What Is the CCPA? California Privacy Law Explained (2026)

By Daniel de Almeida Afonso · Last updated: October 20, 2026

The California Consumer Privacy Act (CCPA) is California's main consumer privacy law, in force since January 1, 2020 and amended by the California Privacy Rights Act (CPRA) from January 1, 2023. It gives California residents the right to know, delete, correct and limit the use of their personal information and to opt out of its sale or sharing. It applies to for-profit businesses that do business in California and have more than $26,625,000 in annual revenue, handle the data of 100,000 or more consumers or households, or earn 50% or more of their revenue from selling or sharing personal information. The California Privacy Protection Agency (CPPA) and the Attorney General both enforce it, with fines of up to $2,663 per violation, or $7,988 for intentional violations and violations involving children under 16.

This guide is general information, not legal advice. It reflects the statute and the CPPA's published rules as of October 20, 2026.

What is the CCPA, and what does the CPRA change?

The CCPA was enacted in 2018 and took effect on January 1, 2020. Its full name is the California Consumer Privacy Act, and it is the first comprehensive state privacy law in the United States. Older posts, including earlier versions of this one, sometimes call it the "California Consumers Protection Act." That is not the name in the statute.

In November 2020, California voters approved Proposition 24, the CPRA. The CPRA did not replace the CCPA. It amended it, so "the CCPA" today means the CCPA as amended. Most of the amendments took effect on January 1, 2023. The main changes were:

A right to correct inaccurate personal information.
A right to limit the use and disclosure of sensitive personal information.
"Sharing" for cross-context behavioral advertising now counts alongside "selling."
A dedicated enforcement body, the CPPA. The agency now uses the name CalPrivacy on its newer pages.
The end of the automatic 30-day cure period (more on that below).
The end of the temporary exemptions for employee and business-to-business data.

Some people call the CPRA "CCPA 2.0." For the amendments in detail, see our guide to what the CPRA is and how it differs from the CCPA.

Who does the CCPA apply to?

The CCPA applies to a for-profit business that collects consumers' personal information, determines why and how it is processed, does business in California, and meets at least one of three thresholds (Civil Code section 1798.140(d)):

Threshold	Current figure
Annual gross revenue	More than $26,625,000 in the preceding calendar year
Volume of data	Buys, sells or shares the personal information of 100,000 or more consumers or households a year
Revenue from data	50% or more of annual revenue from selling or sharing personal information

Three points that trip people up:

The revenue figure moves. The statute started at $25 million. The CPPA adjusts the dollar amounts for inflation, and its announcement of December 17, 2024 set the revenue threshold at $26,625,000 from January 1, 2025. The CPPA says the adjustment happens every odd-numbered year, so expect a new figure in 2027. We found no separate 2026 adjustment.
The data threshold doubled. The original law used 50,000 consumers, households or devices. The CPRA raised it to 100,000 consumers or households and counts businesses that "share" data as well as those that sell it. Many guides, and the 2019 FAQ this article replaces, still show the old number.
Location does not matter. A company anywhere in the world can be covered if it does business in California and meets a threshold. Nonprofits and government agencies are generally not covered.

Size is not the test. A small online retailer can pass the 100,000 mark through advertising and analytics tools alone. Control or common branding also matters: a company that shares branding with a covered business and receives its personal information can be covered too.

A "consumer" is a California resident. That includes people who are domiciled in California but temporarily outside the state.

What rights does the CCPA give consumers?

According to the Attorney General's CCPA page, consumers have these rights:

Right to know what personal information a business collects, uses, shares or sells. Businesses must provide it free of charge, and a consumer can ask up to twice a year.
Right to delete personal information, subject to exceptions.
Right to correct inaccurate personal information.
Right to opt out of the sale or sharing of personal information.
Right to limit the use and disclosure of sensitive personal information.
Right to non-discrimination for using any of these rights.

Businesses generally have 45 days to respond to a verifiable request, and can extend by another 45 days when reasonably necessary if they tell the consumer. Opt-in rather than opt-out applies to children: a business may not sell or share the data of anyone it knows is under 16 unless the teen (13 to 15) or the parent or guardian (under 13) opts in.

"Personal information" is broad. It covers information that identifies, relates to, describes or could reasonably be linked to a particular consumer or household. "Sensitive personal information" is a subset with extra protection. It includes Social Security, driver's license and passport numbers, account log-ins with passwords, precise geolocation, racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, union membership, the contents of private messages (unless the business is the intended recipient), genetic data, biometric data used to identify a person, health data, and information about sex life or sexual orientation.

What must a business do?

If the CCPA applies to you, the core obligations are:

Tell people what you do. Give a notice at or before the point of collection, and keep an accurate privacy policy.
Offer the opt-outs. If you sell or share personal information, put a clear "Do Not Sell or Share My Personal Information" link on your homepage. If you use or disclose sensitive personal information beyond the permitted purposes, add a "Limit the Use of My Sensitive Personal Information" link. You may use one combined link instead.
Honor opt-out preference signals. Under the CCPA regulations (11 CCR section 7025), a business that sells or shares personal information must treat a qualifying browser or device signal, such as Global Privacy Control (GPC), as a valid opt-out request. It applies to that browser or device and to any profile linked to it. Showing the consumer a status message is optional, and you cannot treat the later absence of a signal as consent.
Handle requests. Verify and answer know, delete, correct, opt-out and limit requests within the deadlines.
Control your vendors. Service providers and contractors need a written contract that stops them from selling or sharing the data and from using it outside the business purposes in the contract. The updated regulations add mandatory language for agreements with third parties.
Secure the data. Reasonable security procedures matter twice over, because a breach can lead to private lawsuits (see below).
Respect minors. Get opt-in authorization before selling or sharing data of consumers you know are under 16.

For a step-by-step list, use our CPRA compliance checklist. For the longer requirements walk-through, see the CCPA requirements guide.

Not in the EU sense. California is an opt-out regime, so a business can use cookies and similar tools to sell or share data until the consumer opts out, as long as it has given notice. That does not make cookies harmless. Advertising and cross-site tracking cookies are often a "sale" or "sharing," so you need a working opt-out and signal handling for them, and you need opt-in for consumers you know are under 16.

How is the CCPA enforced?

Two public bodies enforce it. California does have a dedicated enforcement body, which older guides often miss: the CPRA created the CPPA.

The CPPA can investigate on a sworn complaint or on its own initiative and can bring administrative enforcement actions for fines (section 1798.155). Consumers have been able to file complaints with the agency for violations on or after July 1, 2023.
The Attorney General can bring a civil action for an injunction and civil penalties (section 1798.199.90). If the Attorney General asks, the agency must stay its own action to let the Attorney General proceed.

Recent public actions show the pattern. The CPPA announced a $1.35 million fine against a rural lifestyle retailer on September 30, 2025 (press summaries name it as Tractor Supply). Press summaries also report a $12.75 million Attorney General settlement with General Motors announced in May 2026 over the sale of driving and location data, which was still subject to court approval when announced. These are drawn from the CPPA's announcements page and press summaries, so check the originals before citing the figures.

What are the penalties?

Who brings the case	Per violation	Intentional violations, or children under 16
CPPA (administrative fine)	Up to $2,663	Up to $7,988
Attorney General (civil penalty)	Up to $2,663	Up to $7,988

The statute sets $2,500 and $7,500 and adjusts them for inflation. The $2,663 and $7,988 figures come from the CPPA's December 17, 2024 announcement and apply from January 1, 2025.

The amounts add up because they are per violation. A regulator that counts each of 1,000 affected consumers as a violation is looking at up to $2,663,000, or $7,988,000 if the violations are intentional. Whether violations are counted that way depends on the facts of each case, so treat this as an illustration, not a prediction.

Separately, consumers can sue after certain data breaches. If unencrypted personal information is stolen or exposed because a business failed to keep reasonable security, a consumer can claim statutory damages from $100 to $750 per consumer per incident or actual damages if greater (section 1798.150). After the inflation adjustment the CPPA lists this range as $107 to $799. This is the only private right of action in the CCPA. Individuals generally cannot sue for other violations.

Is there a cure period?

There is no automatic right to cure. The original CCPA gave businesses 30 days to fix a violation after a notice. The CPRA removed that for regulators. Now the CPPA may decide not to investigate or may give a business time to cure, and it can weigh a lack of intent and voluntary efforts to fix the problem before the complaint (section 1798.199.45). That is discretion, not a right. The Attorney General's civil penalty provision contains no cure period.

One cure rule remains. Before a consumer can sue for statutory damages after a breach, they must give 30 days' written notice, and if the business can cure and does, the suit cannot proceed. A security fix after the breach does not count as a cure for that breach.

For more on fines and how they are applied, see CCPA fines.

They share vocabulary, such as service providers and processors, but the CCPA is not a copy of the GDPR. The short version: the CCPA is built around notice and opt-out for sale and sharing, covers only for-profit businesses over a threshold, protects California residents only, and relies on two enforcers. The GDPR needs a legal basis for all processing and applies to nearly all organizations. For the full comparison, see CPRA vs GDPR.

What have the CPPA's regulations added?

The CPPA's updated regulations were adopted by the board on July 24, 2025, approved by the Office of Administrative Law in September 2025 and took effect on January 1, 2026. They cover three areas, with phased dates:

Risk assessments. Businesses must run a risk assessment for certain high-risk processing. Compliance began January 1, 2026. Businesses submit an attestation to the CPPA by April 1, 2028 for assessments done in 2026 and 2027, and by April 1 of the following year after that.
Cybersecurity audits. Certain businesses must have an annual independent audit. Certification is due April 1, 2028 for businesses above $100 million in revenue, April 1, 2029 for those from $50 million to $100 million, and April 1, 2030 for smaller covered businesses, per a law-firm summary (Alston and Bird). We did not check the audit-trigger criteria against the regulation text, so confirm who must audit before relying on this.
Automated decisionmaking technology (ADMT). Businesses using ADMT to make significant decisions about consumers must comply from January 1, 2027. The rules give consumers a right to access information about, and opt out of, that use.

Our guides on the regulations cover these in depth.

What about employee, job applicant and B2B data?

Employee, applicant and business-to-business contact data used to be largely exempt. Those exemptions ran out on December 31, 2022, per the Attorney General's page, and the statute's temporary provisions became inoperative on January 1, 2023. Since then, employees, job applicants, contractors and business contacts who live in California have CCPA rights, and covered businesses must handle their data like other consumers' data.

What does the Delete Act add?

The Delete Act (SB 362) is separate from the CCPA but works alongside it. It targets data brokers, meaning businesses that knowingly collect and sell the personal information of people with whom they have no direct relationship. The CPPA runs the Delete Request and Opt-out Platform (DROP). Per the state's DROP page, consumers have been able to use it since January 2026, brokers must register each year, and since August 1, 2026 brokers must process DROP requests at least once every 45 days. Failing to register, or failing to delete as required, carries $200 a day. Our California Delete Act guide covers the Act in more detail, but its description of the platform predates the launch, so use the state's page for current operations.

Frequently asked questions

What does CCPA stand for?

California Consumer Privacy Act. It was passed in 2018, took effect on January 1, 2020, and has been amended by the CPRA since January 1, 2023.

Does the CCPA apply if my company is not in California?

Yes, if you do business in California, collect California residents' personal information and meet a threshold: more than $26,625,000 in revenue, 100,000 or more consumers or households, or 50% or more of revenue from selling or sharing data. Where your company is based does not decide it.

Is CCPA compliance only for large companies?

No. The revenue test excludes small firms, but the 100,000 data test and the 50% revenue test do not depend on company size. Small publishers and retailers can meet them.

Does the CCPA protect publicly available information or health data?

Publicly available information is excluded from the definition of personal information, and the statute has separate rules for some health and medical data, including data covered by HIPAA. Check the exemptions in section 1798.145 before treating a data set as out of scope, because they are narrow and depend on the type of data.

What privacy notices does a business need?

A notice at or before collection that says what you collect and why, a privacy policy, and notices of the right to opt out of sale or sharing and the right to limit sensitive personal information where those apply. If you run a financial incentive program, you also need a notice for it.

Can we still sell personal information?

Yes, but you must give notice, offer an opt-out, honor opt-out preference signals, and get opt-in authorization for consumers you know are under 16. After an opt-out you must stop selling or sharing that consumer's data.

Is the CCPA the same as the CPRA?

No. The CPRA is the 2020 ballot measure that amended the CCPA. The law you comply with today is the CCPA as amended by the CPRA.

Not automatically. GDPR work helps with notices, data mapping and request handling, but you still need the CCPA's opt-out links, signal handling, vendor contract terms and the thresholds-based scope analysis.

If you need help with opt-out links and signal handling, Secure Privacy offers a consent management platform; check your own setup against the rules above.