PrivacyUSA

CCPA

Keep California privacy obligations organised

Bring privacy responsibilities, request-handling evidence and service-provider reviews into one accountable programme.

Full title
California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code 1798.100 et seq.)
Issued by
State of California. Enforced by the California Privacy Protection Agency and the California Attorney General.
Current regulations
CCPA regulations in Title 11 of the California Code of Regulations. The latest package took effect on 1 January 2026, with later phased compliance dates.
Applies to
For-profit businesses that do business in California and meet a revenue or data threshold, and their service providers and contractors
Nature
Binding state law with implementing regulations. There is no certification.
Structure
Consumer rights, business obligations, service provider and contractor duties, security, and enforcement, detailed by regulation

Overview

What the CCPA requires

The California Consumer Privacy Act gives California residents rights over the personal information businesses collect about them, and places duties on the businesses that collect it. It took effect in 2020. The California Privacy Rights Act, approved by voters in November 2020, amended the CCPA from 2023, added rights to correct and to limit the use of sensitive personal information, introduced data minimisation and purpose limits, and created the California Privacy Protection Agency. The CPRA amended the CCPA. It is not a separate law that replaced it.

The Act applies to businesses, not only to consumer-facing ones. A business must give notice at collection, keep a privacy policy updated at least every 12 months, honour requests to know, delete and correct, and let consumers opt out of the sale or sharing of their personal information, including through opt-out preference signals. Collection and use must be reasonably necessary and proportionate to the disclosed purposes, and the business must implement reasonable security procedures and practices.

The regulations that took effect on 1 January 2026 add three significant obligations, each with its own phased dates. Businesses whose processing presents significant risk to consumers’ privacy must carry out and document risk assessments. Businesses whose processing presents significant risk to security must complete an annual independent cybersecurity audit and submit a certification to the Agency. Businesses that use automated decisionmaking technology to make significant decisions about consumers must give pre-use notice, opt-out and access rights from 1 January 2027.

Both the Agency and the Attorney General can enforce the Act, and consumers have a private right of action for certain data breaches caused by a failure to maintain reasonable security. For most organisations the work is operational: knowing what personal information they hold and where, answering requests on time, managing contracts with service providers, and keeping the records that show it.

Who it applies to

A for-profit business that does business in California and determines the purposes and means of processing is covered if it meets any one of these thresholds:

  • Annual gross revenue above the adjusted threshold in the preceding calendar year, set at $26,625,000 from 1 January 2025
  • Annually buys, sells or shares the personal information of 100,000 or more California consumers or households
  • Derives 50 per cent or more of annual revenue from selling or sharing consumers’ personal information
  • Service providers and contractors that process personal information for a covered business, under written contracts
  • Third parties that receive personal information from a covered business
  • Indian companies that do business in California and meet a threshold, or that act as service providers or contractors to covered businesses

Some information is exempt, such as protected health information governed by HIPAA and certain information covered by the Gramm-Leach-Bliley Act, but the organisation may not be. Employee and business-to-business information has been fully in scope since 1 January 2023. A GDPR programme helps, but definitions, rights and obligations differ.

Structure

How the Act and regulations are organised

The statute sets the rights and duties. The CCPA regulations in Title 11 of the California Code of Regulations explain how to meet them, and since 2026 add risk assessments, cybersecurity audits and ADMT rules.

Rights

Consumer rights

Right to know
Know the categories and specific pieces of personal information collected, the sources, the purposes, and the categories of third parties it is disclosed to.
Right to delete
Request deletion of personal information collected from the consumer, subject to listed exceptions. The business also notifies service providers, contractors and third parties as the Act requires.
Right to correct
Request correction of inaccurate personal information.
Right to opt out of sale or sharing
Opt out of the sale of personal information or its sharing for cross-context behavioural advertising, including through opt-out preference signals.
Right to limit sensitive personal information
Limit the use and disclosure of sensitive personal information to purposes the Act permits.
No retaliation
Businesses may not discriminate against consumers for exercising their rights. Financial incentives are allowed only on the conditions the Act and regulations set.
Business duties

Notice, purpose and minimisation

Notice at collection
Tell consumers, at or before collection, what is collected, why, whether it is sold or shared, and how long it is kept.
Privacy policy
A comprehensive description of practices and rights, updated at least once every 12 months.
Purpose limitation and data minimisation
Collection, use, retention and sharing must be reasonably necessary and proportionate to the purposes disclosed.
Opt-out methods
Clear links or alternative methods to opt out of sale or sharing and to limit sensitive personal information, and processing of opt-out preference signals.
Request handling
Verified methods for submitting requests, with set response periods, and records of requests kept as the regulations require.
Contracts

Service providers, contractors and third parties

Service providers and contractors
Process personal information on behalf of a business under a written contract that limits use to the specified business purposes and requires them to comply with the Act.
Third parties
Contracts for sale or sharing limit use to specified purposes and oblige the third party to provide the same level of protection.
Oversight
The business may take reasonable steps to ensure that recipients use the information consistently with its obligations.
Security

Reasonable security and cybersecurity audits

Reasonable security
Implement security procedures and practices appropriate to the nature of the personal information, to protect it from unauthorised access, destruction, use, modification or disclosure.
Cybersecurity audits
Required where processing presents significant risk to security: a business that derives 50 per cent or more of revenue from selling or sharing, or one above the revenue threshold that processed the personal information of 250,000 or more consumers or households, or the sensitive personal information of 50,000 or more consumers, in the preceding year.
Audit conduct
Annual audits by a qualified, objective and independent auditor, internal or external, based on evidence rather than management assertions, with a certification of completion submitted to the Agency.
Risk

Risk assessments

When required
Before processing that presents significant risk to consumers’ privacy, such as selling or sharing personal information, processing sensitive personal information, and certain uses of ADMT and automated inferences.
Contents
The purpose, the personal information and operational elements involved, the benefits and negative impacts, and the safeguards that address those impacts.
Submission
An attestation and summary of risk assessment information submitted to the Agency, first due by 1 April 2028.
ADMT

Automated decisionmaking technology

Scope
ADMT used to make significant decisions about consumers, such as decisions on financial or lending services, housing, education, employment or healthcare.
Consumer rights
A pre-use notice, a right to opt out subject to exceptions, and a right to access information about the business’s use of ADMT.
Compliance date
From 1 January 2027 for ADMT used for significant decisions.
Enforcement

Agency, Attorney General and private action

California Privacy Protection Agency
Makes regulations, audits and brings administrative enforcement. Administrative fines under section 1798.155 are adjusted for inflation, at $2,663 per violation or $7,988 per intentional violation or violation involving consumers under 16 from 1 January 2025.
Attorney General
Brings civil actions, with civil penalties under section 1798.199.90 at the same adjusted amounts.
Private right of action
Under section 1798.150, consumers can sue when certain non-encrypted and non-redacted personal information is breached because of a failure to maintain reasonable security. Statutory damages are $107 to $799 per consumer per incident from 1 January 2025, or actual damages if greater.

Implementation roadmap

How to implement it, step by step

A practical sequence for a CCPA programme, including the 2026 regulations.

  1. 1

    Confirm applicability and role

    Test each threshold, decide whether you act as a business, service provider, contractor or third party, and identify exempt information.

    OutputsApplicability noteRole determination
  2. 2

    Map personal information

    Record the categories collected, sources, purposes, retention periods, and to whom information is disclosed, sold or shared. Flag sensitive personal information.

    OutputsData inventoryRetention schedule
  3. 3

    Update notices and opt-out methods

    Publish the notice at collection and privacy policy, add the required opt-out links or alternatives, and make sure opt-out preference signals are honoured.

    OutputsNotice at collectionPrivacy policyOpt-out mechanisms
  4. 4

    Build request handling

    Set up verification and workflows for requests to know, delete, correct, opt out and limit, with the response periods tracked and records kept.

    OutputsRequest procedureRequest log
  5. 5

    Paper the contracts

    Put the required terms into contracts with service providers, contractors and third parties, and decide how you will check their use of the information.

    OutputsContract registerUpdated agreements
  6. 6

    Run risk assessments

    Assess processing that presents significant privacy risk before it starts, and complete assessments for existing processing by 31 December 2027.

    OutputsRisk assessmentsAgency submission plan
  7. 7

    Prepare for the cybersecurity audit

    If the audit applies, choose an independent auditor, align the security programme to the components the regulations list, and plan for the certification date that matches your revenue.

    OutputsAudit scopeCertification timeline
  8. 8

    Govern ADMT and keep it running

    Inventory ADMT used for significant decisions and prepare notices and opt-outs for 1 January 2027. Review the privacy policy every 12 months and track new regulations.

    OutputsADMT inventoryAnnual review record

Audit and evidence guide

What auditors look for, and the evidence to keep

There is no CCPA certification. Compliance is tested through Agency audits and enforcement, Attorney General actions, consumer complaints and, for breaches, litigation. From 2028 many businesses will also submit cybersecurity audit certifications and risk assessment information to the Agency.

What reviewers look for

  • A privacy policy that matches actual practice and is updated at least every 12 months
  • Notice at collection given at or before the point of collection
  • Working opt-out links and honouring of opt-out preference signals
  • Requests answered within the response periods, with verification and records
  • Contracts with service providers, contractors and third parties that contain the required terms
  • Purpose limitation and data minimisation shown in retention schedules
  • Treatment of sensitive personal information and the right to limit
  • Reasonable security procedures appropriate to the information held
  • Risk assessments completed before significant-risk processing
  • Cybersecurity audit reports and certifications, where required

Key dates and timelines

Regulations on audits, risk assessments and ADMT in effect1 Jan 2026
ADMT requirements for significant decisions1 Jan 2027
Risk assessments for processing ongoing since before 2026By 31 Dec 2027
First risk assessment submission to the AgencyBy 1 Apr 2028
First audit certification, revenue over $100mBy 1 Apr 2028
First audit certification, $50m to $100mBy 1 Apr 2029
First audit certification, under $50mBy 1 Apr 2030
Privacy policy updateAt least every 12 months
Inflation adjustment of thresholds and amountsOdd-numbered years

Evidence to keep, by area

Examples to guide your evidence library. Your auditor or regulator decides what is sufficient.

Transparency

  • Privacy policy versions
  • Notice at collection
  • Opt-out link and signal handling

Data inventory

  • Personal information categories and sources
  • Purposes and retention schedule
  • Sensitive personal information register

Requests

  • Request log with dates
  • Verification records
  • Responses and denials with reasons

Contracts

  • Service provider and contractor agreements
  • Third-party contracts
  • Oversight records

Security

  • Security policies and controls
  • Incident and breach records
  • Cybersecurity audit report and certification

Risk and ADMT

  • Risk assessments
  • Agency submissions
  • ADMT inventory and pre-use notices

Areas that often need attention

  • A privacy policy that has not been updated in 12 months or does not match practice
  • Opt-out preference signals ignored
  • Requests answered late or without records
  • Service provider contracts missing the required terms
  • No retention periods, so information is kept indefinitely
  • Sensitive personal information not identified
  • Risk assessment and cybersecurity audit deadlines not yet planned
  • Security controls that cannot be shown to be reasonable for the information held

How Netra helps

Where each part of the work lives in Netra

Netra loads the CCPA as requirements, tasks and policies, so privacy obligations sit on the same record as the security work behind them.

Obligations owned and tracked

Task Engine

Requirements arrive as tasks with owners and due dates. Recurring tasks cover the 12-month policy review, contract reviews and assessments.

Status for each obligation

Compliance Centre

Status is derived from completed tasks and evidence, never typed in. One task can satisfy CCPA and other privacy and security frameworks.

Privacy policy and procedures

Policy Hub

A policy library generated at onboarding, with a policy score that rises as the work behind each policy is done.

Consumer requests

Compliance Centre

Data-subject requests such as erasure and export are tracked against a 30-day SLA in Security & Privacy settings, inside the CCPA response period.

Service providers and contractors

Third-Party Risk

Find vendors from what Accounts and Purchase pay, assess them through a vendor portal and record each decision with a rating.

Risk assessments

Risk Manager

A risk register with inherent and residual heatmaps. Risks come down as the linked tasks are completed.

Cybersecurity audit readiness

Audit Centre

Run internal and external audits end to end, with findings and corrective actions, using evidence already in a tamper-evident vault.

Netra organises work, evidence and reviews. It does not by itself establish CCPA compliance, it is not a legal adviser, and it is not a submission channel to the California Privacy Protection Agency. Your legal and privacy teams decide scope, exemptions and how the Act applies to your business.

Common questions

More questions about Netra

Related frameworks

View all frameworks
Privacy

GDPR

Make privacy accountability easier to demonstrate

Privacy

ISO 27701:2019

Keep your privacy programme traceable through change

Security

ISO 27001:2022 (Security Controls)

Make security controls visible through completed work

See CCPA in Netra

See how Netra connects your framework requirements with tasks, evidence and audit follow-up.