CCPA compliance checklist
Every duty the CCPA, as amended by the CPRA, and its regulations put on a business: notices, links and signals, requests, contracts, training and records, and the assessments due in 2027 and 2028. Answer what the business does, then give each duty a status, an owner and a date. You get a staged plan and one list per person, ready to print. It runs in your browser and sends nothing.
Build your CCPA program
Pre-filled with a realistic example: a 40-person online outdoor-gear shop with an ad pixel on every page, half-way through its program. Change what the business does, then give each duty a status, an owner and a date. Reset clears it for your own.
01What the business does
Each answer adds or removes duties. The plan assumes the CCPA reaches the business; the threshold calculator below the tool runs that test.
Reached if last year 50 percent or more of revenue came from selling or sharing; or revenue was over the CCPA threshold and you processed the data of 250,000 or more consumers or households, or the sensitive data of 50,000 or more.
Duties in place
5 of 19
14 still open: 0 past their date and 1 with no owner.
Stage 1, first 1 Oct 2026
What a visitor can test
2 of 6 in place
Links, signals, choice screens and request intake: anyone can check these from outside in a minute.
Stage 2
The documents
1 of 6 in place
Notice at collection, privacy policy and the contracts behind the data flows.
Stage 3
The back office
2 of 5 in place
Training, request records and security: what makes the first two stages hold.
Stage 4
Dates the rules set
0 of 2 in place
Risk assessments, ADMT, audits and metrics run to the regulations' own calendar.
02Set each duty
Mark where it stands, who owns it and when it should be done. Rule-set dates cannot be moved.
Notices
Notice at collection, at or before the point of collection
Categories collected (sensitive ones included), purposes, whether each is sold or shared, how long each is kept, and links to the opt-out notice and the privacy policy.
§ 1798.100(a); regs § 7012(e)
in progress; Web and marketing
Privacy policy with rights, request methods and a last-updated date
Update its information at least once every 12 months and show the date it was last updated.
§ 1798.130(a)(5); regs § 7011
in place; Privacy lead
Links and signals
“Do Not Sell or Share My Personal Information” link on the homepage
Or one Alternative Opt-out Link titled “Your Privacy Choices” or “Your California Privacy Choices”, with the opt-out icon beside it.
§ 1798.135(a)(1); regs § 7015(b)
in place; Web and marketing
Treat an opt-out preference signal such as GPC as a valid opt-out
Posting the links does not remove this: under § 7025(e) the signal must still be processed. Show on the site whether it was honoured, e.g. “Opt-Out Request Honored”.
regs § 7025(b), (c)(6), (e)
in progress; target 1 Oct 2026; Engineering
Two or more opt-out methods, the signal among them
A cookie banner or cookie controls alone is not an acceptable way to opt out of sale or sharing.
regs § 7026(a), (a)(4)
not started; Web and marketing
Symmetrical choices on every consent and request screen
No more steps to say no than yes; “Accept All” beside “Decline All”, not beside “More Information”; no louder yes button. Closing a pop-up is not consent.
regs § 7004(a)(2)–(3)
not started; Web and marketing
Requests
Request methods for know, delete and correct
Online only with a direct relationship: an email address is enough, plus the website.
§ 1798.130(a)(1)
in place; Customer support
Confirm receipt within 10 business days
Say how the request will be processed. Business days are not defined in the texts; set the calendar you count by.
regs § 7021(a)
in place; Customer support
Answer within 45 calendar days of receipt
Up to 45 more with notice and reasons inside the first 45, 90 calendar days at most, counted from the day received whatever verification takes.
regs § 7021(b); § 1798.130(a)(2)(A)
in progress; Customer support
Opt-outs: no verification, no account, done within 15 business days
Stop selling and sharing as soon as feasibly possible, and notify the third parties you sold or shared with in between, telling them to comply and pass it on.
regs § 7026(c), (d), (f)
in progress; Engineering
Wait 12 months before asking an opted-out consumer to opt back in
And never read a missing signal, after one was sent, as consent to opt back in.
regs §§ 7026(k), 7025(c)(5)
not started; Web and marketing
A path for authorized agents
You may ask for the consumer's signed permission, but not that they resubmit the request themselves, and never for a power of attorney.
regs § 7063
not started; Customer support
Contracts and security
Service provider and contractor contracts with the required terms
No selling or sharing; specific business purposes, not the contract in general; no use outside the relationship; notice if they can no longer comply; your right to check and to stop misuse; help with consumer requests.
§ 1798.140(ag)(1); regs § 7051(a)
in progress; Vendor manager
Agreements with every third party you sell or share with
Ad-tech partners included: a limited, specified purpose and the duty to honour forwarded opt-outs. Missing terms were part of the CPPA's Honda case.
§ 1798.100(d); regs § 7053(a)
not started; Vendor manager
Reasonable security for the personal information you collect
Procedures and practices that fit the nature of the data, in line with § 1798.81.5.
§ 1798.100(e)
in place; Security
Training and records
Brief everyone who answers privacy questions
They must know the CCPA's requirements and how to direct a consumer to exercise each right.
regs § 7100(a)
not started; no owner yet
Keep request records for at least 24 months
A ticket or log will do if it holds the request date, nature and manner, the response date and nature, and the basis of any denial.
regs § 7101
not started; Customer support
Assessments and audits
Risk assessment for processing begun before 2026 and still running
Selling or sharing, sensitive data and ADMT for significant decisions are among the triggers. Review at least once every three years, and within 45 calendar days of a material change.
regs §§ 7150(b), 7155(b)
by the rule's date
not started; Privacy lead
Submit the 2026 and 2027 risk assessment information to the Agency
Keep each assessment for as long as the processing continues or five years after completion, whichever is later (§ 7155(c)).
regs § 7157
by the rule's date
not started; Leadership
03The plan, owner by owner
What each person still has to do, earliest date first. Print or copy it for the kick-off.
Privacy lead1 open
- no dateRisk assessment for processing begun before 2026 and still running (not started; regs §§ 7150(b), 7155(b))
Web and marketing4 open
- no dateNotice at collection, at or before the point of collection (in progress; § 1798.100(a); regs § 7012(e))
- no dateTwo or more opt-out methods, the signal among them (not started; regs § 7026(a), (a)(4))
- no dateSymmetrical choices on every consent and request screen (not started; regs § 7004(a)(2)–(3))
- no dateWait 12 months before asking an opted-out consumer to opt back in (not started; regs §§ 7026(k), 7025(c)(5))
Engineering2 open
- 1 Oct 2026Treat an opt-out preference signal such as GPC as a valid opt-out (in progress; regs § 7025(b), (c)(6), (e))
- no dateOpt-outs: no verification, no account, done within 15 business days (in progress; regs § 7026(c), (d), (f))
Customer support3 open
- no dateAnswer within 45 calendar days of receipt (in progress; regs § 7021(b); § 1798.130(a)(2)(A))
- no dateA path for authorized agents (not started; regs § 7063)
- no dateKeep request records for at least 24 months (not started; regs § 7101)
Vendor manager2 open
- no dateService provider and contractor contracts with the required terms (in progress; § 1798.140(ag)(1); regs § 7051(a))
- no dateAgreements with every third party you sell or share with (not started; § 1798.100(d); regs § 7053(a))
Leadership1 open
- no dateSubmit the 2026 and 2027 risk assessment information to the Agency (not started; regs § 7157)
No owner yet1 open
- no dateBrief everyone who answers privacy questions (not started; regs § 7100(a))
The clocks your program keeps
- Confirm a request
- 10 business days§ 7021(a)
- Answer know, delete, correct
- 45 calendar days, up to 45 more, 90 in all§ 7021(b)
- Act on an opt-out or limit
- 15 business days§§ 7026(f)(1), 7027(g)(1)
- Ask to opt back in
- wait at least 12 months§ 7026(k)
- Privacy policy update
- at least once every 12 months§ 1798.130(a)(5)
- Request records
- at least 24 months§ 7101(a)
- Risk assessments
- by 31 Dec 2027, submitted by 1 Apr 2028, reviewed every three years§§ 7155, 7157
- ADMT for significant decisions
- 1 Jan 2027§ 7200
- Revenue threshold
- $26,625,000 since 1 Jan 2025; next CPI change 1 Jan 2027
Statute and regulations read 22 Oct 2026.
What it works out
A CCPA checklist that only asks “done or not?” leaves the hard part out: who does the rest, and by when. This builder takes the 25 duties the statute and its regulations put on a business, keeps the ones your answers trigger, and turns them into a plan in 4 stages, each duty with a status, an owner and a date. The result is two things you can hand round: a count of what is in place, and one list per person, earliest date first.
It plans the duties; it does not test whether the law reaches you. Run the three tests in the CCPA threshold calculator first. The 2020 amendments that added sharing, sensitive data, risk assessments and the agency are explained in what the CPRA changed.
It runs in your browser. Nothing you type is sent to us or stored, and closing the tab clears it. It cannot see your site or your contracts, so a duty is only as “in place” as you mark it. Information, not legal advice.
How to use this checklist
- Answer the questions in part 1 honestly. An ad pixel or retargeting tag usually means you share; leaving that unticked hides most of the opt-out duties.
- Set the plan start to the day the work begins. Stage targets fall 30, 60 and 90 days later; dates the rules set stay where they are.
- Go duty by duty in part 2: mark it, give it one owner (a team, not “everyone”), and move its date if the stage default does not fit.
- Read part 3 back in the kick-off meeting. Each person sees only their own list, so nobody waits for the whole program.
- Print or copy the plan and keep it with your records. Re-run it at the yearly policy review; that is the natural moment to check the rest.
Worked example: the outdoor-gear shop
The tool opens on a 40-person online shop selling to about 180,000 Californians a year, which passes the CCPA’s test of 100,000 or more consumers or households. Its ad pixel counts as sharing, so the opt-out duties and the risk assessment come in. Of its 19 duties, 5 are in place. The other 14 split like this:
| Owner | Open | Open duties, by stage |
|---|---|---|
| Privacy lead | 1 | Risk assessment for processing begun before 2026 and still running (stage 4) |
| Web and marketing | 4 | Two or more opt-out methods, the signal among them (stage 1); Symmetrical choices on every consent and request screen (stage 1); Notice at collection, at or before the point of collection (stage 2); Wait 12 months before asking an opted-out consumer to opt back in (stage 2) |
| Engineering | 2 | Treat an opt-out preference signal such as GPC as a valid opt-out (stage 1); Opt-outs: no verification, no account, done within 15 business days (stage 1) |
| Customer support | 3 | A path for authorized agents (stage 2); Answer within 45 calendar days of receipt (stage 3); Keep request records for at least 24 months (stage 3) |
| Vendor manager | 2 | Service provider and contractor contracts with the required terms (stage 2); Agreements with every third party you sell or share with (stage 2) |
| Leadership | 1 | Submit the 2026 and 2027 risk assessment information to the Agency (stage 4) |
| No owner yet | 1 | Brief everyone who answers privacy questions (stage 3) |
Example answers as pre-filled. Rule texts read 22 Oct 2026. Information, not legal advice. | ||
Two lines tell the story. The shop posted its “Do Not Sell or Share” link early and let the GPC work slip, on the belief that the link was enough. It is not: § 7025(e) says a business that posts the links must still process opt-out preference signals. Our Global Privacy Control checker shows what a browser sends, and the guide to the Do Not Sell or Share link covers the link itself. The second line is the training duty with no owner: it belongs to nobody until someone is named, so the owner sheet files it under its own heading.
Why the plan starts with what a visitor can see
The links, the signal handling, the choice screens and the request forms are the parts of a program anyone can test from outside, without a subpoena or a login. The CPPA Board’s decision against American Honda Motor Co., announced on 12 March 2025, turned on exactly these: too much verification and personal information demanded for opt-outs, a privacy tool that did not offer choices symmetrically, obstacles for authorized agents, and ad-tech partners sharing data without contracts carrying the required terms. It ended with a $632,500 fine and an order to change practices.
So stage 1 is what an outsider can click. Stage 2 is the paper behind it: the notice at collection (our notice at collection template drafts one), the privacy policy (check it line by line with the privacy policy checklist) and the contracts, where the data processing agreement template carries the service-provider terms. Stage 3 is the back office that keeps the first two honest: people who know the rules, request logs kept for at least 24 months, reasonable security. The fourth stage is not yours to schedule; the regulations set those dates.
Jurisdiction notes
California
The duties here come from the CCPA as amended by the CPRA, operative since 1 January 2023, and from the regulations in effect from 1 January 2026, both read on the California Privacy Protection Agency’s site. Neither text defines a “business day”, so write down which calendar your team counts by; the DSAR deadline calculator turns a request’s arrival date into each of its California dates.
The assessments due in 2027 and 2028
A risk assessment must name its purpose specifically; “to improve our services” or “security purposes” will not do. Keep each one for as long as the processing continues or five years after completion, whichever is later. The privacy impact assessment template is a starting structure.
Colorado, Oregon, New Jersey and the other states
The signal duty does not stop at California. Colorado recognises GPC as its only universal opt-out mechanism, Oregon’s privacy act names it as an example of a signal businesses must honour from 1 January 2026, and New Jersey names it among the mechanisms controllers must honour from 15 July 2025. The other state laws ask for an opt-out preference signal in general terms. Their notices, clocks and thresholds differ; the US state privacy laws table sets them side by side.
Questions
Is this a CCPA checklist or a project plan?
Both. Every line is a duty from the statute or the regulations with its section cited; the status, owner and date turn the list into a plan. If you only want the yes-or-no view, read the status words and ignore the rest.
We are under the revenue threshold. Do we still need this?
Possibly. Revenue is only one of three tests: buying, selling or sharing the data of 100,000 or more consumers or households is another, and an ad pixel is how a small shop often meets it. The revenue figure is $26,625,000 since 1 January 2025 and moves with inflation every odd-numbered year.
Why can't I move the risk assessment date?
Because the regulation sets it. Processing begun before 1 January 2026 and still running needs its assessment done and documented by 31 December 2027, and the information on the 2026 and 2027 assessments goes to the Agency by 1 April 2028. You can start earlier; the plan shows the latest day.
What does missing a duty cost?
The CPPA can fine up to $2,663 per violation, or $7,988 per intentional violation or one involving consumers the business knows are under 16. The Attorney General’s civil penalties use the same amounts.
Does the tool keep my plan?
No. It runs in your browser and sends nothing anywhere; closing the tab clears it. Copy or print the plan before you leave, and paste it into the tracker your team already uses.