Does your business collect personal data from California residents? If so, are you confident that your data handling practices meet every legal requirement under state privacy law?
The California Consumer Privacy Act (CCPA) is one of the most significant data privacy regulations in the United States. It gives California residents direct control over how businesses collect, store, share, and sell their personal information. Since its introduction, the law has reshaped the way organisations approach data governance, consumer rights, and regulatory compliance.
This guide breaks down everything you need to know about the California Consumer Privacy Act (CCPA). From who it applies to, to consumer rights, business obligations, penalties, and the latest 2026 updates, this blog covers it all in a clear, practical format.
The California Consumer Privacy Act (CCPA) is a state-level privacy law that went into effect on 1 January 2020. It was designed to give California consumers more transparency and control over the personal data that businesses collect about them.
The CCPA was introduced in response to growing concerns about how companies handle personal data. California lawmakers recognised that consumers had little visibility into what information businesses gathered and how it was used. The act was designed to close that gap by establishing clear rights for consumers and firm obligations for businesses.
It was further strengthened by the California Privacy Rights Act (CPRA), which took effect on 1 January 2023. The CPRA expanded the original CCPA with additional protections, including new rules around sensitive personal information and the creation of a dedicated enforcement body, the California Privacy Protection Agency (CPPA).
The California Consumer Privacy Act (CCPA) defines personal information broadly. It includes any data that identifies, relates to, describes, or could reasonably be linked to a specific consumer or household. This covers names, email addresses, IP addresses, browsing history, purchase records, geolocation data, biometric information, and more.
What sets this definition apart is its scope. Even inferences drawn from consumer behaviour, such as purchasing patterns or search history, count as personal information under this law.
The California Privacy Protection Agency (CPPA) is the primary enforcement body for the California Consumer Privacy Act (CCPA). It has the authority to investigate complaints, conduct audits, and impose administrative fines. The California Attorney General also retains enforcement powers, particularly in cases involving large-scale violations or data breaches.
Not every business falls under the California Consumer Privacy Act (CCPA). The law targets for-profit entities that operate in California and meet specific thresholds.
A business must comply with the CCPA if it meets at least one of the following conditions. It generates annual gross revenue exceeding $25 million. It buys, sells, or shares the personal information of 100,000 or more California consumers, households, or devices each year. Or it earns 50% or more of its annual revenue from selling or sharing consumer personal information.
Even if a company is not physically based in California, it still falls under the CCPA if it collects data from California residents and meets any of these thresholds.
Certain entities are exempt from the CCPA. Non-profit organisations, government agencies, and businesses that do not meet any of the three thresholds are not covered. However, if an exempt entity is controlled by or shares branding with a covered business, it may still be subject to the law.
Additionally, some data types already governed by federal regulations, such as health data under HIPAA or financial data under the Gramm-Leach-Bliley Act, may have separate compliance pathways.
Yes. Any for-profit business worldwide that collects personal information from California residents and meets the eligibility criteria must comply. The CCPA does not restrict itself to businesses physically located within the state. This makes it relevant for companies across the United States and internationally.
The California Consumer Privacy Act (CCPA) grants seven core rights to California residents, giving them meaningful control over their personal data.
Consumers can request details about what personal information a business has collected, the sources of that data, the purpose behind the collection, and the third parties it has been shared with. Businesses must respond to these requests within 45 calendar days.
This right ensures that consumers are not left in the dark about how their data flows through an organisation and its partners.
Consumers have the right to request deletion of their personal information from a business’s records. They can also ask for corrections to inaccurate data. These rights apply to data collected directly from the consumer as well as data obtained through third parties. Understanding how user consent works is essential for handling these requests properly.
Businesses must honour these requests unless specific legal exceptions apply, such as when data is needed to complete a transaction or to comply with another legal obligation.
California residents can opt out of the sale or sharing of their personal information at any time. Businesses must provide a clear and visible “Do Not Sell My Personal Information” link on their website. They must also honour opt-out preference signals, including the Global Privacy Control (GPC).
The non-discrimination right ensures that consumers who exercise their privacy rights are not penalised with higher prices, lower quality service, or denial of service.
The California Consumer Privacy Act (CCPA) places several obligations on businesses that go beyond simply responding to consumer requests.
Every covered business must publish a comprehensive privacy policy on its website. This policy must disclose the categories of personal information collected, the purposes for collection, the categories of third parties with whom data is shared, and the specific rights available to consumers.
The privacy policy must be updated at least once every 12 months and be written in clear, accessible language.
Businesses are expected to limit data collection to what is reasonably necessary for the stated purpose. They must also classify their vendors correctly, distinguishing between service providers, contractors, and third parties. Each category carries different contractual requirements under the CCPA. For businesses handling sensitive personal information, additional safeguards apply.
Contracts with service providers must include specific clauses restricting how shared data can be used, ensuring it is not repurposed or sold without authorisation.
Businesses must establish at least two methods for consumers to submit requests, such as a toll-free number and an online form. Once a request is received, the business has 45 days to respond, with the option to extend by another 45 days if necessary.
Verification of the consumer’s identity is required before fulfilling any request. Businesses must also train staff who handle consumer enquiries to ensure compliance.
Non-compliance with the California Consumer Privacy Act (CCPA) carries significant financial and legal consequences for businesses.
The California Privacy Protection Agency (CPPA) can impose fines of $2,500 per unintentional violation and $7,500 per intentional violation. Violations involving the data of minors under 16 also carry fines of $7,500 each. These penalties are assessed per violation, per consumer, meaning costs can escalate rapidly for systemic issues.
In the event of a data breach caused by a business’s failure to implement reasonable security measures, affected consumers can file lawsuits seeking statutory damages of $100 to $750 per consumer per incident, or actual damages, whichever is greater. Recent enforcement actions have resulted in settlements ranging from $375,000 to $1.2 million.
Enforcement has become more proactive since the CPPA took over from the Attorney General’s office. The agency now conducts its own investigations, issues compliance orders, and has signalled a focus on automated decision-making violations, failure to honour opt-out signals, and inadequate data security. Understanding the differences outlined in GDPR vs CCPA comparisons can help businesses benchmark their compliance across both frameworks.
The California Consumer Privacy Act (CCPA) received important regulatory updates that took effect on 1 January 2026, expanding business obligations further.
Businesses that process sensitive data or engage in large-scale data operations must now conduct documented risk assessments. These assessments evaluate whether the benefits of processing personal information outweigh the potential risks to consumers. Results must be retained and made available for regulatory review.
New regulations require businesses using AI or machine learning for significant consumer decisions to provide clear pre-use notices. These notices must explain how the technology works and its potential impact on the consumer. In certain cases, businesses must offer meaningful human alternatives.
Full enforcement of ADMT obligations is expected to begin on 1 January 2027, giving businesses a transition period to adjust.
Annual cybersecurity audits will be phased in between April 2028 and 2030 based on company revenue. These audits will assess access controls, incident response procedures, and vendor contracts. Businesses that already maintain strong compliance frameworks, including those tracking key updates in CCPA, will be better positioned to meet these requirements.
The California Consumer Privacy Act (CCPA) and the General Data Protection Regulation (GDPR) are the two most referenced data privacy laws globally, but they differ in several fundamental ways.
The GDPR operates on an opt-in model, requiring explicit consent before most types of data processing. The CCPA, by contrast, follows an opt-out approach. Businesses can collect and process personal information by default, but must allow consumers to opt out of data sales and sharing.
The GDPR applies to any organisation processing data of EU residents, regardless of size. The CCPA applies only to for-profit businesses meeting specific thresholds. GDPR fines can reach up to 4% of global annual turnover, whilst CCPA penalties are assessed per violation at $2,500 or $7,500.
Another key difference is the private right of action. The CCPA allows consumers to sue in cases of data breaches, whilst the GDPR does not include a direct private litigation pathway.
Both laws recognise categories of sensitive data, but handle them differently. The GDPR prohibits processing sensitive data unless a specific legal basis applies. The CCPA allows processing but gives consumers the right to limit its use. Businesses managing both frameworks often rely on a cookie consent management platform to streamline compliance across multiple jurisdictions.
Meeting the requirements of the California Consumer Privacy Act (CCPA) involves a structured approach across several operational areas.
Compliance is not a one-time task. It requires ongoing monitoring, policy updates, and staff training to keep pace with evolving regulations.
Beyond avoiding fines, the California Consumer Privacy Act (CCPA) compliance delivers tangible business benefits that extend across operations.
When consumers know their data is handled responsibly, trust increases. That trust directly influences engagement, retention, and long-term loyalty. Transparent practices around opt-in vs opt-out choices make consumers more willing to share their information voluntarily.
Proactive compliance reduces the likelihood of enforcement actions, lawsuits, and the reputational damage that comes with public violations. The cost of non-compliance consistently exceeds the cost of building a proper privacy programme.
CCPA compliance forces businesses to organise their data practices. This improved data governance leads to better decision-making, more efficient operations, and a clearer understanding of what data you actually need versus what you are collecting unnecessarily.
The California Consumer Privacy Act (CCPA) is not just a legal checkbox. It is a framework that shapes how businesses collect, manage, and protect consumer data. With 2026 updates adding risk assessments, ADMT rules, and upcoming cybersecurity audits, staying ahead of compliance is more important than ever. Businesses that treat CCPA as a foundation for responsible data practices will build stronger consumer relationships and reduce regulatory risk.
Seers.ai provides a complete compliance platform designed to simplify CCPA obligations for businesses of all sizes. From automated consent management to privacy policy generation and consumer request handling, Seers helps you stay compliant without the complexity.
START FREE TODAYNon-profit organisations, government agencies, and for-profit businesses that fall below all three eligibility thresholds are exempt from the CCPA. However, entities controlled by or sharing branding with covered businesses may still need to comply. Some data governed by federal laws like HIPAA or the Gramm-Leach-Bliley Act may follow separate compliance pathways rather than CCPA rules.
The CCPA requires businesses to obtain opt-in consent before selling personal information of consumers under 16 years old. For children under 13, a parent or guardian must provide that consent. Violations involving minors carry higher penalties of $7,500 per incident. Businesses that knowingly target younger audiences must build specific consent workflows into their data collection processes.
When a consumer submits a deletion request, the business must also notify any service providers or third parties that received the data to delete it from their systems. There are limited exceptions, such as when the data is needed for legal compliance or fraud detection. Businesses must maintain records of these downstream notifications to demonstrate they fulfilled their obligations completely.
The CCPA requires businesses to treat a Global Privacy Control signal as a valid opt out of data sale and sharing. This means if a consumer’s browser sends a GPC signal, the business must honour it automatically without requiring the consumer to take any additional action. Failing to recognise GPC signals has already been the basis for enforcement actions by the California Attorney General.
The CPRA amendment removed the temporary exemptions that previously excluded employee and job applicant data from CCPA coverage. Since 1 January 2023, businesses must extend the same privacy rights to their workforce, including the right to know, delete, correct, and opt out. This means HR departments must update their data handling processes to comply with these expanded obligations.
A CCPA risk assessment is a documented evaluation of whether data processing activities pose significant risks to consumer privacy. It applies to businesses that process sensitive personal information or conduct large-scale data operations. The assessment must weigh the benefits of data processing against potential harms to consumers and be retained for regulatory review upon request.
The CCPA requires businesses to review and update their privacy policy at least once every 12 months. The policy must accurately reflect current data collection practices, categories of personal information processed, purposes of collection, third-party sharing arrangements, and the rights available to consumers. Outdated or inaccurate privacy policies can be considered a violation.
Ignoring an opt-out request is treated as a violation of the California Consumer Privacy Act (CCPA). The California Privacy Protection Agency can impose fines of $2,500 for unintentional violations and $7,500 for intentional ones. Repeated failures to honour opt-out requests, including GPC signals, can lead to formal investigations, compliance orders, and public enforcement actions that damage both finances and reputation.
Small businesses that fall below all three CCPA thresholds are not directly covered by the law. However, if a small business handles data on behalf of a covered entity as a service provider, it must still meet certain contractual obligations. Additionally, as consumer expectations around privacy grow, many smaller businesses are voluntarily adopting CCPA-aligned practices to build trust and prepare for potential threshold changes.
A service provider processes personal information on behalf of a business under a written contract that restricts how the data can be used. A third party receives personal information for its own purposes, which may include targeted advertising. The distinction matters because sharing data with third parties triggers additional consumer rights, including the right to opt out of that sharing entirely.
Rimsha ZafarRimsha is a Senior Content Writer at Seers AI with over 5 years of experience in advanced technologies and AI-driven tools. Her expertise as a research analyst shapes clear, thoughtful insights into responsible data use, trust, and future-facing technologies.
Take our Free Cookie Audit and find out
Join 50,000+ websites using Seers.Ai to turn compliance into trust, insights, & measurable business growth.
