CCPA Compliance for National Companies

· About CCPA Compliance for National Companies

Key Takeaways

  • The CCPA, as amended by the CPRA, applies to for-profit businesses doing business in California that meet the statutory thresholds and requires notice, consumer rights handling, and reasonable security practices.[2][6]
  • A company outside California can still be covered if it does business in California and meets the revenue, data-volume, or revenue-from-sales thresholds, so nationwide operations are not a safe harbor.[2]
  • California’s 2025 regulatory package on risk assessments, annual cybersecurity audits, and automated decisionmaking technology took effect on 1 January 2026, so many compliance programs must now include these operational controls.[6][14]
  • Civil penalties under the CCPA remain up to $2,500 per unintentional violation and up to $7,500 per intentional violation or violations involving consumers under 16, with inflation-adjusted amounts reflected in 2026 enforcement guidance and trackers.[3][9][12]
  • Consumers also have a private right of action for certain data breaches, with statutory damages of $100 to $750 per consumer per incident or actual damages, plus injunctive or declaratory relief.[2][9]
  • California regulators continued active enforcement in 2026, including major settlements and agency actions, making operational compliance more than a paper exercise.[11][2]

What It Is

The California Consumer Privacy Act (CCPA) is California’s comprehensive consumer privacy law for covered businesses, and the California Privacy Rights Act (CPRA) amended it through Proposition 24 to add stronger rights and the California Privacy Protection Agency (CPPA) as the dedicated regulator.[2][1] The California Attorney General and the CPPA both enforce the law, with the CPPA handling rulemaking and dedicated enforcement under the modernized regime.[2][1]

The CPRA changes began taking effect on 1 January 2023, and the CPPA later finalized additional regulations on cybersecurity audits, risk assessments, ADMT, insurance-company applicability, and related updates; those regulations were approved in September 2025 and became effective on 1 January 2026.[2][14][6]

For current compliance programs, the key dates are: CCPA effective 1 January 2020; CPRA amendment effective 1 January 2023; and the newest CPPA regulatory package effective 1 January 2026.[2][6][14]

Who Must Comply

The CCPA applies to a business that is for-profit, does business in California, collects consumers’ personal information, and meets at least one of the statutory thresholds: annual gross revenues over $25 million; buys, sells, or shares the personal information of 100,000 or more consumers or households; or derives 50% or more of annual revenues from selling or sharing consumers’ personal information.[2]

The law can reach companies headquartered outside California if they target California consumers, conduct business there, and meet one of the thresholds, so a national footprint can easily create CCPA coverage.[2]

Certain information and entities are exempt or partially exempt, including data already governed by some sectoral federal laws and narrower categories of information subject to specific statutory carve-outs, but exemptions are limited and fact-specific.[2] The 2025 CPPA regulations also clarified when insurance companies must comply, confirming that the law’s reach is not limited to non-regulated consumer internet businesses.[6][14]

Core Requirements

  1. Provide clear notice at collection. Covered businesses must tell California residents what categories of personal information they collect and the purposes for which they use it, at or before collection.[2]
  1. Maintain and disclose privacy-policy rights. Privacy notices must explain consumers’ rights, the categories of information collected, used, disclosed, sold, or shared, retention practices, and how to submit verified requests.[2]
  1. Honor consumer rights requests. Businesses must offer mechanisms to access, delete, correct, and opt out of the sale or sharing of personal information, and must process verified requests within statutory timelines.[2]
  1. Respect sensitive personal information controls. Consumers have the right to limit use and disclosure of sensitive personal information beyond what is necessary to perform specified business purposes.[2]
  1. Implement contractual and downstream controls. Businesses that disclose personal information to service providers, contractors, or third parties must use compliant contracts and limit downstream use to authorized purposes.[2]
  1. Conduct risk assessments and cybersecurity audits where required. The 2026-effective CPPA rules require qualifying businesses to conduct documented risk assessments and annual cybersecurity audits under the circumstances specified in the regulations.[6][14]
  1. Govern automated decisionmaking. The 2026-effective regulations also implement consumer access and opt-out rights for certain automated decisionmaking technology (ADMT) uses.[6][14]

Deadlines and Penalties

| Milestone | Date | What applies | |---|---:|---| | CCPA becomes operative | 1 January 2020 | Core consumer privacy rights and business obligations begin.[2] | | CPRA amendments take effect | 1 January 2023 | Expanded rights, CPPA authority, and updated statutory framework begin.[2] | | CPPA regulatory package approved | 23 September 2025 | New rules on audits, risk assessments, ADMT, and insurance-company scope are finalized.[14][6] | | New regulations become effective | 1 January 2026 | Covered businesses must implement the new CPPA requirements.[6][14] |

Maximum civil penalties are $2,500 per unintentional violation and $7,500 per intentional violation or any violation involving a consumer under 16.[2][9][12] California also allows $100 to $750 per consumer per incident in private breach actions, or actual damages if higher, along with injunctive or declaratory relief.[2][9]

Other sanctions include injunctions, investigative demands, consent decrees, and reputational harm from public enforcement actions; California regulators continued to announce significant 2026 settlements and actions, underscoring active enforcement.[11][2]

How to Comply

  1. Map data and thresholds. Confirm whether the business is “doing business in California,” whether it crosses the revenue or data-volume thresholds, and whether affiliates or service relationships create shared compliance exposure.[2]
  1. Build a rights-request operating model. Set up intake, identity verification, tracking, legal review, response letters, and appeal handling for access, deletion, correction, and opt-out requests.[2]
  1. Refresh notices and contracts. Align privacy notices, cookies and tracking disclosures, and vendor contracts with CCPA/CPRA requirements, including limits on secondary use and onward disclosure.[2]
  1. Run a data minimization and retention review. Reduce collection to what is necessary, define retention periods, and document deletion workflows so disclosures match actual practices.[2]
  1. Implement security controls aligned to ISO 27001 and NIST CSF 2.0. Use ISO 27001 for the ISMS backbone, and map controls to NIST CSF 2.0 functions for governance, identify, protect, detect, respond, and recover; this is especially relevant given the CCPA’s breach-risk and audit expectations.[6][9]
  1. Stand up risk assessments and annual audits. For in-scope processing, document privacy risk assessments and commission annual cybersecurity audits that are scoped, independent, and retained for regulator review as required by the 2026 rules.[6][14]
  1. Govern AI and ADMT uses with ISO 42001. Use ISO 42001 to structure inventory, impact assessment, accountability, and human oversight for automated decisionmaking uses that may trigger opt-out or notice obligations under California’s 2026 regulations.[6][14]
  1. Test incident response and breach notification. Integrate CCPA obligations with state breach-notification workflows so consumer harm, privilege review, timing, and remediation are handled consistently.[2][9]

Related Regulations

The California Privacy Rights Act (CPRA) is the direct amendment to the CCPA and is the main reason the law now includes the CPPA, sensitive-data limits, and expanded consumer rights.[2][1]

The EU GDPR overlaps on notice, access, deletion, data minimization, and security, but differs on lawful bases, controller/processor structure, and extraterritorial scope.[2]

The Virginia Consumer Data Protection Act (VCDPA) and similar state privacy laws resemble the CCPA on consumer rights and opt-outs, but their thresholds, exemptions, and enforcement structures differ.[2]

The California breach-notification law can apply alongside the CCPA when the incident involves unauthorized access to personal information, creating parallel notification and remediation duties.[2][9]

The FTC Act Section 5 can overlap where privacy representations or security practices are deceptive or unfair, so CCPA compliance does not eliminate federal consumer-protection exposure.[2]

FAQ

Does CCPA apply to companies outside California?

Yes, if a company does business in California and meets one of the statutory thresholds, it can be covered even when headquartered elsewhere.[2] National companies often fall in scope because California residency, California customers, or California-targeted commerce can satisfy the jurisdictional link.

Does every company with California customers have to comply?

No. The law applies only to covered businesses that meet at least one threshold tied to revenue, volume of consumers/households, or revenue from sale or sharing of personal information.[2] Smaller businesses below those thresholds are generally outside the statute unless another rule creates coverage.

What are the main consumer rights under CCPA?

Covered businesses must support access, deletion, correction, and opt-out rights, and they must also give consumers control over certain uses of sensitive personal information.[2] The business must disclose how to submit requests and respond within the law’s procedural framework.

What changed in 2026?

The biggest compliance change in 2026 was the effective date for the CPPA’s regulations on risk assessments, annual cybersecurity audits, and ADMT, plus clarifications for insurance companies.[6][14] These rules add operational obligations beyond privacy notices and request handling.

What are the penalties for noncompliance?

California can seek civil penalties of $2,500 per unintentional violation and $7,500 per intentional violation or violations involving consumers under 16.[2][9][12] Consumers may also sue for certain data breaches and recover statutory damages of $100 to $750 per consumer per incident or actual damages.[2][9]

Is there a grace period or delay for the 2026 rules?

The latest regulatory package was approved in September 2025 and took effect on 1 January 2026; no general delay is reflected in the official CPPA materials cited here.[6][14] Any business seeking more time would need to identify a specific statutory exemption or narrow applicability argument rather than rely on a blanket postponement.

Sources

Put it into practice

More compliance guides