CCPA compliance software
For a firm without a privacy team that must meet California’s CCPA, as amended by the CPRA, and the state laws that followed it. 6 tools, measured against the duties the statute and the CPPA’s regulations set, from each vendor’s own pages. read 2026-10-22
Best overall
Osano
Its own pages cover every row, down to a CCPA service-provider addendum template; only consent is self-service, so get in writing which plan carries each module.
Best for a small site starting free
Enzuzo
A privacy policy, a request form with due-date reminders and a Do Not Sell page on the free plan; GPC needs a paid one.
Best for data spread across many systems
DataGrail
Maps each CCPA duty to its code section and runs requests into connected systems; its own pages say it is built for enterprise stacks.
The CCPA duties, tool by tool
Each row is a duty from the statute or the regulations, with the section it comes from. Read across for one duty; read down for one tool. Only need the opt-out links and a banner? Our consent management platforms page compares those on their own.
| Requirement | Osano | DataGrail | Ketch | TrustArc | Termly | Enzuzo |
|---|---|---|---|---|---|---|
| Gives you the notice at collection, or a policy section to link to§ 1798.100(a); regs § 7012(f) | paid planprivacy policy template | partialdata map feeds it | yesnotice and policy templates | not statednotices on its request forms | yespolicy generator | yespolicy generator |
| Takes requests through a form on your website§ 1798.130(a)(1)(B) | paid planfrom Basic Privacy | yes | paid planrequest module sold separately | yes | yesevery plan | yeson the free plan |
| Tracks the 45-day response deadline§ 1798.130(a)(2); regs § 7021(b) | paid plansubject rights module | yes | not statedstatus queue per request | yesdue dates by jurisdiction | not stated | yesdue-date reminders |
| Verifies who is asking before it releases or deletes dataregs §§ 7060–7062 | paid planmulti-factor | yes | paid planrequest module | yes | not stated | yes |
| Honors Global Privacy Control as an opt-out§ 1798.135(b)(1); regs § 7025 | yes | yes | yes | yes | yesper its release notes | paid plan |
| Runs the “Do Not Sell or Share” link and opt-out§ 1798.135(a)(1); regs § 7026 | yes | yes | yes | yes | yes | yesopt-out page |
| Handles “Limit the Use of My Sensitive Personal Information”§ 1798.135(a)(2); regs § 7027 | yes | yes | not stated | not stated | yesthe link | not stated |
| Keeps service-provider contracts in order§ 1798.100(d); regs § 7051 | paid planCCPA addendum template | yesvendor inventory | paid planrisk module | yesvendor risk assessments | not stated | not stated |
| Logs each request and how you answered itregs § 7101(a) | paid planaudit trail, CSV export | yesone dashboard | yestimestamped audit logs | yesactivity history | not statedconsent logs only | paid planrequest reporting |
| Runs privacy risk assessmentsregs § 7150 (from 2026) | paid planassessment templates | yes | paid plansold separately | yes | not stated | not stated |
| Covers the other state privacy laws toobeyond California | yesCPA, CTDPA and more | not statedstates not named | yes | yescontrols by state | yesin its policies | not statedstates not named |
Source: vendor documentation, read 2026-10-22. “not stated” means the vendor’s own documentation does not say. | ||||||
The clocks a request starts
Most of what CCPA software sells is a way to beat these clocks. A tool that tracks only the 45-day answer misses two of them: the acknowledgement and the opt-out run on business days. Put a real request date through the DSAR deadline calculator to see each date fall out.
10 business days
Confirm you got it
Acknowledge a request to know, delete or correct, and say how you will verify and when to expect an answer.
regs § 7021(a)
15 business days
Stop selling or sharing
The latest point to cease after an opt-out arrives. You may not demand a verified request first.
regs § 7026(d), (f)(1)
45 calendar days
Answer the request
Counted from the day it arrives, whatever the verification takes.
§ 1798.130(a)(2); regs § 7021(b)
90 calendar days
The outside limit
One extension of up to 45 more days, only if you tell the consumer why inside the first 45.
§ 1798.130(a)(2); regs § 7021(b)
24 months
Keep the record
Date, type and channel of the request, date and nature of your answer, and why you denied it if you did.
regs § 7101(a), (b)
“The 45-day period will begin on the day that the business receives the request, regardless of time required to verify the request.”
That sentence is the one to test a tool against. Ask the vendor to show a request that sat waiting for identity proof: the due date should not have moved. The statute itself says the same in § 1798.130(a)(2), and our DSAR tools compared page goes deeper on verification and redaction.
The three documents the law expects you to hold
Request handling is the visible half. The other half is paper: what you tell people when you collect their data, what your vendors sign, and, since January 2026, a written risk assessment for the riskier uses. These are the rows where the tools in the table differ most.
The notice at collection
You must tell people, at or before the point of collection, which categories of personal information you collect, why, and whether you sell or share it (§ 1798.100(a)). Online, a link to your privacy policy can do the job, but only a link that lands on the right section. Under § 7012(f) of the regulations, a link to the top of the policy, where the reader has to scroll to find the categories, does not count. So a policy generator meets the row only if its output has a section you can link to directly. Our notice at collection template builds that section on its own.
Contracts with your service providers
Every vendor that handles personal information for you needs a written agreement that limits it to the purposes you name, binds it to the law and lets you check its use (§ 1798.100(d)). The regulations add a detail most templates leave for you to fill in:
“The business purpose(s) shall not be described in generic terms, such as referencing the entire contract generally. The description shall be specific.”
A vendor inventory or an addendum template saves drafting time, but the purpose clause is yours to write for each vendor. Our processing agreement template keeps that clause in front of you.
Risk assessments, new in 2026
The regulations in force since January 1, 2026 require a risk assessment before any processing that presents a significant risk (§ 7150(a)). The first item on the list is “Selling or sharing personal information” (§ 7150(b)(1)), and “sharing” means passing data to a third party for cross-context behavioral advertising (§ 1798.140(ah)(1)). A site running ad pixels should read that list before assuming it is out of scope.
Processing that began before January 1, 2026 and continues needs its assessment by December 31, 2027 (§ 7155(b)). For assessments done in 2026 and 2027, the summary goes to the Agency by April 1, 2028 (§ 7157(a)(1)). Source: the CCPA regulations, read 2026-10-22.
Of the 6 tools, 4 offer assessments, but none of the pages we read says its template follows the contents § 7152 lists. Ask to see the questions before you buy, or start from our privacy impact assessment template.
Each tool in short
What each one is, who it fits, how it meets the rows, and what to confirm with the vendor. Weighing an enterprise suite instead? Our OneTrust alternatives page covers the lighter platforms on the same terms.
Osano
What it is
A privacy platform sold as modules: cookie consent, subject rights requests, assessments, data mapping and vendor risk.
Who it fits
A firm that wants the banner, the request queue and the vendor files with one vendor, and may add modules later.
What the rule requires and whether it meets it
Requests come in by web form, email, banner or API, pass a multi-factor identity check and get a deadline worked out for them. It honors GPC, handles both California opt-out links, and its template library includes a privacy policy and a “CCPA/CPRA Service Provider Addendum”. Its banner applies state-specific opt-out wording for Colorado and Connecticut as well as California.
Check with the vendor
Its self-service plans are consent plans: request intake starts at Basic Privacy and the other modules are quoted. Its pages do not say how long request records are kept; ask in writing, since the regulations want 24 months of them.
DataGrail
What it is
A privacy platform built around a request manager, a live map of the systems that hold personal data, consent, and risk assessments.
Who it fits
A firm whose customer data sits in many SaaS tools and databases. Its own FAQ says it is designed for enterprise environments.
What the rule requires and whether it meets it
Its CCPA page maps each duty to the code section it comes from and to the module that handles it. It tracks the 45-day deadline, verifies requesters, honors GPC, applies limits on sensitive data, and keeps an inventory of vendors and the processing they do for you.
Check with the vendor
The data map supports your disclosures, but the pages we read do not describe writing the notice itself. They name “GDPR, CPRA, etc” but no other US state. Ask which state laws its policies cover today.
Ketch
What it is
A consent platform with a free plan. Request automation, data mapping and risk assessments are separate products, sold on top.
Who it fits
A firm that wants to start with the banner and notices, and add request handling once the volume justifies it.
What the rule requires and whether it meets it
Notice and policy templates come with the consent product, and it processes GPC automatically. A “Do Not Sell or Share” choice made in the banner or the request form carries over to the other. The request product adds verification matched to the request type and timestamped audit logs; the risk product checks vendor contracts.
Check with the vendor
Its request page shows a status queue but does not describe deadline tracking, and its pages do not mention the “Limit the Use” right. Confirm both, and which products your quote includes.
TrustArc
What it is
A privacy suite: a rights-request manager, a cookie consent manager, an assessment manager and a law-by-law controls library.
Who it fits
A firm with a compliance owner who tracks several US state laws, and other countries’, as one program.
What the rule requires and whether it meets it
The request manager offers branded intake forms, email verification and identity checks, due dates set by jurisdiction and an activity history for each request. The consent manager supports GPC and Do Not Sell or Share. Assessment templates include vendor risk.
Check with the vendor
The product pages we read do not cover writing the notice at collection or the “Limit the Use” link. Ask how those are handled.
Termly
What it is
Policy generators and a consent banner under one account, with a request form you embed on your site.
Who it fits
A small site that needs the policy, both California opt-out links and a way to receive requests, and will answer them by hand.
What the rule requires and whether it meets it
Its policies cover the CCPA and, by its pricing page, 16 other state privacy laws. It publishes the “Do Not Sell or Share” and “Limit the Use” links and an embeddable request form.
Check with the vendor
Its release notes add a notice confirming an honored GPC signal but name no plan, so confirm it runs on yours. The pages we read do not mention deadline tracking or identity checks, and its logs are consent logs, not request logs. Keep your own request log if you use it.
Enzuzo
What it is
A policy generator, cookie banner and request tool, with a free plan for one domain.
Who it fits
A single site or small online store that wants a request form with deadline reminders before it pays for anything.
What the rule requires and whether it meets it
The free plan lists the banner, all its legal policies and request handling. Its request tool walks each request through an identity check and due-date reminders, and it builds a “Do Not Sell” page. GPC and request reporting start on the Growth plan.
Check with the vendor
Its pricing page gives two limits for requests on the free plan: unlimited in the plan table, three a month in its FAQ. It names no US state beyond California, and we found no vendor-contract or assessment tools. Ask before you rely on it for more than California.
What stays on your desk whichever tool you pick
A row marked “yes” means the tool helps with the duty. It does not carry the duty for you. This is the split we see when reading the vendors’ pages against the law. Work through it with our CCPA compliance checklist, listed under Related, once a tool is in place.
| Duty | What a tool can do | What stays with you |
|---|---|---|
| Whether you sell or share at all | Lists the trackers and pixels your site loads | Deciding which of them pass data to a third party for cross-context advertising (§ 1798.140(ah)(1)) |
| The notice at collection | Drafts a policy from your answers | Making the categories and purposes match what you actually collect (§ 1798.100(a)) |
| Opt-out signals | Detects GPC and switches off the scripts that sell or share | Testing it in a real browser, and processing the signal even where you also post the links (regs § 7025(e)) |
| Answering a request | Starts the clock, checks identity, routes the work | Finding the data in systems the tool is not connected to, and deciding the exceptions to deletion |
The quickest check on the third row is your own browser: turn on Global Privacy Control in a browser that offers it, load your site and watch what the banner does with the signal.
How we compared them
We picked tools a US firm of a few dozen people is likely to shortlist for the CCPA: two policy-and-banner tools with free plans, three privacy platforms that sell consent and request handling, and one broader privacy suite. Each sells CCPA coverage on its own site. None of their pages says how long request records are kept; § 7101 of the regulations asks for 24 months, so ask.
Each row is a requirement the rule itself sets, with the article or section cited beside it. Every cell comes from the vendor’s own public documentation, read on 2026-10-22; we did not run trials, take demos or accept vendor answers that are not published.
“not stated” means the vendor’s documentation does not say either way. It is not a “no”: ask the vendor and get the answer in writing. “paid plan” means the feature exists but not on the free or entry tier. There are no scores, ratings or prices on this page.
Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.
This page is information, not legal advice. A tool that meets a row does not make a site compliant; how it is set up does.
Questions
Does the 45-day clock wait while we verify the person asking?
No. Under § 7021(b) of the regulations the 45 days start the day the request arrives, whatever the verification takes. If you cannot verify the person within that time you may deny the request, and you can extend once by up to 45 days if you tell the consumer why inside the first 45.
If we honor Global Privacy Control, can we drop the “Do Not Sell or Share” link?
Only on conditions. § 7025(g) lets a business skip the link if it processes the signal in a “frictionless” way and says so in its privacy policy. The reverse never works: § 7025(e) says a business that posts the links must still process opt-out signals. Our guide to the “Do Not Sell or Share” link walks through both routes.
Do we need to verify identity for an opt-out?
No. § 7026(d) says a business shall not require a verifiable consumer request to opt out of sale or sharing. You may ask only for what you need to carry the request out. A tool that puts an opt-out through the same identity check as an access request is set up wrong.
Is CCPA software enough to comply?
No tool makes a firm compliant on its own. The law applies to what you collect, what your vendors do with it and how you answer people. Whether the CCPA reaches you at all depends on the thresholds, which our CCPA threshold calculator (under Related) tests. This page is information, not legal advice.
Which other state laws should the tool cover?
Every state where your customers live and whose thresholds you meet. Each has its own rights, deadlines and opt-out rules; our list of US state privacy laws sets them side by side, so you can ask a vendor about each by name.