CCPA and CPRA, California privacy rights made practical
Check if the law applies to you and set up notices, opt-outs and request handling.
Official sources
Use these official places to read the text and find the latest version.
Official website
The California Attorney General explains the law. The CPPA publishes regulations.
Visit oag.ca.gov/privacy/ccpa ↗Get the document
The law and regulations are free to read online. The California Attorney General and the California Privacy Protection Agency, now branded CalPrivacy, publish them.
Open the official page ↗What CCPA and CPRA is
The California Consumer Privacy Act gives California residents rights over their personal information: to know, delete, correct and opt out of sale or sharing. The California Privacy Rights Act strengthened it and created a dedicated regulator.
It applies to for-profit businesses doing business in California that meet any one of three tests: revenue above a set figure that is adjusted for inflation, handling data of 100,000 or more consumers or households, or earning half or more of revenue from selling or sharing personal information.
How CCPA and CPRA got to where it is today
The milestones that changed what organisations have to do.
CCPA passed
California enacts the first broad US state privacy law.
CCPA in effect
Enforcement begins July 2020.
CPRA approved
Voters approve the CPRA amendments in November 2020.
CPRA applies
Most CPRA provisions apply from January 2023.
Dates are for orientation. The official website holds the authoritative record.
Do you need it?
If any of these sound familiar, probably yes.
You have California customers.
You sell or share personal data for advertising.
You hit the revenue or data thresholds.
You need to answer data requests.
What it asks of you
The requirements fall into six areas.
Notice at collection
Tell people what you collect and why.
Consumer rights
Know, delete, correct, opt out.
Opt-out of sale and sharing
A clear “Do Not Sell or Share” choice.
Sensitive data
Limits on use of sensitive information.
Service providers
Contracts with vendors.
Enforcement
Fines per violation.
The 5 areas, 13 provisions and 36 obligations of the CCPA and CPRA
The CCPA gives California residents rights over their personal information and sets duties for covered businesses. The CPRA expanded it, added sensitive data rules and created a dedicated regulator.
13 provisions · 36 obligations
Applicability and definitionsWhether and how the law applies to your business.1 provision · 4 obligations
- 1798.140 (business)
Check whether you do business in California and meet one of three tests: annual gross revenue above the statutory threshold (USD 25 million, adjusted for inflation), buying, selling or sharing personal information of 100,000 or more consumers or households, or earning half or more of revenue from selling or sharing personal information.
What you do
- Document the test used
- Re-test each year
- 1798.140 (consumer)
Remember that 'consumer' means any California resident, including employees and business contacts since the exemptions ended on 1 January 2023.
What you do
- Include HR and B2B data in scope
- Update notices for staff and contacts
- 1798.140 (sell, share)
Understand 'sell' as disclosure for monetary or other valuable consideration and 'share' as disclosure for cross-context behavioural advertising.
What you do
- Map ad-tech and analytics tags
- Classify each disclosure
- 1798.145
Apply the listed exemptions, such as certain regulated financial, health and research data, only to the extent they truly cover the data.
What you do
- Record the exemption relied on
- Review annually
Evidence to keep
- Applicability assessment
- Revenue and consumer-count analysis
Consumer rightsWhat Californians can ask of you.4 provisions · 9 obligations
- 1798.110
Disclose on request the categories and specific pieces of personal information collected, sources, purposes and categories of third parties.
What you do
- Search all systems
- Return data in portable form
- 1798.115
Disclose categories of personal information sold or shared and disclosed for a business purpose, and to whom.
What you do
- Maintain disclosure records
- Update annually
Evidence to keep
- Privacy policy
- Request log
- Response samples
- 1798.105
Delete a consumer's personal information on a verified request and tell service providers and contractors to do the same, subject to listed exceptions.
What you do
- Maintain a deletion runbook
- Record exceptions
- 1798.106
Correct inaccurate personal information on a verified request, using commercially reasonable efforts.
What you do
- Provide a correction route
- Verify supporting documents proportionately
Evidence to keep
- Deletion log
- Service provider notification records
- 1798.120(a)
Let consumers direct you not to sell or share their personal information.
What you do
- Provide the opt-out mechanism
- Stop onward disclosure promptly
- 1798.120(c)
Do not sell or share personal information of consumers you know are under 16 without opt-in, using parent or guardian consent for those under 13.
What you do
- Capture age signals
- Store consent records
- 1798.121
Let consumers limit use of sensitive personal information to what is necessary to provide the service.
What you do
- Publish a limit-use mechanism
- Honour it across systems
- 1798.135
Show clear 'Do Not Sell or Share My Personal Information' and 'Limit the Use of My Sensitive Personal Information' links, or a single alternative link, and honour opt-out preference signals such as Global Privacy Control.
What you do
- Test GPC on your site
- Wait at least 12 months before asking again to opt in
Evidence to keep
- Opt-out link screenshots
- Global Privacy Control test results
- Minor opt-in records
- 1798.125
Do not deny goods, charge different prices or reduce service quality because someone exercised a right, except for permitted financial incentives tied to the value of the data and with notice and opt-in.
What you do
- Review loyalty programmes
- Document the value basis
Evidence to keep
- Pricing and loyalty programme review
Business dutiesNotices, minimisation, contracts and handling requests.6 provisions · 17 obligations
- 1798.100(a)
Provide a notice at or before collection listing categories of personal information and sensitive personal information, purposes, whether sold or shared, and retention.
What you do
- Place the notice on every collection point
- Include offline collection
- 1798.130(a)(5)
Describe consumer rights and your practices in an online privacy policy and update it at least once every 12 months.
What you do
- Schedule an annual review
- Record the update date
- 1798.100(b)
If a third party controls collection on your site, make sure the notice at collection covers it.
What you do
- Review tags and pixels
- Contract for notice
Evidence to keep
- Notice at collection
- Privacy policy with date
- Notice of financial incentive
- 1798.100(c)
Keep collection, use, retention and sharing reasonably necessary and proportionate to the disclosed purpose or a compatible one.
What you do
- Review data fields
- Check compatibility of new uses
- 1798.100(a)(3)
Do not keep personal information longer than reasonably necessary for the disclosed purposes.
What you do
- Set retention periods
- Delete on schedule
Evidence to keep
- Retention schedule
- Purpose map
- 1798.100(d)
Sign contracts with third parties, service providers and contractors that restrict use to specified purposes, require CCPA-level protection and allow you to take steps to stop misuse.
What you do
- Use a CCPA-ready addendum
- Audit key vendors
- 1798.140 (service provider)
Treat service providers as those who process on your behalf under a written contract that bars selling, sharing, retaining or using data outside the contract.
What you do
- Check each vendor agreement
- Keep a vendor list
- 1798.140 (third party)
Treat any recipient outside those categories as a third party and apply sale or sharing rules.
What you do
- Classify each recipient
- Offer opt-out where applicable
Evidence to keep
- Data processing addenda
- Vendor register
- Third-party contracts
- 1798.130(a)(1)
Offer two or more designated methods for requests, including a toll-free number unless online-only, and a website method if you have one.
What you do
- Provide web form and phone number
- Test them quarterly
- 1798.130(a)(2)
Respond within 45 days of a verifiable request, extendable once by 45 more days with notice.
What you do
- Log request date and due date
- Send an acknowledgement
- 1798.130(a)(3)
Cover the 12 months before the request for access, and allow longer periods where data is held beyond that, and accept no more than two access requests per consumer in 12 months.
What you do
- Define the lookback
- Track request count
- Regulations
Train staff handling requests and keep records of requests and responses for at least 24 months.
What you do
- Retain request logs
- Use a training programme
Evidence to keep
- Request intake methods
- Verification procedure
- Response timeline log
- 1798.100(e)
Implement reasonable security procedures appropriate to the nature of the information.
What you do
- Adopt a recognised control set
- Encrypt sensitive data
- 1798.150
Be aware that consumers may sue for certain data breaches caused by failure to maintain reasonable security, with statutory damages of USD 100 to 750 per consumer per incident.
What you do
- Reduce stored sensitive data
- Test incident response
Evidence to keep
- Security programme documentation
- Breach response plan
- Incident logs
- CPPA regs: risk assessment
Carry out and document a risk assessment for high-risk processing such as selling or sharing, sensitive data, or certain automated decision-making, and submit summaries to the agency as required.
What you do
- Create a risk assessment template
- Track regulation timelines
- CPPA regs: cybersecurity audit
Complete an independent annual cybersecurity audit if your processing presents significant security risk.
What you do
- Scope audit by risk
- Plan for first audit date
- CPPA regs: ADMT
Give pre-use notice, opt-out and access rights where you use automated decision-making technology for significant decisions.
What you do
- Inventory such tools
- Add opt-out route
Evidence to keep
- Risk assessment reports
- Cybersecurity audit report
- ADMT notices
Sensitive personal informationA defined set of data gets extra protection.1 provision · 2 obligations
- 1798.140 (sensitive personal information)
Identify sensitive personal information such as government ID numbers, account log-ins with credentials, precise geolocation, racial or ethnic origin, religious beliefs, union membership, mail and message contents, genetic and biometric data, health data and sexual orientation.
What you do
- Tag fields in your data inventory
- Collect only when needed
- 1798.121 (use limit)
Use sensitive personal information only for permitted purposes unless the consumer is given the right to limit and you honour it.
What you do
- Map uses
- Document which uses are exempt from limiting
Evidence to keep
- Sensitive data inventory
- Limit-use configuration
EnforcementWho enforces and the penalties.1 provision · 4 obligations
- 1798.199.10
Note the California Privacy Protection Agency is the dedicated regulator with powers to investigate, hold hearings and issue orders.
What you do
- Monitor enforcement actions
- Prepare a regulator response plan
- 1798.155
Expect administrative fines of up to USD 2,500 per violation or USD 7,500 per intentional violation or violation involving minors under 16, adjusted for inflation.
What you do
- Prioritise controls for minors and opt-outs
- Document remedial action
- 1798.199.90
Expect the Attorney General may bring civil actions for the same level of penalties.
What you do
- Track AG sweeps
- Review sector guidance
- 1798.185
Follow regulations issued by the agency, which add detail on notices, opt-outs, verification and service provider terms.
What you do
- Subscribe to agency updates
- Revise policies when rules change
Evidence to keep
- Enforcement risk register
- Evidence of cure steps
Nothing matches. Clear the search or pick another area.
Outcomes and implementation examples are from California Consumer Privacy Act, Civil Code sections 1798.100 to 1798.199.100, published by NIST. Descriptions of what to do and the evidence lists are our own plain-English guidance. Check the official source for the authoritative text.
Your path to getting started
Five steps from first look to ready. Effort depends on your size and starting point.
- 1
Check applicability
Thresholds.
- 2
Map personal information
Categories and sources.
- 3
Update notices
And opt-out links.
- 4
Set up request handling
The standard response time is 45 days, with one extension where allowed.
- 5
Fix vendor contracts
Service provider terms.
How Optimus GRC helps
Each area maps to a part of the platform, so the work and the evidence sit together.
| What it asks | What you do in Optimus GRC |
|---|---|
| Notice at collection | Notice templates |
| Consumer rights | Request tracker |
| Opt-out of sale and sharing | Opt-out records |
| Sensitive data | Data inventory |
| Service providers | Vendor register |
| Enforcement | Evidence pack |
Free CCPA and CPRA readiness checklist
A one-page PDF you can print or share with your team. No sign-up needed.
Download the checklist (PDF)- Privacy notice starter
- Request response templates
- Data inventory
- Vendor addendum outline
Share or cite this page
Writing about CCPA and CPRA? You are welcome to link to this guide. Copy the link below.
<a href="/frameworks/ccpa-cpra/">CCPA and CPRA explained in plain English - Optimus CyberX</a>Common questions
Does it apply to us?
If you meet one of the thresholds and handle California residents’ data. Check the current inflation-adjusted revenue figure on the Attorney General or CalPrivacy site.
Is there a certificate?
No. There is no CCPA certificate. You show compliance through accurate notices, working opt-outs and records of how you handle requests.
Is it like GDPR?
Similar in spirit, different in detail. The CCPA focuses on rights to know, delete, correct and opt out of sale or sharing.
Who enforces it?
The California Privacy Protection Agency and the Attorney General.
Related frameworks
See how ready you are for CCPA and CPRA
Answer questions across every area. We email you a report showing where you comply and where you do not.