CCPA and CPRA Compliance: Thresholds, Rights and Duties Explained

CCPA compliance applies to far more companies than the name suggests. The California Consumer Privacy Act, as amended by the California Privacy Rights Act, reaches any for-profit business that does business in California and meets one of its thresholds, wherever it is based. It covers California residents in every role, including customers, website visitors, employees, job applicants and business contacts. And it reaches vendors: SaaS providers, IT firms and data processors that serve covered businesses must sign specific contracts and meet direct obligations as service providers or contractors.

This guide explains the thresholds, the rights consumers have and how to support them in software, the notice and opt-out rules (including the Global Privacy Control signal), service provider contracts, security and breach liability, the regulations on risk assessments, cybersecurity audits and automated decisionmaking that took effect in 2026, and enforcement. It is a practical overview, not legal advice.

What is the CCPA and the CPRA?

The California Consumer Privacy Act of 2018 is codified in the California Civil Code starting at section 1798.100. It took effect on 1 January 2020. The California Privacy Rights Act, approved by voters as Proposition 24 in November 2020, substantially amended it from 1 January 2023: it added the right to correct, the right to limit use of sensitive personal information, the concept of "sharing" for cross-context behavioural advertising, contractors as a category, data minimisation and retention limits, and created the California Privacy Protection Agency (CPPA). People usually refer to the amended law simply as the CCPA.

Key terms:

• Consumer: a natural person who is a California resident. Since 2023 this includes employees, job applicants and business-to-business contacts.
• Personal information: information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with a particular consumer or household.
• Sensitive personal information: categories such as government identifiers, account log-in with credentials, financial account details, precise geolocation, racial or ethnic origin, religious beliefs, union membership, contents of private communications, genetic and biometric data, health, sex life and sexual orientation.
• Sell and share: selling is disclosing personal information for monetary or other valuable consideration; sharing is disclosing it for cross-context behavioural advertising, whether or not money changes hands.
• Service provider and contractor: entities that process personal information on behalf of a business under a written contract meeting the statute's requirements.

History and why the law was introduced

The CCPA was passed quickly in 2018 as a legislative compromise to avoid a broader ballot initiative. It was the first broad consumer privacy law in the United States, introduced at a time of public concern about data brokers, targeted advertising and large data breaches, and shortly after the GDPR began to apply in Europe. The CPRA followed in 2020 to close gaps, especially around advertising technology and sensitive data, and to create a dedicated regulator. The CPPA has since adopted detailed regulations, including a package effective 1 January 2026 on cybersecurity audits, risk assessments and automated decisionmaking technology.

Who must comply?

A "business" is a for-profit entity that collects consumers' personal information, determines the purposes and means of processing, does business in California, and meets at least one of these thresholds:

• Annual gross revenue above 25 million dollars, as adjusted for inflation by the CPPA (adjusted to 26.625 million dollars from January 2025).
• Annually buys, sells or shares the personal information of 100,000 or more consumers or households.
• Derives 50 percent or more of annual revenue from selling or sharing consumers' personal information.

Where you are based does not matter; doing business in California does. Non-profits are generally outside the definition of a business, and some data is exempt, such as health information covered by HIPAA and financial information covered by the GLBA, though the business itself may still be covered for other data.

Service providers and contractors

SaaS, IT and data vendors that process personal information on behalf of a covered business are service providers or contractors if their contract meets section 1798.100(d) and 1798.140 requirements. They must not sell or share the data, retain, use or disclose it outside the business purposes in the contract, or combine it with other data except as permitted. They must comply with the CCPA, provide the same level of privacy protection, notify the business if they can no longer meet their obligations, allow the business to take reasonable steps to stop unauthorised use, and help with consumer requests. Without such a contract, the disclosure may count as a sale or sharing.

Consumer rights

Right	Section	What the business must do
Right to know and access	1798.100, 1798.110, 1798.115	Disclose categories and specific pieces of personal information collected, sources, purposes and recipients
Right to delete	1798.105	Delete and direct service providers and contractors to delete, subject to exceptions
Right to correct	1798.106	Use commercially reasonable efforts to correct inaccurate information
Right to opt out of sale or sharing	1798.120	Stop selling or sharing; provide a "Do Not Sell or Share My Personal Information" link or honour opt-out preference signals
Right to limit use of sensitive personal information	1798.121	Limit use to permitted purposes; provide a "Limit the Use of My Sensitive Personal Information" link where required
Right to non-discrimination	1798.125	Not penalise consumers for exercising rights, subject to rules on financial incentives

Businesses must respond to verifiable requests to know, delete and correct within 45 calendar days, extendable by a further 45 days with notice. Requests to opt out must be acted on promptly. Minors under 16 must opt in to sale or sharing (with parental consent under 13).

Opt-out preference signals

The regulations require businesses that sell or share personal information to treat a browser-based opt-out preference signal, such as Global Privacy Control, as a valid request to opt out for that browser or device and any consumer profile associated with it. In practice, your site must detect the signal and suppress advertising and data-sharing tags before they fire.

Business obligations

• Notice at collection: at or before collection, the categories of personal information and sensitive personal information, purposes, whether it is sold or shared, and retention periods.
• Privacy policy: a full description of practices and rights, updated at least every 12 months.
• Data minimisation and purpose limitation: collection, use, retention and sharing must be reasonably necessary and proportionate to the disclosed purposes (1798.100(c)).
• Retention: no longer than reasonably necessary for each disclosed purpose.
• Contracts: with service providers, contractors and third parties to whom data is sold or shared.
• Reasonable security: implement reasonable security procedures and practices appropriate to the nature of the information (1798.100(e)).
• Consumer request methods, including at least two methods for most businesses, and records of requests for 24 months.
• Dark patterns: consent obtained through interfaces that subvert or impair choice is not valid consent.

The 2026 regulations: risk assessments, audits and ADMT

CPPA regulations approved in September 2025 took effect on 1 January 2026, with later compliance dates for the most demanding parts:

• Risk assessments: businesses whose processing presents significant risk to consumers' privacy (for example selling or sharing personal information, processing sensitive personal information, or using automated decisionmaking for significant decisions) must conduct and document risk assessments. Submissions to the CPPA covering assessments conducted in 2026 and 2027 are due by 1 April 2028.
• Cybersecurity audits: businesses whose processing presents significant risk to security must complete an annual independent cybersecurity audit. First audit certifications are phased by revenue, from 1 April 2028 for the largest businesses to 1 April 2030 for smaller ones.
• Automated decisionmaking technology (ADMT): businesses using ADMT to make significant decisions about consumers (such as on financial services, housing, education, employment or healthcare) must provide pre-use notices, opt-out rights subject to exceptions, and access to information about the logic and outcome, from 1 January 2027.

Check the regulation text for exact scope and dates, which differ by requirement and revenue tier.

How to comply, step by step

1. Test the thresholds and decide whether you are a business, a service provider or contractor, or both.
2. Map personal information by category, source, purpose, retention and recipient, including employee and B2B data.
3. Identify sales and sharing, especially advertising pixels, SDKs and data partnerships.
4. Write the notice at collection and privacy policy.
5. Implement opt-outs: the required links, Global Privacy Control detection, and tag management that respects the choice.
6. Build request handling for access, deletion and correction, with verification, 45-day tracking, and propagation to service providers.
7. Fix contracts with vendors and customers so that service provider and contractor terms are in place.
8. Set retention periods and automate deletion.
9. Review security against a recognised framework, because data breaches can lead to private lawsuits.
10. Plan for 2026 regulations: risk assessments, cybersecurity audit readiness and ADMT notices where they apply.
11. Train staff who handle consumer requests.

Documentation and records required

• Privacy policy and notices at collection.
• Data inventory with categories, purposes, retention and recipients.
• Records of consumer requests and responses for at least 24 months.
• Service provider, contractor and third-party contracts.
• Records of opt-out preference signal handling.
• Risk assessments and cybersecurity audit reports where the regulations require them.
• ADMT notices and documentation where applicable.
• Security policies and incident records.

Audits, assessments and enforcement

The CCPA has no certification. The CPPA enforces it through investigations and administrative proceedings, and the Attorney General through civil actions. The 2026 regulations introduce mandatory independent cybersecurity audits and risk assessment submissions for businesses meeting their criteria. Service providers can expect customers to audit or request evidence of compliance, often satisfied by SOC 2 reports and contract attestations.

Timeline and cost considerations

The core law has applied since 2020 and the CPRA amendments since 2023, so most obligations apply now. The 2026 regulations add dates in 2027, 2028 and later. Costs include legal review, consent and tag management tools, request handling workflows, vendor contract updates, security improvements, independent audits for qualifying businesses, and engineering for deletion and correction across systems.

Benefits and consequences of non-compliance

Compliance lets you sell to US businesses that require CCPA-ready vendors, reduces data held and therefore breach impact, and prepares you for the other US state privacy laws that follow similar patterns.

Administrative fines under section 1798.155 are up to 2,500 dollars per violation, or 7,500 dollars per intentional violation or violation involving consumers under 16, with amounts adjusted for inflation every two years by the CPPA. Section 1798.150 gives consumers a private right of action when nonencrypted and nonredacted personal information is subject to unauthorised access because of a business's failure to maintain reasonable security, with statutory damages of between 100 and 750 dollars per consumer per incident (also inflation-adjusted) or actual damages if greater. The CPPA and Attorney General have brought public enforcement actions, including over opt-out and dark-pattern failures.

Common mistakes and challenges for IT companies

• Assuming B2B companies are exempt. Employee and business contact data have been covered since 2023.
• Ignoring tracking pixels. Sharing data with advertising platforms for cross-context behavioural advertising is "sharing" even without payment.
• Not honouring Global Privacy Control. Regulators have specifically enforced this.
• Vendor contracts without the required terms, which can turn a service relationship into a sale.
• Using customer data for your own product improvement beyond what your service provider contract allows.
• Dark patterns in cookie banners and opt-out flows, such as asymmetric choices.
• Deletion that misses backups, analytics or vendors.

Best practices, tools and technologies

• Use a consent and tag management platform that reads Global Privacy Control and blocks sharing tags before they load.
• Maintain a vendor inventory classifying each as service provider, contractor or third party.
• Build a request portal with identity verification proportional to risk and automated fulfilment across systems.
• Tag data by category and retention period so deletion can be automated.
• Encrypt personal information, which reduces exposure to the breach private right of action.
• Use the NIST Privacy Framework or ISO/IEC 27701 to structure the programme.

We implement consent-aware tag loading and rights workflows on e-commerce sites and web applications.

How the CCPA relates to other laws and frameworks

Law or framework	Relationship
GDPR	The GDPR requires a lawful basis for all processing; the CCPA is mainly notice and opt-out based, with opt-in for minors and limits on sensitive data. Rights overlap but differ in detail.
Other US state privacy laws	Many states have broad consumer privacy laws with similar rights and processor contracts; thresholds and details differ.
COPPA	Federal law on children under 13 online, alongside the CCPA's opt-in rules for minors.
GLBA and HIPAA	Data covered by these federal laws is largely exempt from the CCPA, but the business may still be covered for other data.
SOC 2	Common evidence of reasonable security and service provider controls.

Real-world enforcement examples

In 2022 the California Attorney General announced a 1.2 million dollar settlement with Sephora over allegations that it sold consumer data through third-party tracking without proper disclosure and did not honour Global Privacy Control signals. The CPPA has since announced its own enforcement actions, including against companies whose opt-out and consent flows were found to use dark patterns or require unnecessary information. These cases show that advertising technology, opt-out signals and interface design are enforcement priorities.

An illustrative case for a US SaaS vendor with Indian engineering: a customer's privacy team asks for service provider terms, confirmation that customer data is not used to train models outside the contract, and a list of sub-processors. The vendor updates its DPA to include CCPA service provider terms, restricts engineers' access to production data, and adds an admin tool for customers to delete end-user data, which also serves GDPR requests.

Next steps

1. Check thresholds and your role.
2. Audit tracking tags and data sharing on your sites and apps.
3. Implement Global Privacy Control and the required links.
4. Update vendor and customer contracts.
5. Plan for the 2026 regulations if you meet their criteria.

Frequently asked questions

Does the CCPA apply to companies outside California?

Yes, if they do business in California and meet a threshold. Location of the company does not matter.

What are the CCPA thresholds?

Annual gross revenue above 25 million dollars as adjusted for inflation, buying, selling or sharing personal information of 100,000 or more consumers or households a year, or deriving at least half of revenue from selling or sharing personal information.

What is the difference between the CCPA and the CPRA?

The CPRA is a 2020 ballot measure that amended the CCPA from 2023, adding new rights, sensitive data rules, sharing for behavioural advertising, contractors, data minimisation and the California Privacy Protection Agency.

Do employees have CCPA rights?

Yes. Since 1 January 2023, employees, job applicants and business contacts who are California residents have full CCPA rights.

What is a service provider under the CCPA?

A person that processes personal information on behalf of a business under a written contract that meets the statute's requirements and restricts use of the data to the contracted business purposes.

Do we have to honour Global Privacy Control?

Businesses that sell or share personal information must treat opt-out preference signals such as Global Privacy Control as valid opt-out requests under the regulations.

How long do we have to respond to a request?

45 calendar days for requests to know, delete and correct, extendable once by another 45 days with notice to the consumer.

What are the CCPA fines?

Up to 2,500 dollars per violation or 7,500 dollars per intentional violation or violation involving minors, adjusted for inflation. Data breaches caused by unreasonable security can also lead to private lawsuits with statutory damages.

Does the CCPA require a cybersecurity audit?

Under regulations effective in 2026, businesses whose processing presents significant security risk must complete annual independent cybersecurity audits, with first certifications due between 2028 and 2030 depending on revenue.

Is the CCPA the same as the GDPR?

No. Both give rights to individuals, but the GDPR requires a lawful basis for all processing, while the CCPA focuses on notice, opt-outs and limits, with different definitions, exemptions and enforcement.

Does the CCPA cover AI and automated decisions?

Yes. The 2026 regulations add notice, opt-out and access rights for automated decisionmaking technology used for significant decisions, from 1 January 2027.