CCPA compliance,
including the 2026 rules.

The California Consumer Privacy Act is California's general privacy law. It took effect on 1 January 2020 and gives California residents (consumers, employees, job applicants and business contacts) rights over the personal information businesses collect about them. It applies to for-profit businesses that do business in California and meet a size or data threshold, wherever they are based. A SaaS company in Texas, London or Bengaluru with California users can be in scope.

The California Privacy Rights Act is a ballot measure, Proposition 24, that voters approved on 3 November 2020. It did not replace the CCPA; it amended it, and most of its changes became operative on 1 January 2023. When people say "CCPA" today they mean the law as amended by the CPRA. The CPRA created the California Privacy Protection Agency (CPPA, which now also calls itself CalPrivacy), the first US regulator dedicated to privacy, and gave it power to write regulations and fine businesses.

A for-profit business that does business in California, collects California residents' personal information and meets at least one threshold (Civil Code 1798.140(d)):

• Revenue: annual gross revenue above $26,625,000 in the previous calendar year, the inflation-adjusted figure in force since 1 January 2025. It is total revenue, not California revenue.
• Volume: buys, sells or shares the personal information of 100,000 or more California consumers or households a year.
• Data revenue: earns 50% or more of annual revenue from selling or sharing personal information.

Employee, job applicant and B2B contact data has been fully covered since 1 January 2023. Some data is exempt rather than whole companies: protected health information governed by HIPAA, data covered by the Gramm-Leach-Bliley Act and consumer reports under the Fair Credit Reporting Act, for example. A service provider processing data only on a customer's instructions has narrower duties, mainly set by contract. Our free Does CCPA apply? checker walks through the tests.

• Know what personal information is collected, used, disclosed, sold or shared, and get a copy.
• Delete it, subject to exceptions.
• Correct inaccurate information.
• Opt out of sale and sharing, including by a browser signal such as Global Privacy Control.
• Limit the use of sensitive personal information to what the service needs.
• Not be retaliated against for using these rights.

Requests to know, delete and correct must be answered within 45 days, extendable once by another 45 days with notice (1798.130). Opt-out requests must be acted on as soon as feasible and no later than 15 business days (11 CCR 7026). Selling or sharing the data of a consumer under 16 needs opt-in: the consumer's own if aged 13 to 15, a parent's if under 13. Our data discovery and DSAR page covers how to find the data a request touches.

"Sell" means disclosing personal information to a third party for money or other valuable consideration. "Share" means disclosing it for cross-context behavioural advertising, whether or not money changes hands. Third-party advertising pixels and retargeting cookies on a website are the most common way a business sells or shares without realising it.

If you sell or share, you need a clear "Do Not Sell or Share My Personal Information" link (or the alternative "Your Privacy Choices" link with the official icon, 11 CCR 7015), a notice of the right to opt out, and a process that stops the selling and sharing once a consumer opts out. You must also treat an opt-out preference signal, in practice Global Privacy Control, as a valid opt-out for that browser and any profile linked to it. Under the regulations in force since 1 January 2026, you must display on your website whether you have processed the signal, for example "Opt-Out Request Honored" (11 CCR 7025(c)(6)). From 1 January 2027, a new section of the statute (1798.136, added by AB 566) requires browser makers to offer such a signal, so expect far more consumers to send one.

1. Confirm scope. Test the three thresholds every January, against the previous year.
2. Map the data. List what you collect about consumers, employees, applicants and business contacts, where it lives, and every vendor that receives it. A record of processing works as the map.
3. Classify each disclosure as to a service provider, a contractor or a third party, and decide which are sales or shares.
4. Publish the notices: a notice at collection and a privacy policy with categories, sources, purposes, retention periods, disclosures and rights. The privacy policy generator is a starting point.
5. Build request handling for know, delete, correct and limit, with identity verification, two or more intake methods and the 45-day clock tracked.
6. Add the opt-out: the Do Not Sell or Share link, Global Privacy Control honoured, and a visible status showing the signal was processed. Test it with the free cookie scanner.
7. Paper the vendors. Service provider and contractor contracts need the terms in 1798.100(d) and 11 CCR 7051; without them a disclosure may count as a sale. See vendor risk management.
8. Limit sensitive data to what the service needs, or offer the "Limit the Use of My Sensitive Personal Information" link.
9. Keep reasonable security in place and documented: it is your defence against breach lawsuits.
10. Run risk assessments for selling, sharing, sensitive data and ADMT, and plan for the cybersecurity audit if you meet its triggers.
11. Train the people who handle requests, and keep records of requests for 24 months.
12. Check the other states. Nineteen states now have comprehensive privacy laws in force; see US state privacy laws.

The consent platform applies an opt-out regime to US visitors, reads the Global Privacy Control signal server side, records a GPC browser as an opt-out in a tamper-evident consent ledger with the reason attached, and puts a privacy-request link on the banner. Requests land in a queue with deadlines set by request type. CCPA and the other US state laws are modelled in the shared control library, so a vendor review, a risk assessment or a security control counts toward SOC 2, GDPR and California at once. See the consent product and framework coverage. No tool makes you compliant by itself: your notices, contracts and decisions still need an owner.