CCPA/CPRA

California Consumer Privacy Act, as amended by the California Privacy Rights Act

In force privacy consumer rights

WhenIn effect since 1 January 2020

Who enforces itCalifornia Privacy Protection Agency and Attorney General

Who it applies toFor-profit businesses doing business in California that meet one threshold: annual gross revenue above $26,625,000 (inflation-adjusted), buying, selling or sharing personal information of 100,000 or more consumers or households, or earning half or more of revenue from selling or sharing personal information.

Tell the regulatorNotify the Attorney General within 15 days of notifying consumers when a breach affects more t… DPO requiredNo DPO requirement RegistrationNo general registration Transfers abroadNot addressed Request deadline45 days to respond to know, delete and correct requests, extendable once by 45 days Maximum fineUp to USD 2,663 per violation or USD 7,988 per intentional violation or violation involving mi…

If you already comply with

81%

of California's 21 requirements are already met by European Union (GDPR). Here is what CCPA/CPRA adds, biggest gaps first.

RegistrationGovernanceGap

GDPR0 No general registration; controllers communicate DPO contact details to the supervisory authority.

CCPA/CPRA adds1 No general registration; data brokers must register annually with the CPPA under the Delete Act. Cal. Civ. Code 1798.99.82 · source ↗

DPIAGovernanceGap

GDPR2 DPIA required before processing likely to result in high risk; prior consultation if residual high risk remains.

CCPA/CPRA adds3 Risk assessments required for significant-risk processing from 1 Jan 2026; attestations and summaries filed with the CPPA starting 1 Apr 2028. 11 CCR 7150, 7155, 7157 · source ↗

RetentionGovernanceGap

GDPR1 Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.

CCPA/CPRA adds2 Disclose retention period per category and keep data no longer than reasonably necessary for the disclosed purpose. Cal. Civ. Code 1798.100(a)(3) · source ↗

Tell peopleBreachesGap

GDPR2 Notify affected individuals without undue delay when the breach is likely to result in high risk.

CCPA/CPRA adds3 Notify affected California residents within 30 calendar days of discovering a breach of unencrypted personal information. Cal. Civ. Code 1798.82(a) as amended by SB 446 · source ↗

Already covered by GDPR: Reach abroad, Lawful basis, Consent, Sensitive data, Children, Rights, Request deadline, Marketing, DPO required, DPO qualifications, Records, Tell the regulator, Transfers abroad, Localization, Maximum fine, Criminal liability, Private action.

A gap means CCPA/CPRA is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.

Regulations library

Every US state privacy law, on one map

24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.

Explore the map Follow Regulatory Watch

In force
Coming into force
Sector laws

AK ME VT NH WA ID MT ND MN IL WI MI NY RI MA OR NV WY SD IA IN OH PA NJ CT CA UT CO NE MO KY WV VA MD DE AZ NM KS AR TN NC SC DC OK LA MS AL GA HI TX FL