Regulations › US states › California
CCPA/CPRA
California Consumer Privacy Act, as amended by the California Privacy Rights Act
WhenIn effect since 1 January 2020
Who enforces itCalifornia Privacy Protection Agency and Attorney General
Who it applies toFor-profit businesses doing business in California that meet one threshold: annual gross revenue above $26,625,000 (inflation-adjusted), buying, selling or sharing personal information of 100,000 or more consumers or households, or earning half or more of revenue from selling or sharing personal information.
Tell the regulatorNotify the Attorney General within 15 days of notifying consumers when a breach affects more t…
DPO requiredNo DPO requirement
RegistrationNo general registration
Transfers abroadNot addressed
Request deadline45 days to respond to know, delete and correct requests, extendable once by 45 days
Maximum fineUp to USD 2,663 per violation or USD 7,988 per intentional violation or violation involving mi…
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
2
Applies to for-profit businesses doing business in California that meet revenue or data-volume thresholds, wherever located, for California residents' data.Cal. Civ. Code 1798.140(d) · source ↗
Revenue threshold adjusted to USD 26,625,000 from 1 Jan 2025 (CPPA CPI page).
Lawful basis
0
No lawful-basis requirement; notice at collection plus purpose limitation, with opt-out of sale/sharing.Cal. Civ. Code 1798.100(a)-(c), 1798.120(a) · source ↗
Consent
1
Opt-out model; opt-in consent required to sell/share data of consumers under 16 and to re-opt-in after an opt-out.Cal. Civ. Code 1798.140(h), 1798.120(c) · source ↗
Sensitive data
1
Sensitive personal information defined; consumers may limit its use to listed necessary purposes, with notice required.Cal. Civ. Code 1798.121(a) · source ↗
Children
2
Under 16: opt-in required to sell/share; under 13: parental authorization. Fines up to USD 7,988 for violations involving minors under 16.Cal. Civ. Code 1798.120(c); 1798.155(a) · source ↗
People's rights
Rights
3
Know/access, delete, correct, portability, opt-out of sale/sharing, limit sensitive data, and ADMT opt-out and access rights.Cal. Civ. Code 1798.105, .106, .110, .120, .121, .130(a)(2); 11 CCR Art. 11 (ADMT) · source ↗
ADMT rights apply from 1 Jan 2027 for existing uses (CPPA announcement).
Request deadline
1
45 days to respond to know, delete and correct requests, extendable once by 45 days; opt-out requests within 15 business days.Cal. Civ. Code 1798.130(a)(2)(A); 11 CCR 7026(f) · source ↗
15-business-day opt-out deadline (11 CCR 7026(f)) not verified this session.
Marketing
1
Right to opt out of selling or sharing data for cross-context behavioral advertising; email marketing governed by federal CAN-SPAM.Cal. Civ. Code 1798.120(a) · source ↗
Governance
DPO required
0
No DPO requirement; executive accountable for risk-assessment attestations and cybersecurity audit certification.11 CCR 7157(c) · secondary source · source ↗
Registration
1
No general registration; data brokers must register annually with the CPPA under the Delete Act.Cal. Civ. Code 1798.99.82 · source ↗
Section number not verified this session; data broker regime (DROP platform) referenced on CPPA site.
DPIA
3
Risk assessments required for significant-risk processing from 1 Jan 2026; attestations and summaries filed with the CPPA starting 1 Apr 2028.11 CCR 7150, 7155, 7157 · source ↗
Section numbers from secondary source (modulos.ai); deadlines confirmed on CPPA announcement.
Records
1
No general record of processing; businesses keep records of consumer requests for at least 24 months.11 CCR 7101 · source ↗
7101 not verified this session.
Retention
2
Disclose retention period per category and keep data no longer than reasonably necessary for the disclosed purpose.Cal. Civ. Code 1798.100(a)(3) · source ↗
Breaches
Tell the regulator
2
Notify the Attorney General within 15 days of notifying consumers when a breach affects more than 500 California residents.Cal. Civ. Code 1798.82(f) as amended by SB 446 · secondary source · source ↗
Effective 1 Jan 2026. Subdivision letter not verified. Breach law sits outside the CCPA but applies to the same businesses.
Tell people
3
Notify affected California residents within 30 calendar days of discovering a breach of unencrypted personal information.Cal. Civ. Code 1798.82(a) as amended by SB 446 · secondary source · source ↗
Effective 1 Jan 2026; law enforcement delay allowed.
Transfers
Transfers abroad
–
Not addressedN/A · source ↗
No cross-border transfer rules; contracts required with service providers, contractors and third parties (1798.100(d)).
Enforcement
Maximum fine
2
Up to USD 2,663 per violation or USD 7,988 per intentional violation or violation involving minors, with no aggregate cap.Cal. Civ. Code 1798.155(a); 1798.199.90 · source ↗
Per-violation amounts stack; 2025 enforcement settlements exceeded USD 1 million. Next CPI adjustment due 2027.
Private action
3
Private right of action for data breaches from failure to maintain reasonable security: USD 107-799 per consumer per incident, class actions allowed.Cal. Civ. Code 1798.150(a)(1)(A) · source ↗
Limited to breach claims; 30-day cure notice for statutory damages.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws