They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.
Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026
The California Consumer Privacy Act, amended by the CPRA and enforced by both the California Privacy Protection Agency and the Attorney General, is the benchmark US state privacy law. We build the data map, notices, rights workflows and opt-out handling, Global Privacy Control included, that California regulators test first.
TCSA has delivered 1,000+ audits for clients in India, the US, the UK, Australia and the UAE, and our privacy practice already spans GDPR, DPDP, PDPL and ISO 27701. CCPA work is scoped per engagement, after a short call about your data flows.
1,000+audits delivered
$7,988top fine per intentional violation
45 daysto answer a consumer request
Cal. Civ. Code § 1798.100 and following, as amended by the CPRA · Last checked against the statute and CPPA regulations on 22 October 2026
This page explains the law so you can plan. It is not legal advice. For an opinion on your own facts, speak to a lawyer licensed in California.
Key Takeaways
- The CCPA, as amended by the CPRA, applies to for-profit businesses that do business in California and cross any one of three thresholds: annual gross revenue above $26,625,000 (the inflation-adjusted figure in force since 1 January 2025), buying, selling or sharing the personal information of 100,000 or more consumers or households, or earning half or more of annual revenue from selling or sharing it. No California office is needed.
- Californians, including employees, job applicants and business contacts since 1 January 2023, can know, delete and correct their personal information, opt out of its sale and sharing, and limit the use of sensitive personal information. Businesses have 45 calendar days to answer most requests and 15 business days to act on an opt-out.
- Two regulators enforce it. The California Privacy Protection Agency and the Attorney General can each seek up to $2,663 per violation and $7,988 per intentional violation or one involving minors’ personal information, with no automatic cure period. In May 2026 the Attorney General announced a $12.75 million settlement with General Motors.
- New CPPA regulations took effect on 1 January 2026. They add risk assessments, annual cybersecurity audits for larger or data-heavy businesses and rules for automated decision-making technology. A risk assessment is already required before any new high-risk processing starts, and the other first deadlines fall between 1 January 2027 and 1 April 2030.
- We scope CCPA readiness per engagement and reuse your GDPR, DPDP or ISO 27701 work. Where a certificate helps with customers, the program can be anchored to ISO 27701, which an independent certification body certifies.
Applicability · Thresholds
Who the CCPA applies to.
The law covers for-profit businesses that do business in California, collect Californians’ personal information, and meet any one of three thresholds. Doing business in California needs no office or entity in the state, so serving California customers from anywhere can qualify. Nonprofits and government agencies fall outside the definition of a business.
Annual gross revenue above $26,625,000
For-profit businesses whose annual gross revenues in the preceding calendar year exceeded $25 million, adjusted for inflation. The CPPA’s adjustment, in force since 1 January 2025, puts the figure at $26,625,000, and the next adjustment is due on 1 January 2027. The statute measures annual gross revenues and does not limit the figure to California sales.
100,000 or more consumers or households
Businesses that, alone or with others, buy, sell or share the personal information of 100,000 or more California consumers or households a year. Ad pixels that pass identifiers to ad-tech partners for targeted advertising, and bought marketing lists, can carry a company past this line without any customer database.
50% or more of revenue from selling or sharing
Businesses that earn half or more of their annual revenue from selling or sharing consumers’ personal information. This is the test that captures data brokers, ad-tech intermediaries and list-driven business models of any size.
Two scope notes that surprise non-US companies. Since 1 January 2023 the law fully covers employee and B2B data (California-resident staff, applicants and business contacts). The main sector exemptions (HIPAA, GLBA, FCRA) attach to data, not to the entity, so a hospital’s marketing website and HR files stay in scope even though its medical records are exempt. The statute and regulations are published by the California Privacy Protection Agency.
Consumer Rights
Eight rights, three clocks.
California consumers hold an enforceable set of rights over their personal information, and the deadlines around them are where programs get tested. The CPPA has fined businesses for friction and over-verification in request handling (Honda in 2025, Ford in 2026).
Know and access
What personal information is collected, where it came from, why, and who it goes to, with a portable copy on request.
Delete
Deletion of personal information collected from the consumer, with notice to service providers, contractors and the third parties it was sold or shared with (§ 1798.105(c)), subject to the statute’s exceptions. From 1 January 2027 (SB 923) the right also covers personal information the business obtained about the consumer from other sources.
Correct
Correction of inaccurate personal information, added by the CPRA, using commercially reasonable efforts.
Opt out of sale or sharing
Stop the sale of personal information and its sharing for cross-context behavioral advertising, including through opt-out preference signals such as Global Privacy Control.
Limit sensitive personal information
Restrict the use of sensitive personal information (precise geolocation, health, biometrics, account credentials, citizenship or immigration status, neural data and more) to the purposes the law allows.
No retaliation
No penalty for using a right. Price or service differences need a financial-incentive notice and must relate reasonably to the value of the data.
Minors’ opt-in
A business that knows, or wilfully ignores, that a consumer is under 16 may not sell or share their data without opt-in: from the consumer at 13 to 15, from a parent or guardian under 13.
Breach damages
Statutory damages of $107 to $799 per consumer per incident (2025 figures) when certain nonencrypted, nonredacted data (a name with a Social Security or government ID number, a financial account or card number with its access code, or medical, health insurance, biometric or genetic data, or an email address with its password) is breached because security was not reasonable.
10 business daysto confirm receipt of a request
For requests to know, delete or correct, with a word on how you will verify and when to expect an answer.
45 daysto respond in full
Calendar days from receipt, extendable once by a further 45 (90 in total) with notice to the consumer. Build the workflow for the first 45.
15 business daysto act on an opt-out or limit request
No identity verification for opt-outs, and any third party you sold or shared the data with between the request and your compliance must be told to honor it.
Windows per the CCPA and the CPPA regulations in force on 22 October 2026. ADMT access requests and appeals run on the same 10-day and 45-day clocks.
Business Obligations
The obligations that actually bite.
Eight duties drive most CCPA remediation work. Across the enforcement cases so far, regulators test the working parts first (links, signals, clocks and contracts) and read the privacy policy after.
| Obligation | What the CCPA requires |
|---|---|
| Notice at collection | At or before collection, tell consumers which categories of personal information you collect, why, whether it is sold or shared, and how long you keep each category, with a link to the full privacy policy. |
| Privacy policy | A privacy policy that sets out consumers’ rights, the categories collected, disclosed, sold and shared in the past 12 months, and how to submit requests, updated at least once every 12 months. |
| Opt-out links | Businesses that sell or share personal information post a clear “Do Not Sell or Share My Personal Information” link, and a “Limit the Use of My Sensitive Personal Information” link where the right to limit applies, or the single “Your Privacy Choices” alternative. Opting out must not require an account. |
| Honor Global Privacy Control | Opt-out preference signals such as GPC count as valid opt-outs for that browser or device, and for the consumer where you know who they are. Since 1 January 2026 the site must also show whether it processed the signal. Ignored signals were central to the Sephora case and device-only handling to the Disney case, so test it like any other control. |
| Verifiable request workflow | At least two ways to submit requests to know, delete or correct, including a toll-free number. A business that operates only online and has a direct relationship with the consumer needs only an email address, and from 1 January 2027 it must also offer an online method such as a webform (SB 923). Then come identity checks in proportion to the request, answers within the statutory clocks, and records of requests and responses kept for at least 24 months. Businesses handling the personal information of 10 million or more consumers a year also publish request metrics. |
| Data minimization and purpose limitation | Collection, use, retention and sharing must be reasonably necessary and proportionate to the purposes you disclosed. The Attorney General has enforced both: purpose limitation against Healthline in 2025 and data minimization against General Motors in 2026. |
| Service-provider and contractor contracts | Every disclosure to a vendor needs a written contract with the statute’s required terms: limited purposes, no resale, flow-down to subcontractors, and your right to take reasonable steps to check compliance. Without one the recipient is a third party, and the disclosure can itself be a sale. |
| Reasonable security and the 2026 duties | Reasonable security is a statutory duty. Regulations in force since 1 January 2026 add risk assessments for higher-risk processing, cybersecurity audits for larger or data-heavy businesses, and rules for automated decision-making technology (ADMT), each with its own start date, set out below. |
Summarized from the CCPA (Cal. Civ. Code § 1798.100 and following, as amended) and the CPPA regulations in force on 22 October 2026. A working summary for planning, not legal advice.
The CPRA Amendments
What the CPRA changed.
The California Privacy Rights Act, passed by voters as Proposition 24 in November 2020 with most provisions operative from 1 January 2023, turned the CCPA from a disclosure law into a full data protection regime. Six changes carry most of the compliance weight.
A dedicated privacy regulator
The CPRA created the California Privacy Protection Agency, a regulator dedicated to privacy, with rulemaking, audit and enforcement powers alongside the Attorney General. It now calls itself CalPrivacy. Under the Delete Act it also runs the data-broker registry and DROP, the one-stop deletion platform registered data brokers have had to process since 1 August 2026.
Sensitive personal information
A protected category: Social Security, driver’s license, state ID card and passport numbers, account log-ins and financial account, debit or credit card numbers together with the codes or passwords that open them, precise geolocation, racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, union membership, the contents of mail, email and texts not addressed to the business, genetic and neural data, biometrics used to identify someone, health, and sex life or sexual orientation. Consumers can limit its use.
Sharing closes the ad-tech gap
The original CCPA regulated sales, and ad-tech argued that swapping data for targeting services was no sale. The CPRA added sharing, meaning disclosure for cross-context behavioral advertising with or without payment, so the opt-out now plainly covers programmatic advertising.
GDPR-style principles in US law
Data minimization, purpose limitation and storage limitation became binding. Collection and use must be reasonably necessary and proportionate to the purposes disclosed, and retention periods must be disclosed for each category of personal information.
Employee and B2B data in scope
The temporary exemptions for workforce data and business-to-business contact data became inoperative on 1 January 2023. Employees, job applicants, contractors and business contacts who live in California now hold the full set of consumer rights.
Risk assessments, cyber audits, ADMT
The CPRA directed the CPPA to write rules for risk assessments, cybersecurity audits and automated decision-making technology. Those rules were approved on 22 September 2025 and took effect on 1 January 2026, with risk assessments required before any new high-risk processing from that date, and the other first deadlines from 2027 to 2030.
In force since 1 January 2026
Risk assessments, cyber audits and ADMT.
The CPPA’s regulations on cybersecurity audits, risk assessments and automated decision-making technology were approved on 22 September 2025 and took effect on 1 January 2026. A risk assessment is already required before any new high-risk processing starts. Processing that was running before 2026 must be assessed by 31 December 2027, ADMT compliance is due by 1 January 2027, and the first cybersecurity audit reports fall due on 1 April 2028.
| Duty | Who it reaches | Key dates |
|---|---|---|
| Risk assessment | Any business that sells or shares personal information, processes sensitive personal information (outside narrow workforce-administration uses), uses ADMT for a significant decision, uses automated processing to infer traits of applicants, students, employees or contractors based on systematic observation of them, or of people based on their presence at a sensitive location, or uses personal information to train ADMT for a significant decision or to train facial-recognition, emotion-recognition or other identity-verification or identification technology. | Before starting the processing. Processing already running before 2026 must be assessed by 31 December 2027. Information on assessments done in 2026 and 2027 goes to the CPPA by 1 April 2028, and by 1 April each year after that. |
| Cybersecurity audit | Businesses that earn 50% or more of revenue from selling or sharing personal information, or that cross the revenue threshold and processed the personal information of 250,000 or more consumers or households, or the sensitive personal information of 50,000 or more consumers, in the preceding year. | First audit report by 1 April 2028 (revenue over $100 million in 2026), 1 April 2029 ($50 million to $100 million in 2027) or 1 April 2030 (under $50 million in 2028), then every year the criteria are met. A signed certification of completion goes to the CPPA each time. |
| Automated decision-making technology | Businesses that use ADMT to make a significant decision about a consumer: financial or lending services, housing, education, employment or independent contracting, or healthcare. | Compliance by 1 January 2027 for ADMT already in use, and from first use after that: a pre-use notice, a right to opt out (with set exceptions) and a right to access information about how the ADMT was used. |
The cybersecurity auditor may be internal or external but must be independent of the program it audits, so whoever built or runs the program, or wrote its documents, cannot audit it (§ 7122). A business may reuse an audit or assessment prepared for another purpose, such as one against the NIST Cybersecurity Framework 2.0, if it meets every requirement on its own or with supplementation (§ 7123). Source: the CPPA’s approved regulations text, effective 1 January 2026.
Penalties & Enforcement
What non-compliance costs in California.
Two regulators share the statute: the California Privacy Protection Agency with administrative powers, and the Attorney General with civil actions. A private right of action sits underneath for data breaches.
Fines and civil penalties, per violation
The CPPA (administrative fines) and the Attorney General (civil penalties) can each seek up to $2,663 per violation, or $7,988 per intentional violation or violation involving minors’ personal information (for the CPPA’s fines, consumers the business actually knows are under 16). Those are the 2025 inflation-adjusted figures on the statute’s $2,500 and $7,500, and the next adjustment is due on 1 January 2027. The CPRA ended the automatic 30-day cure period for regulators, though the CPPA can still choose to allow time to cure. Penalties are assessed per violation, so a defect that touches many consumers adds up quickly.
Private right of action for data breaches
When a name combined with a Social Security or government ID number, a financial account or card number with its access code, or medical, health insurance, biometric or genetic data (the list in Civil Code § 1798.81.5), or an email address with its password, is stolen or disclosed unencrypted and unredacted because a business failed to keep reasonable security, consumers can sue for $107 to $799 per consumer per incident (2025 figures) or actual damages, whichever is greater. Before suing for statutory damages they must give 30 days’ written notice. Where a cure is possible, a business that cures within those 30 days and confirms in writing that the violation is cured and will not recur avoids them. Adding security after the breach does not count as a cure.
Selected enforcement so far
| When | Regulator | Business | Amount | What it turned on |
|---|---|---|---|---|
| Aug 2022 | Attorney General | Sephora | $1.2 million | Global Privacy Control signals ignored, and sales of personal information not disclosed |
| Mar 2025 | CPPA | American Honda Motor Co. | $632,500 | Too much verification for opt-outs, privacy choices that were not symmetrical, a hard route for authorized agents, and ad-tech contracts without the required terms |
| Jul 2025 | Attorney General | Healthline Media | $1.55 million | Purpose limitation (article titles suggesting a diagnosis shared to target ads), opt-outs not honored, and missing contract terms |
| Sep 2025 | CPPA | Tractor Supply Company | $1.35 million | A privacy policy without consumers’ rights, no notice to job applicants, and an opt-out that did not work |
| Feb 2026 | Attorney General | Disney | $2.75 million | Opt-outs and GPC signals that did not reach every device and service on the consumer’s account |
| Mar 2026 | CPPA | Ford Motor Company | $375,703 | An email verification step required before consumers could opt out |
| May 2026 | Attorney General, with four district attorneys | General Motors | $12.75 million | Drivers’ location and driving data sold to data brokers, the first data minimization case (settlement subject to court approval when announced) |
Amounts and dates as announced by the Attorney General and the CPPA. The Attorney General described the General Motors settlement as the largest CCPA penalty to date when it was announced in May 2026, and called it its eighth CCPA enforcement action. The others are Sephora, DoorDash, Tilting Point Media, Jam City, Healthline, Sling TV and Disney. The CPPA Board’s CCPA decisions also include Todd Snyder ($345,178, 2025), PlayOn Sports ($1.1 million, 2026) and LocateSmarter ($116,490, 2026, the first under both the CCPA and the Delete Act). Fines are adjusted for inflation every odd-numbered year, so check the current figures before you rely on them.
How TCSA Helps
A phased path to CCPA readiness.
Every engagement is scoped to your entities, data flows and vendors after a short call. If you already hold GDPR, DPDP, PDPL or ISO 27701 documentation, we reuse it, so the inventory, vendor terms and rights workflows are adapted for California rather than rebuilt. For a certifiable privacy program, pair this work with ISO 27701. If your customers ask for a SOC 2 report that covers privacy, see the SOC 2 Privacy criteria. For ongoing ownership, there is our vCISO and vDPO service.
01
Scope and data inventory
We establish whether the CCPA applies (the thresholds, doing business in California, and your entity structure), then build the personal information inventory: categories, sources, purposes, retention, sensitive data, and every sale or share, ad-tech tags and analytics included.
02
Gap assessment
A section-by-section assessment against the statute and the CPPA regulations, covering notices, rights workflows, opt-out and GPC handling, vendor contracts, minimization, and the 2026 risk-assessment, cybersecurity-audit and ADMT duties. You get a ranked remediation register.
03
Remediation and documentation
Notices at collection and the privacy policy, the Do Not Sell or Share and Limit links, GPC handling, the request workflow and its clocks, service-provider and contractor contract terms, and financial-incentive notices where loyalty programs exist.
04
Operate and evidence
Request-handling drills, staff training, records and metrics, risk assessments for higher-risk processing, and readiness for the cybersecurity audit. Where a certificate helps, the program can be anchored to ISO 27701 and certified by an independent certification body.
- Gap assessment against the statute and the CPPA regulations, with a ranked remediation list
- Data map of personal information: categories, sources, purposes, retention, sensitive data, and every sale or share
- Notices at collection, the privacy policy, and the Do Not Sell or Share and Limit links
- Rights handling: the request workflow, verification, clocks, records, and evidence that GPC works
- Service-provider, contractor and third-party contract terms across your vendors
- One privacy program across California, the EU, India and the Gulf, adapted for each
We prepare you for the CCPA cybersecurity audit. The regulations require that audit to be done by someone independent of your program, so the team that helps you build it cannot also audit it.
Cross-Jurisdiction View
CCPA vs GDPR vs DPDP.
Most companies in scope of the CCPA answer to more than one privacy law. This is the comparison we use to design one program that satisfies all three. See our GDPR, DPDP and PDPL pages for the other legs.
| Dimension | CCPA / CPRA (California) | GDPR (EU) | DPDP Act (India) |
|---|---|---|---|
| Who it protects | California residents (“consumers”), including employees, job applicants and B2B contacts since 1 January 2023 | People in the EU/EEA, whatever their citizenship | Data principals in India (digital personal data) |
| Regulator | California Privacy Protection Agency (CalPrivacy) and the California Attorney General | National supervisory authorities and the EDPB | Data Protection Board of India |
| Legal model | Opt-out: processing is allowed by default, and consumers opt out of sale and sharing and limit sensitive data | Six lawful bases, with consent opt-in where it is relied on | Consent first, plus defined “legitimate uses” |
| When it applies | For-profit, doing business in California, and any one of three thresholds (revenue above $26,625,000, 100,000+ consumers or households, or 50%+ of revenue from selling or sharing) | An establishment in the EU, or offering goods or services to, or monitoring, people in the EU. No size threshold | Processing digital personal data in India, or processing outside India connected with offering goods or services to data principals in India |
| Request clock | 45 calendar days, extendable once by 45. Opt-outs within 15 business days | One month, extendable by two further months | As prescribed under the DPDP Rules |
| Maximum penalties | $2,663 per violation, $7,988 if intentional or involving minors (2025 figures), plus $107 to $799 per consumer in breach damages | €20 million or 4% of worldwide annual turnover, whichever is higher | Up to ₹250 crore for a failure of security safeguards (Schedule to the Act) |
| Private right of action | Yes, for qualifying data breaches only | Yes, compensation for material and non-material damage | No private right of action, penalties come through the Board |
Indicative summary for planning, not legal advice. Other US state privacy laws (Virginia, Colorado, Texas and more) follow a broadly similar opt-out model, and a CCPA-grade program is the practical baseline for all of them.
Proof
In their words.
Quotes verbatim from G2. Company names added where the client confirmed them.
Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.
Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026
The team’s willingness to work with us and ease of communication.
sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026
They delivered the project with speed, accuracy, and cost-effectiveness.
Maneet P.Mid-MarketSOC 2 · August 2026
My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.
Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026
They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.
Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026
Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.
Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026
Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.
Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026
The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.
Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026
What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.
Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026
CCPA compliance, frequently asked questions.
Straight answers on California privacy law from a cross-jurisdiction privacy team.
Does the CCPA apply to companies outside California, or outside the United States?
It can. The test is whether you do business in California and cross one of the thresholds, and the statute does not ask for an office, staff or a legal entity in the state. Selling to Californians, or collecting their personal information through a website at scale, can be enough. A SaaS company headquartered in India, the UK or Canada with real California revenue or traffic should run the threshold analysis rather than assume distance protects it. If you fall below every threshold you are not a business in your own right, but other routes can still bring you in. The two that matter most for SaaS companies are controlling, or being controlled by, a covered business that shares your brand and shares consumers’ personal information with you (§ 1798.140(d)(2)), and processing personal information as a service provider or contractor for a covered business, which brings required contract terms and direct liability for fines (§ 1798.140(ag) and (j), § 1798.155). For many mid-market companies the first deliverable is a written applicability memo.
Do we need to meet all three thresholds, or just one?
One is enough. The three tests are alternatives: annual gross revenue above $26,625,000 in the preceding calendar year (the $25 million base figure as adjusted by the CPPA from 1 January 2025), buying, selling or sharing the personal information of 100,000 or more consumers or households a year, or earning 50% or more of annual revenue from selling or sharing personal information. The 100,000 test is the one that catches companies by surprise, because identifiers from ad pixels and device IDs are personal information, and passing them to ad-tech partners for targeted advertising is sharing.
Is there a CCPA certification?
No. The CCPA is a statute. Compliance is something you maintain and can evidence, and no body issues a CCPA certificate. Companies that want an auditable artifact for their privacy program anchor it to ISO 27701, the privacy extension of ISO 27001, so the CCPA work (inventory, notices, rights workflows, vendor contracts) becomes the operating substance of a certified Privacy Information Management System. We build the program, and an independent certification body certifies it. We never certify our own work.
What is the difference between the CCPA and the CPRA?
It is one law, amended. The California Consumer Privacy Act of 2018 became operative on 1 January 2020. The California Privacy Rights Act, passed by voters as Proposition 24 on 3 November 2020, amended and expanded it, with most changes operative from 1 January 2023. The CPRA created the CPPA as a dedicated regulator and added the sensitive personal information category and the right to limit its use, the right to correct, sharing for cross-context behavioral advertising, data minimization and purpose limitation, and the rulemaking behind the risk-assessment, cybersecurity-audit and ADMT rules. Practitioners say CCPA, or the CCPA as amended. There is no separate CPRA compliance regime.
What counts as selling or sharing personal information?
Both are wider than they sound. Selling is disclosing personal information to a third party for money or other valuable consideration, so no invoice is needed, and enriched analytics or reciprocal data access can be consideration. Sharing is disclosure for cross-context behavioral advertising, whether or not money changes hands, which is what standard ad-tech and social media pixels do. If your site runs third-party advertising tags, assume you sell or share personal information and need the opt-out links and Global Privacy Control handling. A compliant contract can make an analytics or measurement vendor a service provider, but no contract can do that for cross-context behavioral advertising. For those advertising services the vendor is a third party, not a service provider or contractor, under the CPPA regulations (§ 7050(b)).
Do we have to honor Global Privacy Control?
Yes, if you sell or share personal information. The regulations require you to treat an opt-out preference signal such as Global Privacy Control as a valid opt-out for that browser or device, and for the consumer if you know who they are. Since 1 January 2026 the site must also show whether it processed the signal, for example with an “Opt-Out Request Honored” message. Regulators test this. The Attorney General’s Sephora settlement ($1.2 million, 2022) turned on ignored GPC signals, and the Disney settlement ($2.75 million, February 2026) found signals applied only to the device in use even when the consumer was logged in. From 1 January 2027 browsers must also offer a setting that sends the signal, so expect many more of them. Treat it as an engineering control: the signal is received, the relevant tags stop, and you keep evidence that it works.
Are employee and B2B data really covered?
Yes. The temporary exemptions for workforce data and business-to-business contact data became inoperative on 1 January 2023. California-resident employees, job applicants and contractors can now ask to access, delete or correct payroll, monitoring and performance data, and business contacts hold the same rights. For non-US companies with California staff or sales contacts, the HR workflow is often the least-built part of the program. The CPPA’s first decision on job applicants’ privacy rights came in September 2025, against Tractor Supply.
What exemptions exist under the CCPA?
The main ones attach to data, not to companies. Medical information governed by HIPAA or California’s Confidentiality of Medical Information Act, consumer-report data under the Fair Credit Reporting Act, and information handled under the Gramm-Leach-Bliley Act are exempt as data, but the same company’s marketing, website and HR data stay in scope. The FCRA and GLBA carve-outs also do not reach the data-breach lawsuit right. Nonprofits and government agencies fall outside the definition of a business, and publicly available information is excluded. Treating a sector exemption as if it covered the whole organization is one of the scoping errors we correct most often.
How is the CCPA enforced in practice?
By two regulators, both active. The Attorney General’s settlements include Sephora ($1.2 million, 2022, ignored GPC signals and undisclosed sales), Healthline ($1.55 million, 2025, purpose limitation and ad-tech disclosures) and Disney ($2.75 million, 2026, opt-outs that did not reach every device and service). In May 2026 it announced a $12.75 million settlement with General Motors over the sale of drivers’ location and driving data, which it called the largest CCPA penalty to date and its first data minimization case. The CPPA’s Board decisions include Honda ($632,500, 2025), Todd Snyder ($345,178, 2025), Tractor Supply ($1.35 million, 2025), PlayOn Sports ($1.1 million, 2026) and Ford ($375,703, 2026). The pattern across the cases: opt-out plumbing, friction in rights requests, vendor contracts and data kept longer or used more widely than disclosed. Regulators test the working parts before they read the policy.
How long does CCPA readiness take, and how is it priced?
For most mid-size organizations, 6–12 weeks from kickoff to a working program: threshold analysis and data inventory first, then the gap assessment, remediation and request-handling drills. Every engagement is scoped to your entities, data flows and vendors, and to whether ad-tech remediation and the 2026 risk-assessment and cybersecurity-audit duties are in scope, then quoted as a fixed, all-inclusive fee in USD after a short scoping call. If you already run a GDPR, DPDP or ISO 27701 program, we reuse it, so the inventory, vendor terms and rights workflows are adapted for California rather than rebuilt.
Can a SOC 2 report or an ISO 27001 audit count as the CCPA cybersecurity audit?
It can help, but not automatically. The regulations let a business use an audit or assessment prepared for another purpose if it meets every requirement of the cybersecurity-audit rules, on its own or with supplementation, and they give an audit against the NIST Cybersecurity Framework 2.0 as an example. Map your SOC 2 or ISO 27001 work against the CCPA audit’s required scope, report contents and auditor-independence rules, and close the gaps. The auditor may be internal or external but must be independent of the program it audits, so whoever builds or runs your program cannot also audit it.
What changed in 2026?
The CPPA’s regulations on risk assessments, cybersecurity audits and automated decision-making technology took effect on 1 January 2026, with risk assessments required before any new high-risk processing from that date, and the other first deadlines from 2027 to 2030. Updated rules came with them, including the duty to show whether an opt-out preference signal was honored. Since 1 August 2026, registered data brokers have had to process deletion requests sent through DROP, the CPPA’s one-stop deletion platform. From 1 January 2027, browsers must include a setting that sends an opt-out preference signal (Civil Code section 1798.136). SB 923, signed on 27 September 2026, extends the right to delete to personal information a business obtained about a consumer from other sources, and requires online-only businesses to offer a webform or similar online method, from 1 January 2027.
Sources
Where every legal fact on this page comes from.
We checked every figure, date and case on this page against these official sources on 22 October 2026. Laws, regulations and inflation-adjusted amounts change, so check the live source before you rely on a figure.
- 01California Civil Code §§ 1798.100 to 1798.199.100 (the CCPA as amended)
The statute: thresholds, rights, request methods and clocks, minors, exemptions, breach damages, fines and the browser opt-out signal rule (§ 1798.136, operative 1 January 2027).
California Legislative Information - 02CCPA statute, effective 1 January 2026
The agency’s posted text of the statute, with its notes on the amounts adjusted for inflation.
California Privacy Protection Agency - 03CCPA Regulations, Cal. Code Regs. tit. 11, § 7000 and following, effective 1 January 2026
Request timelines (§ 7021), opt-out preference signals (§ 7025), opt-outs (§ 7026), the right to limit (§ 7027), record-keeping (§ 7101) and request metrics (§ 7102).
California Privacy Protection Agency - 04CCPA updates, cybersecurity audits, risk assessments, ADMT and insurance regulations
Approved by the Office of Administrative Law on 22 September 2025, effective 1 January 2026. Cybersecurity audits §§ 7120 to 7124, risk assessments §§ 7150 to 7157, ADMT §§ 7200 to 7222.
California Privacy Protection Agency - 05CCPA monetary thresholds, adjusted for inflation
Effective 1 January 2025: $26,625,000 revenue threshold, $2,663 and $7,988 fines and penalties, $107 to $799 breach damages.
California Privacy Protection Agency - 06Delete Act and the Delete Request and Opt-out Platform (DROP)
With Civil Code § 1798.99.86: data brokers have had to access DROP and process requests since 1 August 2026.
California Privacy Protection Agency - 07California Consumer Privacy Act (CCPA)
The Attorney General’s guide to consumer rights, response times and the breach lawsuit right.
Office of the Attorney General - 08Settlement with Sephora, 24 August 2022
$1.2 million, Global Privacy Control and undisclosed sales.
Office of the Attorney General - 09Settlement with Healthline.com, 1 July 2025
$1.55 million, purpose limitation, opt-outs and contract terms.
Office of the Attorney General - 10Settlement with Disney, 11 February 2026
$2.75 million, opt-outs and GPC signals that did not reach every device and service.
Office of the Attorney General - 11Settlement with General Motors, 8 May 2026
$12.75 million in civil penalties, subject to court approval when announced, location and driving data sold to data brokers. The release calls it the eighth enforcement action under the CCPA and names the seven before it.
Office of the Attorney General - 12Board enforcement decisions
Decisions and press releases for Honda (March 2025, $632,500), Todd Snyder (May 2025, $345,178), Tractor Supply (September 2025, $1,350,000), PlayOn Sports (decision of 27 February 2026, $1.1 million), Ford (March 2026, $375,703) and LocateSmarter (August 2026, $116,490, the first action under both the CCPA and the Delete Act).
California Privacy Protection Agency (CalPrivacy) - 13California Expands Privacy Protections by Strengthening Deletion Rights, 27 September 2026
SB 923, the Expanding Privacy Rights Act, signed 27 September 2026 and in effect from 1 January 2027: deletion reaches personal information obtained from third parties, and online-only businesses must offer an online way to submit requests.
California Privacy Protection Agency (CalPrivacy) - 14The Digital Personal Data Protection Act, 2023
For the comparison table: territorial scope (section 3) and the penalty Schedule.
Ministry of Electronics and Information Technology, Government of India - 15Regulation (EU) 2016/679, the General Data Protection Regulation
For the comparison table: scope (Article 3), response time (Article 12) and fines (Article 83).
EUR-Lex
Last checked against the statute and CPPA regulations on 22 October 2026. This page is general information for planning, not legal advice.
Keep Exploring
Related Reading
Privacy
GDPR Compliance
The EU's data protection regulation for any company with EU users.
Read morePrivacy
ISO 27701 (PIMS)
The privacy extension to ISO 27001 — one audit, two certificates.
Read moreSOC 2
TSC: Privacy
PII lifecycle management aligned with AICPA privacy principles.
Read morePrivacy
DPDP Act Overview
India's Digital Personal Data Protection Act, explained.
Read morePrivacy
PDPL Compliance (KSA & UAE)
Saudi Arabia's SDAIA-enforced privacy law and the UAE's federal PDPL.
Read moreService
vCISO / vDPO
A named, certified security and privacy leader — fractional.
Read moreGet Started
Make the CCPA a closed question.
Two regulators are enforcing, enterprise customers are asking, and opt-outs run on a 15-business-day clock. Start with a readiness assessment scoped to your real data flows, beginning with whether the law applies to you at all.
CCPA as amended by the CPRA · Cal. Civ. Code § 1798.100 and following · Serving India, the USA, the UK, Australia and the UAE