DPO SchoolDPO School

California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act, Proposition 24)

California privacy law (CCPA): controller duties

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Businesses must give a notice at collection and a privacy policy, keep collection and use reasonably necessary and proportionate, set retention periods, and keep reasonable security. Businesses that sell or share must honor opt-out preference signals such as Global Privacy Control under the regulations, and from 2027-01-01 browser makers must build such a signal in. Under the regulations in effect from 2026-01-01, businesses whose processing presents significant risk must conduct risk assessments (submissions to the CPPA from 2028-04-01) and, if they meet the security-risk tests, annual cybersecurity audits phased in by revenue from 2028 to 2030.

Key points

  1. Notice at or before collection: categories, purposes, whether sold or shared, and retention period for each category.

    Section: Cal. Civ. Code § 1798.100(a)

  2. Data minimisation: collection, use, retention and sharing must be reasonably necessary and proportionate to the disclosed purposes.

    Section: Cal. Civ. Code § 1798.100(c)

  3. Privacy policy updated at least every 12 months, describing rights and request methods.

    Section: Cal. Civ. Code § 1798.130(a)(5)

  4. Opt-out preference signals must be treated as valid opt-out requests by businesses that sell or share.

    Section: Cal. Code Regs. tit. 11, § 7025(b), (c)

  5. Browsers must offer a configurable opt-out preference signal from 2027-01-01.

    Section: Cal. Civ. Code § 1798.136(a), (f)

  6. Risk assessments before high-risk processing (selling or sharing, sensitive data, ADMT for significant decisions, certain inferences); existing processing assessed by 2027-12-31; attestation and summary to the CPPA by 2028-04-01.

    Section: Cal. Code Regs. tit. 11, §§ 7150, 7155(b), 7157(a)

  7. Cybersecurity audits for businesses meeting the data-revenue test, or the revenue test plus 250,000 consumers or 50,000 consumers' sensitive data; first reports due 2028-04-01, 2029-04-01 or 2030-04-01 by revenue band.

    Section: Cal. Code Regs. tit. 11, §§ 7120(b), 7121(a)

  8. Reasonable security procedures appropriate to the nature of the information.

    Section: Cal. Civ. Code § 1798.100(e)

Sources

Compare controller duties across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the California statute

Reference material, not legal advice.