--- title: "California privacy law (CCPA): controller duties" canonical: "https://dposchool.com/state-privacy-laws/state/california/controller-duties" source: "https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5." text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act, Proposition 24) # California privacy law (CCPA): controller duties Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Businesses must give a notice at collection and a privacy policy, keep collection and use reasonably necessary and proportionate, set retention periods, and keep reasonable security. Businesses that sell or share must honor opt-out preference signals such as Global Privacy Control under the regulations, and from 2027-01-01 browser makers must build such a signal in. Under the regulations in effect from 2026-01-01, businesses whose processing presents significant risk must conduct risk assessments (submissions to the CPPA from 2028-04-01) and, if they meet the security-risk tests, annual cybersecurity audits phased in by revenue from 2028 to 2030. ## Key points 1. Notice at or before collection: categories, purposes, whether sold or shared, and retention period for each category. Section: [Cal. Civ. Code § 1798.100(a)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 2. Data minimisation: collection, use, retention and sharing must be reasonably necessary and proportionate to the disclosed purposes. Section: [Cal. Civ. Code § 1798.100(c)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 3. Privacy policy updated at least every 12 months, describing rights and request methods. Section: [Cal. Civ. Code § 1798.130(a)(5)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 4. Opt-out preference signals must be treated as valid opt-out requests by businesses that sell or share. Section: [Cal. Code Regs. tit. 11, § 7025(b), (c)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 5. Browsers must offer a configurable opt-out preference signal from 2027-01-01. Section: [Cal. Civ. Code § 1798.136(a), (f)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 6. Risk assessments before high-risk processing (selling or sharing, sensitive data, ADMT for significant decisions, certain inferences); existing processing assessed by 2027-12-31; attestation and summary to the CPPA by 2028-04-01. Section: [Cal. Code Regs. tit. 11, §§ 7150, 7155(b), 7157(a)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 7. Cybersecurity audits for businesses meeting the data-revenue test, or the revenue test plus 250,000 consumers or 50,000 consumers' sensitive data; first reports due 2028-04-01, 2029-04-01 or 2030-04-01 by revenue band. Section: [Cal. Code Regs. tit. 11, §§ 7120(b), 7121(a)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 8. Reasonable security procedures appropriate to the nature of the information. Section: [Cal. Civ. Code § 1798.100(e)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) ## Sources - [CCPA statute text effective 2026-01-01 (AB 137, AB 566 update), consolidated by the CPPA](https://cppa.ca.gov/pdf/20260101_ccpa_statute.pdf) - [CPPA, CCPA Updates, Cyber, Risk, ADMT and Insurance regulations: approved text](https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf) [Compare controller duties across all states](https://dposchool.com/state-privacy-laws/topic/controller-duties) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 35: Data protection impact assessment](https://dposchool.com/gdpr/article/35) (assessments) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the California statute](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) Reference material, not legal advice. ## Other topics for California - [Applicability](https://dposchool.com/state-privacy-laws/state/california/applicability) - [Consumer rights](https://dposchool.com/state-privacy-laws/state/california/consumer-rights) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/california/sensitive-data) - [Processors](https://dposchool.com/state-privacy-laws/state/california/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/california/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [California](https://dposchool.com/state-privacy-laws/state/california) / Controller duties Previous: [Sensitive data](https://dposchool.com/state-privacy-laws/state/california/sensitive-data) Next: [Processors](https://dposchool.com/state-privacy-laws/state/california/processors) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents