that processes the signal in a frictionless manner and meets the conditions in regulations § 7025(g) may leave the link off. Check your advertising tags before you decide you do neither: passing visitor data to an ad platform for cross-context behavioural advertising is sharing.
Does it cover data about our employees?
Yes, for staff and applicants who live in California. The exemption for employee data and the one for business-to-business contacts both became inoperative on 1 January 2023.
How does it compare with the GDPR and the other state laws?
The GDPR needs a legal basis before processing; the CCPA lets processing run and gives people the right to stop the sale or sharing. Our GDPR vs CCPA page sets the two side by side, and the US state privacy laws table lists the other states with comprehensive laws, each with its own thresholds.