California Consumer Privacy Act (CCPA): An Overview

The California Consumer Privacy Act (CCPA) is the first comprehensive state consumer privacy law passed in the U.S. Since taking effect in 2020, it has shaped subsequent privacy legislation in other states. The California Privacy Rights Act (CPRA), which took effect in 2023, amended and expanded the CCPA. For the remainder of this article, “CCPA” refers to the law as amended by the CPRA.

Several other California laws passed since the CCPA can also affect your data privacy obligations, including the California Age-Appropriate Design Code Act, parts of which remain in litigation, and the California Opt Me Out Act.

The same is true of federal laws like the Health Insurance Portability and Accountability Act (HIPAA) and the Children’s Online Privacy Protection Act (COPPA). Older California laws also matter, particularly the California Invasion of Privacy Act (CIPA), which is central to website tracking lawsuits. SB 690, signed on September 30, 2026, will limit pen register claims from January 1, 2027, but wiretapping claims remain available.

If you do business in California and meet one of the CCPA’s thresholds, its obligations are a sensible place to start. They can give you a useful foundation for other U.S. state privacy laws, but those laws differ in their thresholds, definitions, and consent rules, so check each state’s requirements and consult qualified legal counsel about your obligations and compliance strategy.

In this article, we look at when and how the law applies, what’s coming up, the CCPA’s obligations for businesses, and practical steps to help you meet them.

What Is the California Consumer Privacy Act (CCPA)?

The California Consumer Privacy Act (CCPA) is a U.S. state-level consumer privacy law that was passed in 2018 and came into effect on January 1, 2020. It applies exclusively to California residents, known as “consumers” under the law, and regulates the protection of their personal information. 

Under the CCPA, a resident is any individual who is:

• In the State for other than a temporary or transitory purpose
• Domiciled in the state and outside the state for a temporary or transitory purpose

Although the CCPA is a state law, it has a considerable influence. This is largely due to California being both the most populous U.S. state, with almost 40 million residents, one of the world’s largest economies, and the headquarters of many global tech companies. 

The CCPA was amended and expanded by the California Privacy Rights Act (CPRA), which took effect on January 1, 2023. It granted additional rights to consumers and established the California Privacy Protection Agency (CPPA, also known as CalPrivacy), among other things.

What’s New in the CCPA? 2026 Regulation Updates

In July 2025, the CPPA board voted to adopt new regulations to update existing regulations and add more requirements for businesses. Implementation will be staggered over four years, starting in January 2026 and ending in April 2030. The regulations took effect on January 1, 2026.

Automated Decision-Making Technology (ADMT)

Effective from January 1, 2027, you are required to provide a clear disclosure before using ADMT to make a significant decision about a consumer. You must include:

• The fact you’re using ADMT
• How the ADMT works
• The reasons why ADMT is being used
• Consumers’ rights regarding ADMT use under the CCPA

You must also let consumers opt out of ADMT used for significant decisions, unless an exception applies, such as offering a human appeal instead. Advertising is outside this rule. You must keep detailed records of notices, consumer preferences, and decisions.

Cybersecurity Audits

The CCPA regulations require an annual cybersecurity audit from any business whose data processing presents a significant risk to consumers’ security. A business meets that standard if it either:

• Derives 50 percent or more of its annual revenue from selling or sharing consumers’ personal information, or
• Had annual gross revenue above USD 26,625,000 in the preceding calendar year (as adjusted for inflation), and processed the personal information of 250,000 or more consumers or households, or the sensitive personal information of 50,000 or more consumers

A professional must conduct these annual audits using recognized standards. They should evaluate how well your cybersecurity program protects consumers from threats using measures like access controls, encryption, and vulnerability scanning. 

Afterward, they must issue a report describing any potential issues and the steps your business will take to address them.

Your first audit certification is due to CalPrivacy on a date that depends on your annual gross revenue:

• Over USD 100 million (2026 revenue): April 1, 2028
• USD 50–100 million (2027 revenue): April 1, 2029
• Under USD 50 million (2028 revenue): April 1, 2030

Risk Assessments

Risk assessment requirements began on January 1, 2026. You must assess an activity before you start it if it presents a significant risk to consumers’ privacy. Assessments for activities already under way are due by December 31, 2027, and your first attestation and summary are due to CalPrivacy on April 1, 2028.

• Selling or sharing personal information
• Processing sensitive personal information
• Using ADMT to make a significant decision

Risk assessments must weigh the proposed benefits to consumers of the data processing activity against the potential risks. You can’t frame the benefits in generic terms, such as ‘to improve our service’. In addition to conducting these assessments before new initiatives, you must be able to submit them to CalPrivacy or the Attorney General upon request.

Insurance Company Clarifications

The updates to the CCPA also clarified when insurance companies must comply with the CCPA. Any personal information collected by insurance companies outside of an insurance transaction is subject to CCPA requirements, given that the insurer meets one of the CCPA’s thresholds. Personal information collected within the scope of an insurance transaction is subject to compliance with the California Insurance Code (CIC).

This arrangement will change. In September 2026, California enacted Senate Bill 354, which replaces the state’s Insurance Information and Privacy Protection Act with the California Insurance Information and Privacy Protection Act (CIIPPA). The CIIPPA becomes operative on July 1, 2028, with implementing regulations due from the Insurance Commissioner by January 1, 2029. Insurers should plan for these requirements now, even though the framework above remains the current position.

Other Changes to Existing CCPA Requirements

The 2025 regulations also amended several existing requirements. These changes took effect on January 1, 2026:

• Opt-out confirmation: Your website must show consumers that you have processed their opt-out preference signal, such as Global Privacy Control (GPC), as a valid opt-out of sale and sharing.
• Privacy policy disclosures: Your privacy policy must also list the categories of personal information you disclosed to service providers and contractors in the preceding 12 months, or state that you made no such disclosures.
• Neural data: Neural data now counts as sensitive personal information.
• Expanded access requests: If you retain personal information for longer than 12 months, consumers can request information collected before that period, going back to January 1, 2022.

Definitions Under the CCPA

The CCPA defines several terms that cover the information it protects and data processing activities. 

Personal Information

The CCPA defines personal information as “information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”

Here are examples of information that could identify individuals under the law:

Names or nicknames

Postal address

Contact details

Purchase and browsing history

Location data

Employment and professional data

Sensitive Personal Information

Sensitive personal information is any private data that could lead to harm, such as discrimination or identity theft, if exposed. The CCPA defines it as any details that reveal a consumer’s:

Government ID or numbers

Credentials for personal or financial log-in accounts

Precise geolocation

Race or ethnic origin

Immigration status

Religious or philosophical beliefs

Contents of private messages

Genetic data

Neural data

Since January 1, 2026, sensitive personal information also includes neural data. This is data generated by measuring the activity of a consumer’s central or peripheral nervous system that is not inferred from non-neural information.

Unique Identifiers

The CCPA defines a unique identifier or “unique personal identifier” as “a persistent identifier that can be used to recognize a consumer, a family, or a device that is linked to a consumer or family, over time and across different services.”

The law specifies that a family means a parent or guardian and any children under 18 years of age who are in their custody.

Examples of unique identifiers include:

• Device identifier
• IP address
• Cookies, beacons, pixel tags, mobile ad identifiers, or similar technology
• Customer number, unique pseudonym, or user alias

Consent

The law defines consent as “any freely given, specific, informed, and unambiguous indication of the consumer’s wishes by which the consumer, or the consumer’s legal guardian, a person who has power of attorney, or a person acting as a conservator for the consumer, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the consumer for a narrowly defined particular purpose.“

The following does not constitute valid consent under the CCPA:

• Acceptance of general or broad terms of use
• Acceptance of a similar data practice
• Hovering over, muting, pausing, or closing a piece of content
• Consent obtained through dark patterns

Sale of Data

The law defines sale as “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for monetary or other valuable consideration.”

The following activities are not considered to be sales under the CCPA:

• A consumer uses or directs the business to intentionally disclose or interact with third parties 
• The business uses or shares an identifier for the purpose of informing others that the consumer has opted out of the sale of or limited the use of their personal information
• The business transfers personal information to a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business

Who Must Comply With the California Consumer Privacy Act (CCPA)?

The CCPA applies to for-profit businesses that operate in California and collect the personal information of the state’s residents, if they meet any one of the following thresholds:

• More than USD 26,625,000 in annual gross revenue (as adjusted for inflation, with the next adjustment due January 2027)
• Buy, sell, or share personal information of 100,000 or more consumers or households
• Derive 50 percent or more of their annual revenue from the sale of California residents’ personal information

All companies that meet one of these thresholds must meet CCPA obligations if they are doing business with California residents, regardless of where in the world they are based. 

What Are Consumers’ Rights Under the California Consumer Privacy Act (CCPA)?

The CCPA grants consumers rights that enable them to protect their personal information and control how it’s used. Additional rights were added when the CPRA came into effect.

Right to Access

Personal information collected about the consumer, including information from before the 12 months preceding the request (back to January 1, 2022) if you retain it, as long as it’s possible or not unreasonably difficult to provide.

Right to Opt Out

Of the sharing and sale of personal information to third parties.

Right to Delete

Any personal data the business and third parties have about or from the consumer, with some exceptions.

Right to Portability

Obtain a copy of the consumer’s personal data that the consumer previously provided to the business, in a readily usable format, with some exceptions.

Right to Correction

Any inaccurate or outdated information the business maintains about the consumer.

Right to Restrict Sensitive Personal Information

To limit access to and use of data categorized as sensitive.

Right for Minors’ Personal Information Not to Be Shared or Sold Without Opt-In Consent

And for them not to be asked for consent within 12 months of declining a company’s consent request.

Right to Access Information About Automated Decision-Making

To request information about automated decision-making and the likely outcomes of using such processes, specifically with regard to profiling.

Right to Opt Out of ADMT

To opt out of ADMT used for significant decisions, unless an exception applies.

Right Not to Be Discriminated Against

Businesses cannot unlawfully discriminate against consumers, including for exercising their rights.

Obligations Under the California Consumer Privacy Act (CCPA) Rules

Businesses have specific CCPA obligations. These aim to protect California residents’ personal information with standards for transparency and accountability in data handling practices.

Notices Required Under the CCPA

The CCPA requires businesses to provide two distinct notices to consumers: a notice at collection and a privacy policy. You must display a notice at collection before you collect or use a California consumer’s personal information. This must clearly list all of the following, where relevant.

CCPA Notice at Collection Requirements

CATEGORIES OF PERSONAL INFORMATION

A list of the categories of personal information you collect, including categories of sensitive personal information, written so consumers can clearly understand what is collected.

PURPOSES

The purposes for which each category, including sensitive personal information, is collected and used.

SALE OR SHARING

Whether each category of personal information is sold or shared.

RETENTION PERIODS BY CATEGORY

The retention period for each category of personal information, or the criteria used to determine it.

OPT-OUT LINK

If you sell or share personal information, a link to your Notice of Right to Opt-out of Sale/Sharing, which is the “Do Not Sell or Share My Personal Information” link or the alternative opt-out link.

A LINK TO THE PRIVACY POLICY

The notice at collection must link to your privacy policy.

THIRD-PARTY COLLECTION

If a third party, such as an ad network, controls the collection of personal information on your site, both you and the third party must provide a notice at collection. You can provide a single combined notice.

Your notice at collection must link to your privacy policy. If you sell or share personal information, it must also link to the way consumers can opt out: either a link titled “Do Not Sell or Share My Personal Information” or a single alternative link titled “Your Privacy Choices” or “Your California Privacy Choices,” shown next to the opt-out icon. The alternative link also covers the right to limit the use of sensitive personal information. Either link must take consumers to a page where they can submit their request.

If you give your notice at collection as a link to your privacy policy, the link must go directly to the section that contains the required information.

Your notice at collection must also be easy to understand, written in plain language, readable on smaller screens, available in the languages in which you ordinarily give consumers in California contracts and other information, and reasonably accessible to consumers with disabilities, following generally recognized standards such as the Web Content Accessibility Guidelines (WCAG) 2.1.

CCPA Privacy Policy Requirements

A description of consumers’ privacy rights and how to exercise them.

Categories of personal information collected, sold, or shared in the preceding 12 months.

Categories of sources from which personal information is collected.

Business or commercial purpose for collecting, selling, or sharing personal information.

Categories of third parties to whom personal information is disclosed.

Categories of personal information disclosed to service providers and contractors for a business purpose in the preceding 12 months, or a statement that you made no such disclosures.

Links to any online request forms or portals you offer.

An explanation of how your business verifies requests.

A contact method for any questions or concerns.

The date you last updated your privacy policy.

Consent Requirements Under the CCPA

In most cases, the CCPA doesn’t require you to obtain opt-in consent from consumers to process their personal information, though they do have the right to opt out of specific uses at any time. California privacy laws operate on an opt-out model: you may process personal information without prior consent, but consumers can direct you to stop selling, sharing, or limiting use. 

There is an exception for personal information belonging to minors:

• Aged 13 to 15: You must obtain opt-in consent from a minor before selling or sharing their personal information
• Under 13: You must obtain opt-in consent from a parent or guardian before selling or sharing a minor’s personal information

Opt-Out Requests Under the CCPA

You must provide options for consumers to:

• Opt out of the sale or sharing of their personal information, including sharing for cross-context behavioral advertising
• Limit the use or disclosure of their sensitive personal information to what is necessary to provide the goods or services the consumer requested

The law mandates specific ways to provide consumers with opt-out options.

1. A clear and conspicuous link on your homepage titled “Do Not Sell or Share My Personal Information” that directs consumers to a page where they can opt out of the sale or sharing of their personal information.
2. A clear and conspicuous link titled “Limit the Use of My Sensitive Personal Information,” which enables consumers to control the use or disclosure of their sensitive personal information.

Alternatively, you can provide a single link reading “Your Privacy Choices” that combines both functions and enables consumers to opt out of the relevant uses and disclosures of their personal information.

You must also respect universal opt-out mechanisms, such as GPC signals, through which consumers can set their opt-out preferences once via their browsers, which are then communicated automatically across various websites and online services.

Since January 1, 2026, you must also give consumers a way to see that you processed their opt-out preference signal as a valid opt-out of sale and sharing. For example, your website can display a message such as “Opt-Out Request Honored” and show, through a toggle or similar control, that the consumer has opted out.

Under the California Opt Me Out Act (AB 566), effective January 1, 2027, browser developers must offer a setting that lets consumers send an opt-out preference signal (OOPS) to websites. Businesses must already honor these signals.

This Act, which supplements the CCPA, also requires browser developers to make clear to consumers how the opt-out preference signal works and the intended effect of the opt-out preference signal.

The California Delete Act also gives consumers a single place to act on data brokers. Through CalPrivacy’s Delete Request and Opt-out Platform (DROP), which launched on January 1, 2026, consumers can send one deletion request to all registered data brokers. Data brokers began processing those requests on August 1, 2026. DROP applies to registered data brokers.

Consumer Requests to Know, Correct, and Delete

As we mentioned above, consumers have the right to request information about the personal data collected about them, as well as to correct inaccuracies or to delete that data.

The law requires businesses to provide at least two designated methods for consumers to submit requests, like a toll-free number and a website form. A business that operates exclusively online and deals directly with consumers needs to provide only an email address, but any business with a website must also let consumers submit requests through it. You must confirm receipt within 10 business days and respond within 45 calendar days.

If you retain personal information for longer than 12 months, consumers can request access to information collected before that 12-month period, going back to January 1, 2022. You can let consumers specify a date range or offer an option to request all the personal information you have collected about them.

Businesses have 45 days from the date of the request to disclose the requested information, and they may seek an extension of an additional 45 days under certain circumstances.

Contracts Under the CCPA

Businesses that collect consumers’ personal information sometimes share this data with third parties, such as an advertising network or data analytics provider. The CCPA requires you to establish third-party agreements with the following requirements.

Third-Party Data Processing Agreement Requirements

The personal information is sold, shared, or disclosed only for limited and specific purposes.

The third party, service provider, or contractor must comply with the CCPA obligations applicable to them.

The third party, service provider, or contractor must provide the level of data privacy protection required by the law.

The business is entitled to take “reasonable and appropriate steps” to ensure that any third party, service provider, or contractor uses the personal information shared in a way that aligns with the business’s CCPA obligations.

The third party, service provider, or contractor must inform the business if it cannot meet its legal obligations.

The business has the right to take reasonable and appropriate steps to stop and remedy any unauthorized use of personal information, after providing notice.

Contracts with service providers and contractors must also prohibit them from:

• Selling or sharing personal information
• Retaining, using, or disclosing personal information for any purpose other than that specified in the contract
• Combining the personal information received from the business with personal information received by any other means, except for purposes exempted under the law

Data Security Under the CCPA

Under the CCPA, you must maintain reasonable security procedures to safeguard personal information from: 

• Unauthorized or illegal access
• Destruction
• Unauthorized use
• Modification
• Disclosure

Previously, businesses had more flexibility over how to handle safeguarding. If you meet the audit thresholds described above, the 2025 updates mean you must now have your cybersecurity program evaluated against specific standards and identify any weaknesses in your data protection practices.

Data Minimization Under the CCPA

Under the CCPA, businesses can collect, use, store, and share consumers’ personal information only to the extent needed to achieve the original purpose for collecting the information, or for another compatible purpose. The personal information must not be processed in ways that conflict with the original purposes.

This requirement is a key aspect of data minimization, which means that companies must limit their handling of personal data to what is essential for the intended purposes.

CalPrivacy’s Enforcement Advisory No. 2024-1 highlighted the principle of data minimization by advising that businesses should not require consumers to share additional information ‘beyond what is necessary.”

As part of your risk assessments, you must now provide clear reasons for processing the information you collect. This helps to prove you’re upholding the CCPA principle for data minimization.

Enforcement and Penalties Under the CCPA

The Attorney General and CalPrivacy are both responsible for enforcing California’s data privacy laws and applying CCPA penalties. However, CalPrivacy can’t limit the Attorney General’s authority and must halt proceedings when requested. 

Violations of the CCPA attract fines of up to:

• USD 2,663 per non-intentional violation
• USD 7,988 per intentional violation or violation involving consumers the business knows are under 16

Like the revenue threshold, fines are adjusted every two years for inflation, with the next adjustment due in January 2027.

Under the CCPA, consumers have a private right of action, meaning they can sue businesses in the event of a data breach involving certain categories of personal information.

They can do so only when the breach occurred because the business failed to implement reasonable security measures to protect the personal information, resulting in non-encrypted or non-redacted data being stolen.

In order for this condition to apply, the consumer’s first name (or first initial) and last name must have been stolen in combination with at least one of the following:

Social Security number

Driver’s license number, tax identification number, passport number, military identification number, or other unique identification number issued on a government document commonly used to identify a person’s identity

Financial account number, credit card number, or debit card number if combined with any required security code, access code, or password that would enable account access

Medical or health insurance information

Fingerprint, retina or iris image, or other unique biometric data used to identify a person’s identity (but not including photographs unless used or stored for facial recognition purposes)

Consumers must give businesses 30 days to cure the violation and provide written assurance that no further violations will occur before they can bring legal action against the business.

They can otherwise make a claim:

• To recover damages between USD 107 and USD 799 per incident, or actual damages suffered, whichever is greater
• For injunctive or declaratory relief

Like the revenue compliance threshold and fines, damages consumers can recover are also adjusted every two years for inflation.

If a consumer believes that their rights, other than those arising out of a data breach, have been violated, they may file a complaint with the Attorney General or CalPrivacy.

Recent CCPA Enforcement Actions

California regulators have focused much of their recent CCPA enforcement on opt-out mechanisms. The largest settlement to date addressed data minimization instead. Three actions from 2026 show the range.

General Motors (May 2026)

The California Attorney General announced a USD 12.75 million settlement with General Motors and OnStar over the alleged sale of drivers’ location and driving data to data brokers without adequate notice or consent. It is the largest CCPA penalty to date, subject to court approval, and the first to center on data minimization and purpose limitation.

Disney (February 2026)

The Attorney General announced a USD 2.75 million settlement over allegations that Disney’s opt-out methods did not fully stop the sale or sharing of consumers’ data across all devices and streaming services linked to their accounts.

PlayOn Sports (March 2026)

CalPrivacy announced a USD 1.1 million fine against PlayOn, whose ticketing platform is used by about 1,400 California schools. CalPrivacy alleged that PlayOn required visitors to accept tracking through a cookie banner before they could use their tickets or browse its sites, without offering an equivalent way to reject.

For a fuller list of actions since 2025, including what regulators expect from consent and opt-out interfaces, see our guide to California privacy law in 2026.

What Does the CCPA Mean for Your Business?

If your business meets one of the CCPA thresholds and has an online property, it must take several steps to meet its obligations. Here’s a quick CCPA compliance checklist to help.

CCPA Obligations

Your website must present visitors with a notice at collection that lists the categories and purposes of the personal data collected, whether personal information is sold or shared, and how long the business will retain the personal information.

You must provide a new notice at collection whenever you start to collect additional categories of personal information or intend to use the data for additional purposes.

Your website must include a privacy policy that informs consumers of their privacy rights and how to exercise them, as well as your privacy practices in more detail.

If you sell or share personal data, you must present a link titled “Do Not Sell or Share My Personal Information” to enable consumers to opt out of the sale of their personal data.

If you process sensitive data, you must include a link titled “Limit the Use of My Sensitive Personal Information” to enable consumers to limit the processing of this information to specific purposes.

If you sell or share personal information, you must treat opt-out preference signals, such as Global Privacy Control, as valid opt-out requests, and give visitors a way to see that you processed the signal.

For personal information of minors, you must obtain opt-in consent from the consumer (between 13 and 15 years) or their parent or guardian (when the minor is below 13 years) before their personal information can be shared or sold.

If you meet the cybersecurity audit thresholds, you must complete annual independent audits and submit a certification to CalPrivacy by the applicable deadline.

If you use ADMT to make significant decisions, you must give consumers a pre-use notice, let them opt out (or offer a human appeal where permitted), give them access to information about how the ADMT affected them, and complete a risk assessment before you start.

Usercentrics Supports CCPA Compliance

A CCPA compliance tool like Usercentrics CMP makes it easier to comply with the California privacy law’s requirements while building trust with consumers. 

The Usercentrics CMP provides geolocation functionality that detects when a California resident visits your site. It then displays the relevant banner and access to the privacy policy with clear links or buttons that enable visitors to manage their data processing preferences. 

Usercentrics does not provide legal advice, and information is provided for educational purposes only. We always recommend engaging qualified legal counsel or privacy specialists regarding data privacy and protection issues and operations.