California Consumer Privacy Act (CCPA)

The California Consumer Privacy Act (CCPA) gives residents of California the right to know what personal data is being collected about them, to whom it is being sold or disclosed, and the ability to access, delete, and opt out of the sale of their data.

JurisdictionCalifornia
CategoryPrivacy & Data Protection
StatusActive
Effective date
Latest development
Enforcement actions on record4

Analysis

California Consumer Privacy Act (CCPA) Analysis

1. Key Requirements

The California Consumer Privacy Act (CCPA) outlines specific requirements for companies that correlate with consumer rights over their personal data. These core requirements are as follows:

  • Right to Disclosure: If you collect information about a consumer protected by the CCPA, then you must inform the consumer of your intentions at or before the point of data collection.[1]
  • Right to Access: Consumers have the right to request you provide them with the information in a readily usable format. This must be free of charge and provided within 45 days from the request. Individuals must also have clear and easy access to your full privacy policy.[1]
  • Right to Contact Information: You’re required to inform consumers where they can find more information about your privacy policy and CCPA compliance efforts. You also need to provide a toll-free telephone number and online contact details should they decide to contact you to exercise any CCPA-related rights.[1]
  • Right to be Forgotten: If a consumer requests that you delete any personal data and information, you’re legally mandated to do so under the CCPA. There are very narrow exceptions in cases where you need the information to fulfill some form of superseding legal obligation.[1]
  • Opt-out of Data Sales and Marketing: If you do sell visitors’ personal information, you must give consumers the opportunity to opt-out of this transaction. You’re required to have a web page that clearly presents an opt-out option, preferably with a link to your privacy policy page. They must also be able to opt-out of data usage for future marketing efforts.[1]
  • Right to Fair Treatment: In no way, shape, or form can you discriminate or treat users differently based on whether or not they exercise their CCPA rights. You must provide the same level of access and service to all consumers regardless of which rights they exercise.[1]
  • Periodic Privacy Policy Updates: You must update your privacy policy every 12 months. That way, customers know if you’re now collecting, selling, processing, or otherwise handling data differently than before. Or if you’re gathering more information than previously stated.[1]

2. Common Compliance Challenges

Compliance with data privacy laws like GDPR and CCPA poses substantial challenges for businesses globally. Some common challenges include:

  • Understanding Complex Data Protection Law Requirements: Businesses often struggle to interpret these regulations accurately, leading to compliance gaps and potential penalties.[2]
  • Data Mapping & Inventory: Identifying and cataloging personal data across systems and processes can be a daunting task. Many businesses find it challenging to create a comprehensive data inventory, especially in large organizations with disparate data sources.[2]
  • Implementing Data Rights Protocols: The new consumer data rights set forth by CCPA should be central to your compliance efforts. Therefore, you need processes and protocols in place if and when consumers decide to exercise any of those rights.[1]

3. Best Practices for Implementation

Achieving CCPA compliance involves a combination of understanding the act’s requirements and then implementing best practices that ensure ongoing adherence. Here are some best practices:

  • Understand the Scope of the CCPA: Ensure you comprehend all aspects of the CCPA to avoid any compliance gaps.[3]
  • Update Privacy Policies: Review and update your privacy policy to address all new rights as outlined under the CCPA, and inform consumers in more detail at the point of data collection about how their data can and will be used.[1]
  • Implement Systems for Handling Consumer Requests: Have processes and protocols in place for handling consumer requests, such as those related to data deletion or access.[1]
  • Offer Clear Opt-out Opportunities: Provide a clear and easily accessible opt-out option for consumers who wish to opt-out of data sales and marketing efforts.[1]
  • Review Vendor Agreements: Ensure that all vendor agreements comply with CCPA requirements, especially regarding data handling and sharing.[3]
  • Protect Minor’s Data: Implement additional safeguards to protect the personal data of minors, as required by the CCPA.[3]
  • Strengthen Data Security Practices: Enhance data security practices to protect consumer data from unauthorized access or breaches.[3]
  • Train Employees: Conduct regular training sessions for employees to ensure they understand their roles in maintaining CCPA compliance.[3]
  • Monitor Regulatory Updates: Stay updated with any changes or amendments to the CCPA to ensure ongoing compliance.[3]
  • Seek Legal Counsel: Consult with legal experts to ensure that your compliance efforts are accurate and comprehensive.[3]

4. Recent Updates or Changes

The CCPA has undergone several updates and changes since its inception. Some notable changes include:

  • Request for Deletion Revisions: Previously, businesses were required to indicate which method of deletion was performed (deleted, de-identified, or aggregated). This requirement has been removed, and

Recent developments

  • — New CCPA/CPRA regulations took effect, expanding compliance obligations for covered businesses. Key changes include requirements around ADMT, risk assessments, cybersecurity audits, and response procedures for consumer requests. (source)
  • — Industry guidance described the 2026 CCPA changes as materially increasing obligations for data access, consent, and automated decision-making. The article highlights operational impacts for businesses that collect minors’ data or use AI-driven systems. (source)
  • — Businesses began facing new procedural deadlines such as confirmation of consumer requests within 10 business days and general response deadlines of 45 days. The guidance also notes that the 2025 ADMT rules require clearer notices, opt-out rights, and more detailed disclosures. (source)
  • — The California Attorney General’s CCPA page continues to describe consumer rights including access, deletion, opt-out of sale or sharing, correction, and limits on sensitive personal information. It also notes that the CPPA’s updated regulations are in effect and that consumers can file complaints for certain violations occurring on or after July 1, 2023. (source)
  • — The CPPA announced 2025 increases for CCPA fines and penalties. This signals stronger enforcement pressure for businesses subject to California privacy law. (source)
  • — The CPPA announced finalized regulations strengthening consumer privacy protections under the CCPA/CPRA, with new requirements taking effect in 2026. The update focuses on risk assessments, automated decision-making technology (ADMT), and related compliance deadlines. (source)
  • — The CPPA confirmed the regulations were approved by the Office of Administrative Law and filed with the Secretary of State. This made the 2025 updates effective January 1, 2026. (source)
  • — The CPPA Board adopted regulations updating CCPA rules, including requirements for risk assessments, annual cybersecurity audits, and consumer rights related to ADMT. The agency said the rulemaking was complete after OAL approval and filing in September 2025. (source)
  • — The CPPA announced additional data broker settlements. The enforcement activity underscored the agency’s continuing focus on compliance in the data-broker sector. (source)
  • — The CPPA opened a formal public comment period for draft ADMT regulations. This was part of the lead-up to the finalized 2025 rules governing automated decision-making. (source)

Enforcement actions

DateAuthorityEntityFineSummary
California Privacy Protection AgencyPlayOn Sports (GoFan)1,100,000 USDFirst student-data enforcement action: tracking and selling student, parent and school data without honouring opt-outs. (source)
California Attorney General and CPPAGeneral Motors (OnStar)12,750,000 USDLargest CCPA penalty to date: sale of drivers' geolocation and driving-behaviour data to data brokers without notice or opt-out. (source)
California Privacy Protection AgencyHonda Motor Co632,500 USDCharged consumers to exercise privacy rights, failed to process opt-out requests. (source)
California AGSephora Inc1,200,000 USDFailed to disclose sale of consumer data and honour opt-out requests via GPC signals. (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates