Comprehensive state privacy law
California privacy law
California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act, Proposition 24)
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
- Citation
- Cal. Civ. Code §§ 1798.100 to 1798.199.100; Cal. Code Regs. tit. 11, § 7000 et seq.
- Official text
- https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.
- In force
- January 1, 2020
- Effective dates
- January 1, 2020: CCPA operative (Cal. Civ. Code § 1798.198(a))
- January 1, 2023: CPRA amendments in effect; employee and business-to-business exemptions expired (§ 1798.145(m)(4), (n)(3))
- July 1, 2023: civil and administrative enforcement of the CPRA amendments begins, for violations on or after that date (§ 1798.185(d))
- January 1, 2026: CPPA regulations on CCPA updates, cybersecurity audits, risk assessments, ADMT and insurance in effect (Cal. Code Regs. tit. 11); risk assessment duty applies to new processing
- January 1, 2027: ADMT rules apply to businesses using ADMT for significant decisions (tit. 11, § 7200(b)); browsers must offer an opt-out preference signal (§ 1798.136(f)); SB 923 (2026) deletion and request-method changes take effect
- December 31, 2027: deadline to complete risk assessments for processing that began before 2026-01-01 and continues (tit. 11, § 7155(b))
- April 1, 2028: first risk assessment submissions to the CPPA (assessments from 2026 and 2027) (tit. 11, § 7157(a)(1)); first cybersecurity audit reports for businesses with 2026 revenue over $100 million (tit. 11, § 7121(a)(1))
- April 1, 2029: first cybersecurity audit reports for businesses with 2027 revenue of $50 million to $100 million (tit. 11, § 7121(a)(2))
- April 1, 2030: first cybersecurity audit reports for businesses with 2028 revenue under $50 million (tit. 11, § 7121(a)(3))
- Enforcer
- California Privacy Protection Agency (administrative) and Attorney General (civil)
- Private right of action
- Yes. Limited to data breaches caused by a failure to maintain reasonable security (§ 1798.150); no private action for other CCPA violations (§ 1798.150(c)).
- Cure period
- No right to cure for CPPA or AG enforcement; the CPPA may, at its discretion, give a business time to cure. A 30-day notice and cure applies only before a consumer sues for statutory damages under the breach action (§ 1798.150(b)). (§ 1798.199.45(a))
- Rulemaking
- Yes, California Privacy Protection Agency. Regulations at Cal. Code Regs. tit. 11, § 7000 et seq.; latest package effective 2026-01-01. Rules
Amendments
- AB 137 (2025), budget trailer bill. Reworked the Consumer Privacy Fund: 95 percent of administrative fines and settlements goes to the CPPA's subfund and 5 percent to a grant subfund (reflected in § 1798.155(b) of the CPPA's consolidated text effective 2026-01-01).
- AB 566 (2025), California Opt Me Out Act, signed 2025-10-08 (in force January 1, 2027). Adds § 1798.136: a business that develops or maintains a browser must include an easy-to-find setting that sends an opt-out preference signal, and explain how it works; browser makers are not liable for violations by businesses that receive the signal.
- SB 923 (2026), Expanding Privacy Rights Act, signed 2026-09-27 (in force January 1, 2027). Extends the right to delete to personal information a business obtained about the consumer from third parties (with a suppression list allowed so deleted data stays deleted), and requires online-only businesses to offer an online request method such as a webform in addition to email.
- CPPA regulations: CCPA updates, cybersecurity audits, risk assessments, ADMT and insurance (approved by OAL September 2025) (in force January 1, 2026). New Articles on cybersecurity audits (§§ 7120 to 7124), risk assessments (§§ 7150 to 7157), ADMT pre-use notice, opt-out and access (§§ 7200 to 7222) and insurance companies (§§ 7270 to 7271), with phased compliance dates.
Pending
- CPPA preliminary rulemaking: opt-out preference signals, reducing friction in exercising rights, employee data, notices and disclosures. Pre-rulemaking comment periods closed April to May 2026; no proposed text published as of 2026-10-28.
- CCPA monetary thresholds, inflation adjustment due 2027-01-01. § 1798.199.95(d) requires the CPPA to adjust the revenue threshold, fines, penalties and breach damages on January 1 of each odd-numbered year; the 2027 figures were not published as of 2026-10-28.
Topics
- ApplicabilityThe CCPA applies to for-profit businesses that do business in California, decide why and how consumers' personal information is processed, and meet one of three tests: annual gross revenue above an inflation-adjusted threshold ($26,625,000 since 2025-01-01), buying, selling or sharing the personal information of 100,000 or more consumers or households, or earning half or more of revenue from selling or sharing personal information. Unlike most state laws, it protects California residents in every role, including employees, job applicants and business contacts, because those exemptions expired on 2023-01-01. Financial and health exemptions are data-level: information covered by the GLBA or HIPAA is excluded, but the business itself remains covered for its other data.
- Consumer rightsConsumers may know and access their personal information, delete it, correct it, opt out of its sale or sharing (sharing means cross-context behavioral advertising), and limit the use of sensitive personal information. Businesses must answer requests to know, delete and correct within 45 days, extendable once by 45 days with notice. There is no statutory appeal process, unlike most other states. From 2027-01-01 the regulations add rights to opt out of, and access information about, automated decisionmaking technology used for significant decisions, and SB 923 extends deletion to data obtained from third parties.
- Sensitive dataCalifornia uses a 'limit' model rather than opt-in consent: consumers may direct a business to limit its use of sensitive personal information to what is necessary to provide the goods or services they expect. Sensitive personal information covers government identifiers, account log-ins, precise geolocation, racial or ethnic origin, citizenship or immigration status, religious beliefs, union membership, message contents, genetic data, neural data, biometric identification, health, and sex life or sexual orientation. For minors, a business may not sell or share personal information of a consumer it knows is under 16 without opt-in authorization (from the consumer if 13 to 15, from a parent if under 13).
- Controller dutiesBusinesses must give a notice at collection and a privacy policy, keep collection and use reasonably necessary and proportionate, set retention periods, and keep reasonable security. Businesses that sell or share must honor opt-out preference signals such as Global Privacy Control under the regulations, and from 2027-01-01 browser makers must build such a signal in. Under the regulations in effect from 2026-01-01, businesses whose processing presents significant risk must conduct risk assessments (submissions to the CPPA from 2028-04-01) and, if they meet the security-risk tests, annual cybersecurity audits phased in by revenue from 2028 to 2030.
- ProcessorsCalifornia calls processors 'service providers' and 'contractors'. A business that discloses personal information to a service provider or contractor, or sells or shares it with a third party, must have a written agreement limiting use to specified purposes, requiring CCPA-level protection and allowing the business to stop unauthorized use. Without a compliant contract, the recipient is not a service provider or contractor and the disclosure may be a sale or sharing.
- EnforcementThe CPPA enforces through administrative proceedings and fines, and the Attorney General through civil actions; both amounts are adjusted for inflation every odd-numbered year. Since 2025-01-01 the maximum is $2,663 per violation, or $7,988 per intentional violation or violation involving consumers known to be under 16. There is no right to cure, although the CPPA may allow time to cure at its discretion. Consumers may sue only over certain data breaches, for $107 to $799 per consumer per incident or actual damages.
Sources
- CCPA statute text effective 2026-01-01 (AB 137, AB 566 update), consolidated by the CPPA
- Cal. Civ. Code, Title 1.81.5 (official code site; blocked automated reading on 2026-10-28)
- CPPA, Updated monetary thresholds in the CCPA (effective 2025-01-01)
- CPPA, CCPA Updates, Cyber, Risk, ADMT and Insurance regulations: approved text
- CPPA, rulemaking page for the 2025 regulations package
- CPPA announcement, 2025-09-23: regulations approved, effective 2026-01-01
- CPPA, CCPA regulations consolidated text effective 2026-01-01
- CPPA, Law and regulations index
- CPPA FAQ
- CPPA announcement, 2025-10-08: Governor signs AB 566
- CPPA (privacy.ca.gov), 2026-09-27: Governor signs SB 923
- Office of the Governor, legislative update 2026-09-27 (AB 1542 vetoed)
- Office of the Attorney General, CCPA page
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the California statute
Reference material, not legal advice.