Privacy Law Library

California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (Proposition 24)

CCPA/CPRA

Comprehensive privacy

California's comprehensive consumer privacy law. It gives California residents rights to know, delete, correct, opt out of the sale or sharing of their personal information, and limit the use of sensitive personal information, and it bars retaliation for exercising those rights. Proposition 24 (the CPRA, approved November 3, 2020) amended the law, created the California Privacy Protection Agency, and made most changes operative January 1, 2023.

Where
California
Citation
Cal. Civ. Code 1798.100-1798.199.100 (Title 1.81.5)
Status
In force
In force since
2020-01-01
Last amended
2026-01-01
Enforced by
California Privacy Protection Agency (administrative enforcement; now styled CalPrivacy) and California Attorney General (civil actions)
People can sue
Limited
Penalties
Administrative fines (CPPA) or civil penalties (AG) up to $2,500 per violation and $7,500 per intentional violation or violation involving known minors under 16, CPI-adjusted to $2,663 and $7,988 (2025 adjustment). Private action only for data breaches caused by failure to maintain reasonable security: statutory damages $100-$750 per consumer per incident (adjusted to $107-$799) or actual damages, after a 30-day notice for statutory damages (1798.150, 1798.155, 1798.199.90, 1798.199.95(d)).
Applies to
  • For-profit businesses doing business in California that determine the purposes and means of processing consumers' personal information and meet one threshold: annual gross revenue over $25,000,000 as CPI-adjusted (currently $26,625,000); buying, selling, or sharing personal information of 100,000+ consumers or households; or deriving 50%+ of revenue from selling or sharing personal information (1798.140(d))
  • Service providers, contractors, and third parties receiving personal information (1798.100(d), 1798.140)
  • Covers California residents, including employees, job applicants, and B2B contacts (the employee and B2B exemptions expired January 1, 2023)
  • Browser developers must offer an opt-out preference signal setting from January 1, 2027 (1798.136)
  • Excludes medical information governed by CMIA/HIPAA, FCRA-regulated activity, GLBA and CalFIPA data, and other listed data (1798.145, 1798.146)

What a privacy notice must say

  • At or before collection, tell consumers the categories of personal and sensitive personal information collected, the purposes, whether it is sold or shared, and how long each category is kept.Cal. Civ. Code 1798.100(a)
  • Post 'Do Not Sell or Share My Personal Information' and 'Limit the Use of My Sensitive Personal Information' links, or honor an opt-out preference signal instead.Cal. Civ. Code 1798.135(a)-(b)

Rights it gives people

  • Consumers may request deletion of personal information collected from them; the business must also direct service providers and contractors to delete.Cal. Civ. Code 1798.105
  • Consumers may request correction of inaccurate personal information.Cal. Civ. Code 1798.106
  • Consumers may request the categories and specific pieces of personal information collected, and what is sold or shared and to whom.Cal. Civ. Code 1798.110, 1798.115
  • Consumers may opt out of the sale or sharing (cross-context behavioral advertising) of their personal information; opt-in consent is required for known consumers under 16 (parental consent under 13).Cal. Civ. Code 1798.120(a), (c)
  • Consumers may limit the use and disclosure of sensitive personal information (including precise geolocation, health, and neural data) to specified necessary purposes.Cal. Civ. Code 1798.121, 1798.140(ae)

Practices it requires

  • Businesses that develop or maintain a web browser must include an easy-to-find, consumer-configurable opt-out preference signal and explain how it works.Cal. Civ. Code 1798.136 · Only if: Applies to browser developers · From 2027-01-01
  • Limit collection, use, retention, and sharing to what is reasonably necessary and proportionate to the disclosed purposes.Cal. Civ. Code 1798.100(c)
  • Do not discriminate against consumers who exercise their rights; financial incentives require notice and opt-in consent.Cal. Civ. Code 1798.125
  • Respond to verifiable requests free of charge within 45 days (extendable once by 45 days) and offer at least two request methods, including a toll-free number unless online-only.Cal. Civ. Code 1798.130(a)(1)-(2)
  • Contracts with service providers, contractors, and third parties must restrict use of personal information to specified purposes.Cal. Civ. Code 1798.100(d)

Security duties

  • Implement reasonable security procedures and practices appropriate to the nature of the personal information.Cal. Civ. Code 1798.100(e)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Whether any 2026-session CCPA amendments (e.g., AB 1542 on sensitive data sales, SB 923 on deletion scope) are signed; both were on the Governor's desk as of 2026-09-25 with a September 30 deadline.

Research reference, not legal advice.