Página traduzida e verificada automaticamente. Prevalece a versão em inglês. Algumas partes ainda estão em inglês enquanto a tradução é verificada. Ver em inglês · Informar um erro de tradução
CCPA/CPRA
California Consumer Privacy Act, alterada pela California Privacy Rights Act
A lei estadual de privacidade mais detalhada dos EUA e a única com um regulador de privacidade dedicado. Abrange dados de funcionários e de relações entre empresas, exige opt-out de venda e compartilhamento e tem regulamentos próprios sobre tomada de decisão automatizada.
The law in brief
The CCPA, as amended by the CPRA, is California's comprehensive privacy law and the most developed in the United States. It gives California residents rights over their personal information, including employees and business contacts, and puts duties on the businesses that collect it.
It is enforced by a dedicated regulator, the California Privacy Protection Agency, alongside the Attorney General, and its detailed regulations matter as much as the statute.
A quem se aplica
- For-profit businesses that do business in California and meet one of three tests: annual gross revenue above a threshold adjusted for inflation (originally $25 million), buying, selling or sharing the personal information of 100,000 or more California consumers or households, or earning half or more of annual revenue from selling or sharing personal information (Civil Code 1798.140(d)).
- Service providers and contractors that process personal information for such a business, under contract.
- All California residents count as consumers, including employees, job applicants and business contacts.
What it requires
Notice at collection
At or before collection, tell consumers what categories of personal information you collect, why, whether you sell or share it, and how long you keep it.
Purpose limitation and minimization
Collect, use and keep personal information only as reasonably necessary and proportionate to the disclosed purposes.
Opt-out of sale and sharing
Stop selling or sharing a consumer's personal information when they opt out, including through a recognized opt-out preference signal, and do not ask again for at least 12 months.
Contracts with every recipient
Bind service providers, contractors and third parties by contract to specific purposes and to CCPA-level protection.
Reasonable security
Implement reasonable security procedures and practices appropriate to the nature of the personal information.
Direitos das pessoas
California residents can:
- know what personal information is collected, used, shared or sold, and get a copy (1798.100, 1798.110);
- delete it, with exceptions (1798.105);
- correct inaccurate information (1798.106);
- opt out of the sale or sharing of their information, including through an opt-out preference signal such as Global Privacy Control (1798.120, 1798.135);
- limit the use of sensitive personal information (1798.121);
- not be retaliated against for using these rights (1798.125).
Businesses must respond to requests within 45 days, extendable once by another 45 days with notice.
Enforcement and penalties
Multas administrativas por violação, maiores para violações intencionais e para violações envolvendo menores de 16, com valores reajustados pela inflação; aplicadas pela Agência de Proteção da Privacidade da Califórnia e pelo Procurador-Geral (1798.155, 1798.199.90). Os consumidores só podem processar diretamente em casos de determinadas violações de dados causadas pela falta de segurança razoável, buscando indenização prefixada em lei por consumidor por incidente ou danos efetivos (1798.150).
What's changing
Adopted rules with phased dates. Regulations on cybersecurity audits, risk assessments and automated decision-making technology took effect on January 1, 2026, with compliance dates phased over the following years. Check the regulations for the dates that apply to your business; Regulatory Watch reports new rules and enforcement.
What to do first
- Confirm the thresholds and whether you sell or share personal information, including through advertising cookies and pixels.
- Map personal and sensitive personal information, including employee and business-contact data.
- Update your notice at collection and privacy policy, and review it at least every 12 months.
- Honor opt-out preference signals and add "Do Not Sell or Share" and "Limit" links where required.
- Put CCPA terms in contracts with service providers, contractors and third parties.
- Build a request process that verifies identity and answers within 45 days.
- Check the 2026 regulations for risk assessments, audits and automated decision-making.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Novidades recentes
-
CPPA proposes amendments to CCPA opt‑out preference signal regulations to recognize GPC and expand reporting
The changes would tighten how businesses must honor GPC‑based opt‑out requests, impacting data‑sharing and advertising practices. The California Privacy Protection Agency staff released a package of proposed amendments to the CCPA regulations on opt‑out preference signals (OOPS). The proposal would explicitly recognize the Global Privacy Control (GPC) as a valid opt‑out signal, add new examples for handling OOPS, and broaden annual metrics‑reporting obligations. The agency plans to open a 45‑day public comment period before formal rulemaking.
Source: Covington Inside Privacy. CCPA/CPRA in the regulations library.
-
CalPrivacy Board to hold public meeting on privacy rights and regulatory proposals Nov 5-6, 2026
The meeting signals upcoming regulatory activity that could affect how companies handle privacy notices, disclosures, and opt‑out mechanisms in California. The California Privacy Protection Agency Board will meet on November 5‑6, 2026 to discuss consumer privacy rights, legislative updates, and possible regulatory amendments such as opt‑out preference signals. The meeting will be open to the public in person and via remote access.
Source: Hunton Privacy & Cybersecurity Law Blog. CCPA/CPRA in the regulations library.
-
California Governor signs four privacy bills expanding deletion rights, privacy settings, data‑broker rules and limiting CIPA lawsuits
The new statutes significantly strengthen consumer deletion rights, tighten data‑broker obligations, protect user‑controlled privacy settings, and curtail a class of privacy‑related lawsuits. Governor Gavin Newsom signed SB 923, AB 2561, AB 883 and SB 690 into law during the 2026 session. SB 923 broadens CCPA deletion rights and requires online request mechanisms; AB 2561 bars operating systems and apps from changing privacy settings without consent; AB 883 shortens data‑broker deletion request processing to 30 days and promotes DROP awareness; SB 690 removes the private right of action for certain pen‑register and trap‑and‑trace claims under CIPA.
Effective: not stated.
Source: Covington Inside Privacy. CCPA/CPRA in the regulations library.
-
U.S. AI AGENT Act and California SB 1106 propose definitions and rules for AI agents
The bills signal the first U.S. attempts to regulate AI agents, affecting privacy, data access, and consumer protection. Two legislative proposals introduced in the United States this summer – the federal AI AGENT Act and California Senate Bill 1106 – aim to define “agentic AI” and impose obligations on consumer‑facing agents, with differing scopes and technical criteria.
SB 1106.
Source: Future of Privacy Forum. CCPA/CPRA in the regulations library.
-
California Privacy Protection Agency adopts multiple regulations including Conflict of Interest Code Amendments and Data Broker Registration Fee
Adopted CPPA regulations expand enforcement tools for the CCPA and Delete Act, affecting data brokers and other entities. The CPPA has adopted several regulations, such as the Conflict of Interest Code Amendments Regulation (September 2026) and Data Broker Registration Fee Regulation (December 2025). These were adopted through the Administrative Procedures Act rulemaking process and are now part of the agency’s regulatory framework.
Effective: not stated.
Source: CPPA rulemaking page (change monitor). CCPA/CPRA in the regulations library.
Fontes
- California Consumer Privacy Act (Código Civil 1798.100 a 1798.199.100) California Legislative Information · Texto oficial ou regulador
- Todas as leis abrangentes de privacidade que entram em vigor em 2026 MultiState · Escritório de advocacia ou analista
- Comparação das leis estaduais de privacidade dos EUA (24 leis promulgadas, datas de vigência) Recording Law · Escritório de advocacia ou analista
Biblioteca de regulamentações
Todas as leis estaduais de privacidade dos EUA em um só mapa
24 estados têm uma lei abrangente de privacidade na biblioteca, ao lado das leis da UE, do Reino Unido, federais dos EUA e globais: 102 no total, cada uma explicada em linguagem simples com suas fontes. Selecione um estado para ver o que se aplica lá.
- Em vigor
- Entrando em vigor
- Leis setoriais