Página traducida y verificada automáticamente. Prevalece la versión en inglés. Algunas partes siguen en inglés mientras se verifica su traducción. Ver en inglés · Informar un error de traducción
CCPA/CPRA
Ley de Privacidad del Consumidor de California, modificada por la Ley de Derechos de Privacidad de California
La ley estatal de privacidad de EE. UU. más detallada y la única con un regulador de privacidad específico. Abarca los datos de empleados y los datos entre empresas, exige mecanismos de exclusión voluntaria de la venta y el intercambio, y tiene sus propias regulaciones sobre la toma de decisiones automatizada.
The law in brief
The CCPA, as amended by the CPRA, is California's comprehensive privacy law and the most developed in the United States. It gives California residents rights over their personal information, including employees and business contacts, and puts duties on the businesses that collect it.
It is enforced by a dedicated regulator, the California Privacy Protection Agency, alongside the Attorney General, and its detailed regulations matter as much as the statute.
A quién se aplica
- For-profit businesses that do business in California and meet one of three tests: annual gross revenue above a threshold adjusted for inflation (originally $25 million), buying, selling or sharing the personal information of 100,000 or more California consumers or households, or earning half or more of annual revenue from selling or sharing personal information (Civil Code 1798.140(d)).
- Service providers and contractors that process personal information for such a business, under contract.
- All California residents count as consumers, including employees, job applicants and business contacts.
What it requires
Notice at collection
At or before collection, tell consumers what categories of personal information you collect, why, whether you sell or share it, and how long you keep it.
Purpose limitation and minimization
Collect, use and keep personal information only as reasonably necessary and proportionate to the disclosed purposes.
Opt-out of sale and sharing
Stop selling or sharing a consumer's personal information when they opt out, including through a recognized opt-out preference signal, and do not ask again for at least 12 months.
Contracts with every recipient
Bind service providers, contractors and third parties by contract to specific purposes and to CCPA-level protection.
Reasonable security
Implement reasonable security procedures and practices appropriate to the nature of the personal information.
Derechos de las personas
California residents can:
- know what personal information is collected, used, shared or sold, and get a copy (1798.100, 1798.110);
- delete it, with exceptions (1798.105);
- correct inaccurate information (1798.106);
- opt out of the sale or sharing of their information, including through an opt-out preference signal such as Global Privacy Control (1798.120, 1798.135);
- limit the use of sensitive personal information (1798.121);
- not be retaliated against for using these rights (1798.125).
Businesses must respond to requests within 45 days, extendable once by another 45 days with notice.
Enforcement and penalties
Multas administrativas por infracción, más altas en caso de infracciones intencionales y de infracciones que afecten a menores de 16 años, con importes ajustados a la inflación; la aplican la Agencia de Protección de la Privacidad de California y el Fiscal General (1798.155, 1798.199.90). Los consumidores solo pueden demandar directamente por ciertas violaciones de datos causadas por no mantener una seguridad razonable, para obtener daños legales por consumidor y por incidente o daños reales (1798.150).
What's changing
Adopted rules with phased dates. Regulations on cybersecurity audits, risk assessments and automated decision-making technology took effect on January 1, 2026, with compliance dates phased over the following years. Check the regulations for the dates that apply to your business; Regulatory Watch reports new rules and enforcement.
What to do first
- Confirm the thresholds and whether you sell or share personal information, including through advertising cookies and pixels.
- Map personal and sensitive personal information, including employee and business-contact data.
- Update your notice at collection and privacy policy, and review it at least every 12 months.
- Honor opt-out preference signals and add "Do Not Sell or Share" and "Limit" links where required.
- Put CCPA terms in contracts with service providers, contractors and third parties.
- Build a request process that verifies identity and answers within 45 days.
- Check the 2026 regulations for risk assessments, audits and automated decision-making.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Novedades recientes
-
CPPA proposes amendments to CCPA opt‑out preference signal regulations to recognize GPC and expand reporting
The changes would tighten how businesses must honor GPC‑based opt‑out requests, impacting data‑sharing and advertising practices. The California Privacy Protection Agency staff released a package of proposed amendments to the CCPA regulations on opt‑out preference signals (OOPS). The proposal would explicitly recognize the Global Privacy Control (GPC) as a valid opt‑out signal, add new examples for handling OOPS, and broaden annual metrics‑reporting obligations. The agency plans to open a 45‑day public comment period before formal rulemaking.
Source: Covington Inside Privacy. CCPA/CPRA in the regulations library.
-
CalPrivacy Board to hold public meeting on privacy rights and regulatory proposals Nov 5-6, 2026
The meeting signals upcoming regulatory activity that could affect how companies handle privacy notices, disclosures, and opt‑out mechanisms in California. The California Privacy Protection Agency Board will meet on November 5‑6, 2026 to discuss consumer privacy rights, legislative updates, and possible regulatory amendments such as opt‑out preference signals. The meeting will be open to the public in person and via remote access.
Source: Hunton Privacy & Cybersecurity Law Blog. CCPA/CPRA in the regulations library.
-
California Governor signs four privacy bills expanding deletion rights, privacy settings, data‑broker rules and limiting CIPA lawsuits
The new statutes significantly strengthen consumer deletion rights, tighten data‑broker obligations, protect user‑controlled privacy settings, and curtail a class of privacy‑related lawsuits. Governor Gavin Newsom signed SB 923, AB 2561, AB 883 and SB 690 into law during the 2026 session. SB 923 broadens CCPA deletion rights and requires online request mechanisms; AB 2561 bars operating systems and apps from changing privacy settings without consent; AB 883 shortens data‑broker deletion request processing to 30 days and promotes DROP awareness; SB 690 removes the private right of action for certain pen‑register and trap‑and‑trace claims under CIPA.
Effective: not stated.
Source: Covington Inside Privacy. CCPA/CPRA in the regulations library.
-
U.S. AI AGENT Act and California SB 1106 propose definitions and rules for AI agents
The bills signal the first U.S. attempts to regulate AI agents, affecting privacy, data access, and consumer protection. Two legislative proposals introduced in the United States this summer – the federal AI AGENT Act and California Senate Bill 1106 – aim to define “agentic AI” and impose obligations on consumer‑facing agents, with differing scopes and technical criteria.
SB 1106.
Source: Future of Privacy Forum. CCPA/CPRA in the regulations library.
-
California Privacy Protection Agency adopts multiple regulations including Conflict of Interest Code Amendments and Data Broker Registration Fee
Adopted CPPA regulations expand enforcement tools for the CCPA and Delete Act, affecting data brokers and other entities. The CPPA has adopted several regulations, such as the Conflict of Interest Code Amendments Regulation (September 2026) and Data Broker Registration Fee Regulation (December 2025). These were adopted through the Administrative Procedures Act rulemaking process and are now part of the agency’s regulatory framework.
Effective: not stated.
Source: CPPA rulemaking page (change monitor). CCPA/CPRA in the regulations library.
Fuentes
- Ley de Privacidad del Consumidor de California (Código Civil 1798.100 a 1798.199.100) California Legislative Information · Texto oficial o regulador
- Todas las leyes integrales de privacidad que entran en vigor en 2026 MultiState · Despacho de abogados o analista
- Comparación de leyes estatales de privacidad de EE. UU. (24 leyes promulgadas, fechas de entrada en vigor) Recording Law · Despacho de abogados o analista
Biblioteca de regulaciones
Todas las leyes estatales de privacidad de EE. UU., en un mapa
24 estados tienen una ley integral de privacidad en la biblioteca, junto con las leyes de la UE, del Reino Unido, federales de EE. UU. y globales: 102 en total, cada una explicada en palabras sencillas con sus fuentes. Seleccione un estado para ver qué se aplica allí.
- En vigor
- Entrada en vigor
- Leyes sectoriales