By Daniel de Almeida Afonso · Last updated: October 12, 2026
The California Consumer Privacy Act (CCPA) regulations are the detailed rules, found in Cal. Code Regs. tit. 11, section 7000 and following, that tell businesses how to comply with the statute. The CCPA regulations are no longer proposals. The Attorney General's first version took effect on August 14, 2020, the California Privacy Protection Agency (CPPA) replaced it with a CPRA-era rewrite effective March 29, 2023, and a further package on risk assessments, cybersecurity audits and automated decisionmaking technology (ADMT) took effect on January 1, 2026, with ADMT compliance due January 1, 2027.
This guide covers who the rules apply to, what the current text requires, the dates that still matter, and a short history of the 2019 to 2020 drafts. It is general information, not legal advice.
Who the CCPA regulations apply to
The regulations apply to any "business" under the CCPA. A for-profit company that does business in California is a business if it meets one of three tests in Civil Code section 1798.140(d):
- Annual gross revenue above $26,625,000 (the statute says $25,000,000, adjusted for inflation; the CPPA's adjusted figure took effect January 1, 2025)
- Buys, sells or shares the personal information of 100,000 or more consumers or households a year
- Derives 50 percent or more of annual revenue from selling or sharing consumers' personal information
The CPPA says it adjusts the dollar figures every odd-numbered year, so a new revenue figure should follow in 2027. Check the CPPA's CPI adjustment page before relying on the numbers above after that date.
Penalties follow the same adjustment. Administrative fines and civil penalties are up to $2,663 per violation and up to $7,988 for each intentional violation or violation involving consumers the business knows are under 16. The separate private right of action for certain data breaches carries $107 to $799 per consumer per incident, or actual damages if greater.
The three layers of regulation
California's rules were written in three stages.
| Stage | Who wrote it | Took effect | What it did |
|---|---|---|---|
| Original CCPA regulations | Attorney General | August 14, 2020 (amended March 15, 2021) | Set notice, request-handling, verification, minors and non-discrimination rules |
| CPRA-era regulations | CPPA | March 29, 2023 | Rewrote the text to match the CPRA amendments and added new rights and consent rules |
| 2025 update package | CPPA | January 1, 2026 | Added risk assessments, cybersecurity audits and ADMT rules, with later compliance dates |
The Attorney General's original rules sat at sections 999.300 and following. The CPPA moved the content into sections 7000 and following. Older articles that cite "section 999.305" use the original numbering.
What the current regulations require
The CPPA's consolidated text, effective January 1, 2026, is organized by topic. These are the areas most businesses touch.
Notices and disclosures
Businesses must give a notice at collection at or before the point where they collect personal information, keep an online privacy policy, and, where they sell or share personal information, post the notice of the right to opt out. The text also covers the notice of the right to limit use of sensitive personal information and the notice of financial incentive. Notices must be readable, available in the languages the business normally uses with consumers in California, and reasonably accessible to people with disabilities.
A business that wants one link instead of two can use the Alternative Opt-out Link under section 7015. It must be titled "Your Privacy Choices" or "Your California Privacy Choices" and must carry the regulation's opt-out icon.
Consent and dark patterns
Section 7004 sets the standard for how a business collects consent and offers choices. An agreement obtained through dark patterns does not count as consent. If you run a cookie banner or preference center in California, this is the section your design is measured against. One of its rules is symmetry in choice: opting out of sale or sharing cannot take more steps than opting in.
Opt-out preference signals and Global Privacy Control
When a business that collects personal information online detects a valid opt-out preference signal, such as Global Privacy Control (GPC), it must treat the signal as a valid request to opt out of sale and sharing for that browser or device, and for any consumer profile linked to it. A business must also display whether it has processed the consumer's opt-out, for example with a message such as "Opt-Out Request Honored" (section 7025). The August 2020 text already said that user-enabled global privacy controls count as the consumer's own request. For testing and enforcement detail, see our Global Privacy Control compliance guide.
Consumer requests
The regulations set how businesses receive, verify and answer requests to know, delete, correct, opt out and limit. They also cover authorized agents and the contract terms that make a vendor a service provider or contractor rather than a third party. Our guide to CCPA service providers, contractors and third parties covers the contract side. For a full list of obligations in one place, see the CCPA requirements guide.
Employee and business-contact data
The temporary exemptions for employee, applicant and business-to-business data were extended several times and finally expired on January 1, 2023, after the legislature adjourned without extending them. Since then, the same notice and request rules apply to that data, according to law-firm summaries of the expiry.
The 2025 package: risk assessments, cybersecurity audits and ADMT
The CPPA board adopted the update package on July 24, 2025. The Office of Administrative Law (OAL) approved and filed it on September 22, 2025, and it took effect on January 1, 2026. It does four things: updates the existing CCPA regulations, requires certain businesses to complete risk assessments and annual cybersecurity audits, gives consumers rights to access and opt out of ADMT, and clarifies when insurance companies must comply with the CCPA.
Most of the work lands later than the effective date. These are the compliance dates in the regulation text.
| Requirement | Who it covers | Date |
|---|---|---|
| Risk assessment before new high-risk processing | Businesses that sell or share personal information, process sensitive personal information, use ADMT for significant decisions, and the other activities listed in section 7150 | From January 1, 2026 |
| Risk assessment for processing begun before 2026 and continuing | Same businesses | By December 31, 2027 |
| Risk assessment submission to the CPPA (2026 and 2027 assessments) | Same businesses | By April 1, 2028 |
| ADMT notice, opt-out and access | Businesses using ADMT for a significant decision | January 1, 2027 |
| First cybersecurity audit report | Businesses over $100 million revenue | April 1, 2028 |
| First cybersecurity audit report | Businesses with $50 million to $100 million revenue | April 1, 2029 |
| First cybersecurity audit report | Businesses under $50 million revenue | April 1, 2030 |
Risk assessments
Section 7150 lists the processing that triggers an assessment, including selling or sharing personal information, processing sensitive personal information, using ADMT for a significant decision, certain automated inference about applicants, students, employees and contractors, and processing personal information to train ADMT or facial-recognition technology. Section 7150 includes a narrow carve-out for employee sensitive data used only for payroll, work authorization, benefits, accommodations and wage reporting. Risk assessments must be kept for as long as the processing continues or five years after completion, whichever is later.
Cybersecurity audits
An audit is required if a business derives 50 percent or more of its revenue from selling or sharing personal information, or if it meets the revenue test in section 1798.140(d)(1)(A) and also processed personal information of 250,000 or more consumers or households, or sensitive personal information of 50,000 or more consumers, in the preceding calendar year. Because the revenue test cross-refers to the statute, the current inflation-adjusted figure applies, not a flat $25 million as some summaries state.
ADMT
The regulations define ADMT as technology that processes personal information and uses computation to replace or substantially replace human decisionmaking. "Substantially replace" means the business uses the output without human involvement, and the rules set three conditions for real human involvement: the reviewer knows how to interpret the output, reviews it with other relevant information, and has authority to change the decision.
A "significant decision" is one that results in providing or denying financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services. A business using ADMT for such a decision before January 1, 2027 must comply by that date, and one starting later must comply whenever it uses ADMT for a significant decision. For the full ADMT walkthrough, read our guide to the CPRA ADMT regulations.
Enforcement of the CPPA's regulations
The CPPA began formal rulemaking on July 8, 2022 and the OAL approved its first package on March 29, 2023. According to law-firm summaries, a Sacramento trial court ruled on June 30, 2023 that enforcement of those regulations could not start until March 29, 2024, and a California Court of Appeal vacated that delay on February 9, 2024. The practical result is that the CPPA can enforce the regulations from their effective dates. The Attorney General also keeps authority to bring civil actions for penalties under Civil Code section 1798.199.90.
How we got here: the 2019 to 2020 drafts
Many readers still arrive from searches for "CCPA proposed regulations." These are the milestones.
- October 11, 2019: The Attorney General published the first proposed regulations, with hearings in four cities in early December 2019 and a comment period closing December 6.
- February 10, 2020: The first set of modifications, with comments through February 25.
- March 2020: A second set of modifications, with a comment period closing March 27.
- June 1, 2020: The Attorney General submitted the final text to the OAL and asked for expedited review.
- August 14, 2020: The OAL approved the regulations and they took effect immediately.
- March 15, 2021: Further amendments took effect, after third and fourth sets of modifications issued in late 2020.
The numbers changed a lot between the first draft and the final text. This table compares the October 2019 draft with the August 2020 final text.
| Topic | October 2019 draft | August 2020 final text |
|---|---|---|
| Definition of household | A person or group occupying a single dwelling | People who live at the same address, share a device or service, and are identified by the business as sharing a group account or unique identifier |
| Methods for requests to know | At least two, including a toll-free number and, for businesses with a website, an online form | At least two including a toll-free number, but an online-only business with a direct consumer relationship needs only an email address |
| Confirming receipt of a request | 10 days | 10 business days |
| Acting on an opt-out request | 15 days | 15 business days |
| Telling third parties about an opt-out | Notify third parties sold to in the 90 days before the request | Notify third parties sold to after the request but before the business complies |
| Metrics reporting threshold | Businesses handling the data of 4,000,000 or more consumers | 10,000,000 or more consumers |
| Records of requests | At least 24 months | At least 24 months, kept with reasonable security procedures |
Three changes between drafts are worth knowing in their own right.
- The IP address and opt-out button language did not survive. The February 2020 draft said an IP address was not personal information if the business did not link it to a consumer or household, and it showed an optional opt-out button design. The second set of modifications removed both, according to law-firm summaries of that round, and the August 2020 text contains no button. An opt-out icon does appear in today's section 7015, for the Alternative Opt-out Link.
- Notice at collection and the privacy policy stayed separate. Both the October 2019 draft and the final text let a business give the notice at collection online by linking to the specific section of its privacy policy that contains it, so a bare link to the whole policy is not enough. The October 2019 draft also required explicit consent before using data for a new, undisclosed purpose; that rule did not make it into the approved text (see the withdrawn provisions below).
- The non-discrimination rule held, the examples changed. Both versions have two illustrative examples in section 999.336. The October 2019 mailing-list example was replaced by a loyalty-program example. The core rule stayed: a price or service difference tied to exercising a right is discriminatory unless it is reasonably related to the value of the consumer's data.
The OAL also approved the package in part and withdrew four provisions, according to law-firm summaries: the opt-in for material changes in data use, the offline opt-out notice, a requirement that opt-out methods be easy to execute, and the ability to deny agent requests lacking proof of authority. The first of these is the "new purpose" rule above, and the Attorney General could resubmit withdrawn provisions.
The 2019 amendment bills that sat beside the draft were separate statutory changes, not part of this rulemaking. Our CCPA vs. CPRA guide, explains how voters' approval of the CPRA in November 2020 reshaped the statute these regulations implement.
What to do now
- Confirm whether you meet a business threshold using the current $26,625,000 revenue figure, not the original $25 million.
- Check your cookie banner and preference center against the section 7004 dark pattern rules and the opt-out preference signal rules. Our CPRA compliance checklist is a practical place to start.
- Make a list of processing that triggers a risk assessment under section 7150, and date it. Anything started before 2026 and still running has until December 31, 2027.
- Inventory any system that makes or heavily shapes decisions about employment, credit, housing, education or healthcare, and decide whether a human reviewer meets the three-part test before January 1, 2027.
- If you are above the audit thresholds, work out which revenue tier sets your first cybersecurity audit date.
Frequently asked questions
Are the CCPA regulations still "proposed"?
No. The Attorney General's regulations took effect on August 14, 2020, the CPPA's rewrite took effect on March 29, 2023, and the 2025 update package took effect on January 1, 2026. Some compliance dates inside that package run to 2030.
Who enforces the CCPA regulations today?
The CPPA and the California Attorney General both enforce the CCPA. The CPPA wrote the current regulations after taking over rulemaking from the Attorney General, who wrote the original ones.
What are the current CCPA thresholds and penalties?
A business needs more than $26,625,000 in annual revenue, 100,000 or more consumers or households bought, sold or shared, or 50 percent of revenue from selling or sharing. Fines are up to $2,663 per violation and up to $7,988 for intentional violations or those involving known minors under 16.
When do the ADMT rules apply?
ADMT compliance is due January 1, 2027 for businesses already using ADMT for a significant decision. A business that starts using it later must comply from the first use.
Do the cybersecurity audit rules apply to small businesses?
Only if the business meets an audit trigger: 50 percent of revenue from selling or sharing, or the revenue threshold plus 250,000 consumers or households (or 50,000 consumers' sensitive data). The first report is due April 1, 2028, 2029 or 2030, depending on revenue.
Does Global Privacy Control have to be honored?
Yes, for businesses that collect personal information online. The regulations require treating a valid opt-out preference signal as an opt-out of sale and sharing for that browser or device, and displaying that the opt-out was processed.
