Most companies meet the California Consumer Privacy Act through a lawyer's email rather than a customer's request. Somebody read your privacy policy, noticed it does not carry the link the statute requires, and priced that observation. The reflex answer is that you are not a California company, which is true and irrelevant: the law reaches any for-profit business doing business in California that crosses one of three thresholds, and the thresholds count data rather than offices.
What follows is what the statute says, with the section number behind every requirement.
What Is the CCPA?
The California Consumer Privacy Act of 2018 gives California residents enforceable rights over the personal information companies hold about them, and puts matching duties on the companies. Civil Code section 1798.198(a) makes the title operative January 1, 2020.
Two words carry the confusion. A consumer is a California resident, not a customer: a job applicant, an employee and a one-time form filler all qualify, because the rights attach to the person rather than the relationship. Personal information is anything that identifies, relates to, describes or could reasonably be linked with a particular consumer or household, which pulls in online identifiers and inference profiles.
Two regulators enforce it. The Attorney General brings civil actions, and the California Privacy Protection Agency, created by the 2020 ballot measure, handles administrative enforcement and rulemaking. From July 1, 2023 consumers can file complaints with the Agency too.
What Did the CPRA Change?
The California Privacy Rights Act is not a second law. It amended the CCPA, so "CCPA vs CPRA" is a question about dates rather than competing regimes.
According to the Attorney General, California voters approved Proposition 24 in November 2020, and its added protections began on January 1, 2023. It created the Agency, added a right to correct, carved out sensitive personal information with its own right to limit, added "shares" alongside "sells" throughout, raised the volume threshold, and let the employee and business-to-business exemptions expire.
- The CCPA becomes operative under Civil Code section 1798.198(a)
- California voters approve Proposition 24, the CPRA, amending the CCPA
- CPRA protections begin, and the employee and business-to-business exemptions in section 1798.145 expire
- Consumers can file CCPA complaints with the California Privacy Protection Agency
- First inflation adjustment of the monetary thresholds, then every odd-numbered year
- General Motors settles for $12,750,000, the largest CCPA settlement announced to date
That exemption change deserves a pause. Section 1798.145 subdivisions (m) and (n) became inoperative on January 1, 2023, so HR files, applicant records and contractor data now carry the same rights as customer data. A program scoped around the marketing database has a gap nobody has looked at.
Who Has to Comply With the CCPA?
You must be a for-profit entity collecting California residents' personal information that does business in California, and cross at least one of three thresholds.
The revenue figure is not fixed. Section 1798.199.95(d) directs the Agency to adjust the monetary thresholds on January 1, 2025 and every odd-numbered year after, using the change in the California Consumer Price Index. A company near the line should check the Agency's published figure rather than the code text.
Nonprofits are not for-profit entities and government agencies are not businesses, so both sit outside the definition. So does an operation clearing none of the three thresholds, which is why a small business with a few thousand California customers and no advertising data flow usually has no CCPA obligations at all.
What Rights Does the CCPA Give Consumers?
Six rights, each with its own section. The Attorney General lists them together; the section numbers are what a request letter will cite.
| Right | Section | What the consumer can demand |
|---|---|---|
| Know | 1798.100, 1798.110, 1798.115 | The categories and specific pieces collected, the sources, the purposes, and who received them |
| Delete | 1798.105 | Deletion of personal information collected from them, subject to the listed exceptions |
| Correct | 1798.106 | Correction of inaccurate personal information |
| Opt out of sale or sharing | 1798.120 | That you stop selling or sharing their personal information with third parties |
| Limit sensitive personal information | 1798.121 | That you restrict sensitive categories to what the service actually requires |
| Non-discrimination | 1798.125 | That exercising a right costs them nothing in price or service quality |
Two rows have teeth people underestimate. Section 1798.120(c) flips the default for minors: data on consumers under 16 cannot be sold or shared without affirmative authorization, from the consumer at 13 to 15 and from a parent or guardian under 13, and willful disregard of age counts as actual knowledge. Section 1798.125(a)(1) separately prohibits retaliating against an employee, an applicant, or an independent contractor for exercising these rights.
Sensitive personal information is defined in section 1798.140(ae): Social Security, driver's license and passport numbers, financial account credentials, precise geolocation, racial or ethnic origin, citizenship, religion, union membership, private communications, genetic and neural data, biometrics used for identification, health information and sexual orientation. Section 1798.121(a) lets a consumer direct you to limit its use to what an average consumer would expect the service to need.
What the CCPA Requires a Business to Do
The obligations that apply whether or not anybody files a request are the half that gets companies fined.
Notice at collection. Section 1798.100(a) requires informing consumers, at or before the point of collection, of the categories collected and the purposes they will be used for.
Data minimization. Section 1798.100(c) states that collection, use, retention and sharing "shall be reasonably necessary and proportionate to achieve the purposes for which the personal information was collected or processed". It is a substantive limit, and the Attorney General used it: the $12.75 million General Motors settlement found practices that violated the CCPA's purpose limitation and data minimization requirements, added in 2023.
Two links, with fixed wording. Section 1798.135(a) requires the titles "Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information". Subdivision (b)(1) recognizes an opt-out preference signal sent by a platform or browser, and the Attorney General is unambiguous that the Global Privacy Control "must be honored by covered businesses as a valid consumer request to stop the sale or sharing of personal information".
Reasonable security. This is the obligation a security team owns.
Because the statute defines reasonable by outcome rather than by control list, the practical answer is to adopt a published framework and show you followed it. The NIST Cybersecurity Framework is the usual US choice, and it produces evidence several other obligations want.
How to Respond to a CCPA Request
The clock goes wrong because it starts on receipt rather than on triage.
Section 1798.130(a)(2) requires disclosing and delivering the information free of charge, correcting inaccurate information, or deleting it, within 45 days of a verifiable consumer request. The period "may be extended once by an additional 45 days when reasonably necessary", which the Attorney General states as 45 calendar days, extendable by another 45 for 90 days total if the consumer is notified. Disclosure covers the 12 months preceding receipt.
Verification sits inside the 45 days rather than before them, so a slow identity check consumes the window rather than pausing it. And one extension means one, with a reason.
What Are the Penalties for CCPA Violations?
Section 1798.155 sets administrative fines of not more than $2,500 for each violation, or $7,500 for each intentional violation and for violations involving the personal information of consumers the business knows are under 16. Section 1798.199.90(a) gives the Attorney General the same amounts as civil penalties in court, and directs the court to consider "the good faith cooperation of the business, service provider, contractor, or other person in determining the amount of the civil penalty."
The damaging word is "violation". These are per-violation figures with no cap, which is how one misconfigured opt-out becomes seven figures.
The Disney matter is instructive because nothing was breached. The announcement of that $2.75 million settlement describes opt-out toggles that applied to a single device or streaming service rather than the whole account, a webform that did not stop sharing with embedded advertising technology, and Global Privacy Control signals honored on one device while the same logged-in account kept sharing elsewhere. The company had an opt-out. It did not have one that worked.
Can You Be Sued for a Data Breach Under the CCPA?
Yes, and this is the only part a private individual can enforce.
Read the qualifier twice. This section reaches nonencrypted and nonredacted personal information only. Data that was encrypted when it was taken sits outside it, which makes encryption at rest the highest-leverage control in the statute for anyone holding California consumer records. It does not remove the 1798.100(e) duty and it does not stop the regulators, but it takes the class action off the table for that data.
The arithmetic explains why plaintiffs' firms watch breach notifications. At the statutory floor of $100 per consumer per incident, a data breach touching a million California residents carries $100 million of exposure, and the class does not have to prove a loss.
What the CCPA Does Not Require
There is no CCPA certificate, no registry, no accreditation body and no annual filing. Nobody audits you into a status. You are compliant if your practices match the statute and you can show it, and the first authoritative opinion usually arrives as an inquiry letter.
Four federal carve-outs sit in section 1798.145: medical information under the Confidentiality of Medical Information Act and protected health information under the HHS rules, where the HIPAA Security Rule takes over; information subject to the Gramm-Leach-Bliley Act; creditworthiness information held by a consumer reporting agency under the Fair Credit Reporting Act; and information handled under the Driver's Privacy Protection Act of 1994.
The statute also does not require consent to collect. It is an opt-out regime for adults, subject to the minimization limit in 1798.100(c), until the consumer says stop. Opt-in applies under 1798.120(c) for consumers under 16, and under 1798.125(b) for financial incentive programs.
How to Comply With the CCPA
Key takeaways
- Operative since January 1, 2020. The CPRA amended the CCPA rather than replacing it, with its additions effective January 1, 2023.
- Section 1798.140(d)(1) binds any for-profit business doing business in California that exceeds $25,000,000 in gross revenue as adjusted, handles data on 100,000 or more consumers or households, or draws half its revenue from selling or sharing that data.
- That revenue figure is adjusted for inflation every odd-numbered year under section 1798.199.95(d), so the number printed in the statute is not the current one.
- Six rights: know, delete, correct, opt out of sale or sharing, limit sensitive personal information, and non-discrimination. Section 1798.125 also bars retaliation against employees, applicants and contractors.
- Section 1798.100(e) imposes an affirmative reasonable security duty, and 1798.185(a)(14) directs the Agency to require annual cybersecurity audits from higher-risk processors.
- Requests get 45 days under section 1798.130(a)(2), extendable once by 45 more when reasonably necessary.
- Penalties run $2,500 per violation and $7,500 per intentional violation or one involving a consumer known to be under 16, with no cap. Announced settlements reach $12,750,000.
- The private right of action in section 1798.150 covers nonencrypted, nonredacted data only, at $100 to $750 per consumer per incident, which is why encryption at rest is the highest-leverage control in the law.
Common questions
What does CCPA stand for?
California Consumer Privacy Act, enacted in 2018 and codified at Civil Code section 1798.100 and following. CPRA refers to the same statute as amended by Proposition 24, approved in November 2020, whose additions took effect on January 1, 2023.
Does the CCPA apply to companies outside California?
Yes. Nothing in the definition of a business turns on where you are incorporated. If you are a for-profit entity doing business in California that collects residents' personal information and crosses one of the thresholds in section 1798.140(d)(1), it applies.
What is the difference between the CCPA and the CPRA?
Timing, not jurisdiction. The CPRA amended the CCPA, so there is one law and one set of obligations. The amendment created the Agency, added correction and sensitive personal information rights, brought sharing into scope alongside selling, and ended the employee and business-to-business exemptions.
How much can a CCPA violation cost?
Sections 1798.155 and 1798.199.90 both set $2,500 per violation and $7,500 for an intentional violation or one involving a consumer known to be under 16. There is no cap, and the per-violation structure scales the figure with the number of affected consumers rather than the number of mistakes.
Can an individual sue under the CCPA?
Only over a data breach. Section 1798.150 allows a suit when nonencrypted, nonredacted personal information is exfiltrated because the business failed to maintain reasonable security, recovering $100 to $750 per consumer per incident or actual damages, whichever is greater.
Does the CCPA require encryption?
Not by name. Section 1798.100(e) requires reasonable security appropriate to the nature of the information, without listing controls. Encryption matters for a different reason: section 1798.150 excludes encrypted data from the private right of action, so encrypting at rest removes exposure no clause commands you to remove.
How long does a business have to respond to a CCPA request?
45 days from receipt of a verifiable request under section 1798.130(a)(2), extendable once by another 45 when reasonably necessary and the consumer is told. Identity verification happens inside that window rather than before it starts.
Is the CCPA the same as GDPR?
No. The CCPA is an opt-out regime with three applicability thresholds and fixed per-violation dollar penalties. GDPR is a consent-and-lawful-basis regime with turnover-based fines that applies to processing rather than to companies above a size threshold.
Does the CCPA cover employee data?
Yes, since January 1, 2023, when the employment and business-to-business exemptions in section 1798.145 became inoperative. Applicants, employees and contractors now hold the same rights as customers, and section 1798.125(a)(1) separately bars retaliation for exercising them.
Is there a CCPA certification?
There is none. No body certifies CCPA compliance, no registry lists compliant companies and no filing is required. Compliance is a state of affairs you have to evidence, which is why the output is a data map, working opt-out mechanics and security records.
On this page
- What Is the CCPA?
- What Did the CPRA Change?
- Who Has to Comply With the CCPA?
- What Rights Does the CCPA Give Consumers?
- What the CCPA Requires a Business to Do
- How to Respond to a CCPA Request
- What Are the Penalties for CCPA Violations?
- Can You Be Sued for a Data Breach Under the CCPA?
- What the CCPA Does Not Require
- How to Comply With the CCPA
Daniel Reyes
Daniel Reyes is a CISSP who spent twelve years in security operations, most recently leading a detection and response team for a mid-sized healthcare group in Texas. He reviews every resource and breach report on Cyber Security Firms for technical accuracy before it publishes.
Most of the people he has trained arrived having been told too much: a dozen acronyms, six vendors, and no clear idea which risk was theirs. His approach is to explain what an attack actually does before naming the tool that stops it, on the basis that most breaches start with something a reader could have recognised.