California Consumer Privacy Act (CCPA) - Compliance Guide

· About California Consumer Privacy Act (CCPA)

Key Takeaways

  • The California Consumer Privacy Act (CCPA), as amended by the CPRA and later regulations, applies to covered businesses handling California residents’ personal information and is enforced by the California Privacy Protection Agency (CPPA) and the California Attorney General.[1][3][8]
  • For 2026, the operative CCPA regulations include a new package approved in September 2025 and effective 1 January 2026, covering privacy risk assessments, cybersecurity audits, automated decisionmaking technology (ADMT), and updates to existing rules.[8][11]
  • A business generally falls under the CCPA if it meets the statutory threshold tests, including annual gross revenue of at least $26.625 million for 2025 threshold adjustments, or other statutory volume/data-sharing tests.[9]
  • The CCPA gives California consumers rights to know, access, delete, correct, opt out of sale/share, and in some cases limit use/disclosure of sensitive personal information, with additional ADMT-related rights effective in 2026.[7][11]
  • Noncompliance can trigger civil penalties of up to $2,663 per violation or $7,988 per intentional violation or violations involving children under 16, plus private statutory damages of $107 to $799 per consumer per incident for certain security breaches.[6][9]
  • New 2026 cybersecurity-audit obligations phase in over time, with the first audit deadlines tied to revenue and due dates beginning in 2027 for the largest businesses.[11][14]

What It Is

The CCPA is California’s comprehensive consumer privacy law, originally enacted in 2018 and later expanded by the California Privacy Rights Act (CPRA) and implementing regulations. It regulates how businesses collect, use, disclose, sell, and share California residents’ personal information, and it is enforced primarily by the CPPA and, in some contexts, the California Attorney General.[1][3][8]

The current regulatory framework matters because the CPPA finalized a second major package of regulations in 2025, and the agency states those rules became effective 1 January 2026.[8][11] Those rules address ADMT, privacy risk assessments, cybersecurity audits, and updates to existing CCPA compliance obligations.[8][11]

For core statute timing, the CCPA was adopted in 2018, became operative on 1 January 2020, and has since been amended repeatedly through legislation and regulations.[3][7] The current 2026-effective regulatory package is the most important recent phase-in for compliance programs.[8][11]

Who Must Comply

The CCPA applies to businesses that collect personal information of California residents and meet one or more statutory thresholds, including revenue, data-volume, or revenue-from-sharing tests.[3][9] The threshold figures are adjusted annually; for 2025 the gross-revenue threshold is $26,625,000.[9]

The law has extraterritorial reach: it can apply to companies outside California, and even outside the United States, if they do business in California and meet the statutory tests.[3][7] That makes California nexus and data-processing footprint more important than headquarters location.

There are statutory exclusions and sectoral carve-outs, but they are narrow and depend on the entity and data type. The CPPA’s 2026 materials also clarify when insurance companies must comply with the CCPA, indicating that prior ambiguity has been narrowed rather than removed.[8][12]

Core Requirements

  1. Notice and transparency: Businesses must tell consumers what categories of personal information they collect, why they collect it, whether they sell or share it, and how long they retain it or the criteria used to determine retention.[3][7][11]
  2. Consumer rights handling: Businesses must provide mechanisms for consumers to exercise rights to know, access, delete, correct, and opt out of sale/share, and must respond within the statutory timelines.[3][7]
  3. Sensitive personal information controls: Businesses must honor consumer limits on the use and disclosure of sensitive personal information where the law applies, and must disclose the relevant categories and purposes.[3][7]
  4. Contracting and downstream governance: Businesses using service providers, contractors, and third parties must maintain required contractual controls over the use, retention, and disclosure of personal information.[3][7]
  5. Risk assessments: For covered processing activities, the 2026 regulations require privacy risk assessments that evaluate benefits, harms, mitigations, and the nature of the data processing.[8][11]
  6. Cybersecurity audits: Certain businesses must complete annual cybersecurity audits under the 2026 regulations, with obligations phased in based on company size and timing.[8][11][14]
  7. ADMT governance: The 2026 regulations add consumer rights and business obligations around automated decisionmaking technology, including access and opt-out-related requirements.[8][11]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | CPPA 2026 regulations effective | 1 January 2026 | Risk assessments, cybersecurity audits, ADMT, and updates to existing CCPA regulations apply.[8][11] | | Threshold-adjusted business revenue test | 2025 amount | Annual gross revenue threshold for coverage is $26,625,000 for the adjusted year referenced by the CPPA.[9] | | Largest-business cybersecurity audit phase-in | Beginning in 2027 | First annual audits begin phasing in for covered businesses based on revenue and the CPPA’s staggered schedule.[11][14] |

The maximum civil penalties are up to $2,663 per violation and up to $7,988 per intentional violation or violations involving consumers under 16, based on the CPPA’s 2025 adjustment notice.[6][9] For private lawsuits involving certain security breaches, consumers may recover statutory damages of not less than $107 and not more than $799 per consumer per incident, or actual damages, whichever is greater.[6][9]

Other sanctions include injunctive relief, regulatory investigation, and corrective orders, plus reputational and contractual exposure from downstream partners and procurement reviews.[3][7] The financial risk can scale quickly because California penalties are assessed per violation, not per matter.

How to Comply

  1. Map data and purposes: Build a data inventory covering collection points, categories, retention periods, disclosure recipients, and whether data is sold or shared.
  2. Classify CCPA applicability: Test revenue, volume, and data-sharing thresholds annually, and document whether the entity qualifies as a business, service provider, contractor, or third party.
  3. Refresh consumer rights workflows: Ensure intake, identity verification, suppression, deletion, correction, and opt-out workflows meet statutory timelines and are reachable through web and non-web channels.
  4. Write a defensible retention schedule: Align retention with business needs, legal holds, and disclosed retention periods; this is especially important because notice must describe retention criteria.
  5. Implement risk assessments and audit readiness: Use NIST CSF 2.0 for governance and control mapping, ISO 27001 for security management, and ISO 42001 where ADMT governance overlaps with AI management and documentation.
  6. Strengthen vendor contracts: Update service-provider and contractor agreements to restrict secondary use, require assistance with rights requests, and impose security obligations.
  7. Prepare for cybersecurity audits: Identify scope early, close evidence gaps, and assign control owners well before the first phased audit deadline in 2027.
  8. Track regulatory updates: Monitor CPPA rulemaking and annual threshold adjustments, because California privacy obligations continue to evolve and the 2026 package is not the endpoint.[6][8][9][11]

Related Regulations

  • California Invasion of Privacy Act (CIPA) overlaps on tracking, recording, and interception risks, and some privacy class actions plead both statutes together.
  • EU GDPR is similar on transparency, rights handling, and governance, but the CCPA differs on sale/share opt-outs and California-specific enforcement mechanics.
  • Virginia CDPA overlaps on notice, consumer rights, and sensitive data controls, but California is generally broader and more prescriptive on regulatory detail.
  • Colorado Privacy Act overlaps on universal opt-out and data protection assessments, and its AI-related obligations can create parallel compliance tasks for multistate businesses.
  • California breach-notification law interacts with the CCPA because a security incident can trigger both privacy-law exposure and breach-notice duties.

FAQ

Does the CCPA apply to companies outside California?

Yes. The CCPA can apply to entities outside California if they do business in California and meet the statutory thresholds.[3][7] Headquarters location does not control applicability; the key questions are California nexus, scale, and data practices.

Do small businesses have to comply with the CCPA?

Not every small business is covered. The statutory thresholds include revenue and operational volume tests, and the CPPA’s adjusted revenue benchmark for 2025 is $26,625,000.[9] A business below those thresholds may still need to comply if it meets another coverage test or falls within a specific regulated structure.

What changed in 2026?

The CPPA’s newly approved regulations took effect on 1 January 2026 and added or clarified requirements for ADMT, risk assessments, cybersecurity audits, and certain insurance-company issues.[8][11] Those changes do not replace the CCPA; they operationalize and expand it.

What are the biggest penalties under the CCPA?

Civil penalties can reach $2,663 per violation and $7,988 per intentional violation or violations involving children under 16.[6][9] In security-breach cases, private plaintiffs may seek statutory damages of $107 to $799 per consumer per incident, or actual damages if higher.[6][9]

Does the CCPA require cybersecurity audits?

Yes, for certain covered businesses under the 2026 regulations.[8][11] The audit obligation is phased in, with the earliest deadlines beginning in 2027 for the largest covered entities.[11][14]

Sources

Put it into practice

More compliance guides