California
California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA)
- Effective date
- January 1, 2020
- Enacted
- June 28, 2018
- Enforcement
- California Privacy Protection Agency and California Attorney General
- Last reviewed
- October 3, 2026
Overview
At a Glance
Effective Date
January 1, 2020
Enforcement Authority
California Privacy Protection Agency and California Attorney General
Consumer Request Deadline
45 days generally; 45-day extension may apply. Sale/share opt-out requests have separate timing rules.
Cure Period
No general mandatory fixed cure period; cure is discretionary in enforcement.
No automatic cure period; regulators have discretion.
Universal Opt-Out / GPC
Yes
Private Right of Action
Yes
Limited to certain data breaches
Sensitive Data Consent
No
Notice and opt-out model
Appeals Process
No
Applicability
Who Does This Law Apply To?
Applies to qualifying for-profit businesses doing business in California that meet revenue, volume, or sale/share revenue tests.
General Coverage Thresholds
- Annual revenue
- Gross annual revenue over $25 million (inflation-adjusted, currently about $26.6M)
- Consumer volume
- Buys, sells or shares personal information of 100,000+ consumers or households
- Data sales
- Derives 50% or more of annual revenue from selling or sharing personal information
- Business nexus
- Does business in California
Rights
Consumer Rights
Right to Opt Out of Sale
Opt out of sale or sharing of personal information under the CCPA/CPRA.
Right to Access
Confirm processing and access covered personal data, subject to statutory limits.
Right to Delete
Request deletion of covered personal data, subject to exceptions.
Right to Opt Out of ProfilingConditional
Automated decisionmaking technology rights are subject to California regulations and phased compliance requirements.
Right to Correct
Request correction of inaccuracies in covered personal data.
Right to Data Portability
Obtain covered personal data in a portable format where the statute provides.
Right to Opt Out of Targeted Advertising
California regulates cross-context behavioral advertising through the right to opt out of sale/sharing.
Obligations
Business Obligations
- AppealsNot requiredNo general internal appeal process required by this omnibus law.
- Data securityRequiredMaintain reasonable administrative, technical, and physical safeguards as required by the statute.
- Privacy noticeRequiredProvide required privacy disclosures/notices.
- Sensitive dataState-specificConsumers have a right to limit certain uses/disclosures of sensitive personal information; the regime is not a general opt-in-consent model for all sensitive data.
- Data minimizationRequired / state-specificLimit or govern collection/use consistent with the statute's duties and disclosed purposes.
- Universal opt outRequiredHonor qualifying opt-out preference signals/universal mechanisms.
- Processor contractsRequiredUse contracts governing processors/service providers as required.
- Consumer request processRequiredProvide methods for consumers to exercise statutory rights.
- Data protection assessmentRequiredConduct assessments for specified higher-risk processing.
Private right of action is limited; do not describe it as a general private enforcement right.
Exemptions
Common Exemptions
Exemptions are state-specific and may apply at the entity level, data level, or both. Verify the official statute before relying on an exemption. Treatment commonly varies for government, regulated financial/health information, higher education, nonprofits, employment data, and B2B data. California's treatment of employee and B2B personal information differs from the common carveouts in many Virginia-model laws.
This list is not exhaustive.
Enforcement
Enforcement & Penalties
Authority: California Privacy Protection Agency and California Attorney General
Administrative/civil penalties can apply; CCPA also includes a limited private right of action for specified data-security breaches.
Self-check
Could This Law Apply to My Business?
Your result
Answer the 4 questions to see a general, educational indication.
Sources
Sources & Verification
- View source
California Consumer Privacy Act, as amended by the California Privacy Rights Act (statute)
State legislature
- View source
Attorney General guidance
State Attorney General
- View source
iapp.org
Secondary reference
- View source
ncsl.org
Secondary reference
- View source
privacylawnetwork.com
Secondary reference
- View source
ketch.com
Secondary reference
Last reviewed: October 3, 2026· Verified against official sources
From understanding to action
Digital Data Rights helps you understand the privacy landscape.
DataRightsOS helps businesses put privacy processes into operation.
Educational information only, not legal advice. Summaries may omit details; verify against the statute, regulations and official guidance.