CCPA and CPRA Compliance Guide

California's privacy law is the most developed in the United States, and it reaches many companies far from California. A SaaS company in Bengaluru, an agency in London or a start-up in Texas can be in scope if it does business in California and meets one of the thresholds. Since 1 January 2026 new regulations on risk assessments, cybersecurity audits and automated decision-making technology also apply. This guide explains who must comply, what consumers can demand, what service providers must put in their contracts, and the 2026 to 2030 deadlines.

What is the CCPA/CPRA?

The California Consumer Privacy Act is a consumer privacy law that gives California residents control over personal information businesses collect about them. The California Privacy Rights Act, approved by voters in November 2020, amended and expanded it and created a dedicated regulator. Together they are usually referred to as the CCPA.

Full form and definition

CCPA stands for California Consumer Privacy Act of 2018; CPRA stands for California Privacy Rights Act of 2020. "Personal information" is broadly defined as information that identifies, relates to or could reasonably be linked with a particular consumer or household, including identifiers, device data, browsing history, geolocation and inferences. "Sensitive personal information" includes government IDs, account logins, precise geolocation, racial or ethnic origin, health, sex life, biometric and genetic data and the contents of private communications.

Law, standard or certification?

It is a state law with regulations issued by the California Privacy Protection Agency (CPPA). There is no certification.

History and background of the CCPA

The CCPA was passed in June 2018 to head off a stricter ballot initiative and took effect on 1 January 2020. The CPRA, passed by ballot as Proposition 24, took effect on 1 January 2023. It added the right to correct, the right to limit sensitive personal information, "sharing" for cross-context behavioural advertising, contract requirements for service providers, contractors and third parties, and full coverage of employee and B2B data.

In 2025 the CPPA finalised regulations on risk assessments, cybersecurity audits and automated decision-making technology (ADMT), effective from 1 January 2026, with phased deadlines running to 2030.

Why was the CCPA introduced?

Californians had little visibility into the data broker and advertising ecosystem. The law aimed to give consumers transparency and control, and the CPRA aimed to make enforcement sustainable with a dedicated agency.

Main objectives and purpose

• Transparency about collection, use, sale and sharing of personal information.
• Consumer rights to access, delete, correct and opt out.
• Limits on use of sensitive personal information.
• Accountability through contracts, risk assessments and cybersecurity audits.
• Effective enforcement by the CPPA and the Attorney General.

Who needs to comply with the CCPA?

A business is a for-profit entity that collects consumers' personal information, determines the purposes and means of processing, does business in California and meets at least one threshold:

• Annual gross revenue above USD 26,625,000 in the preceding calendar year (adjusted every two years for inflation)
• Annually buys, sells or shares the personal information of 100,000 or more California consumers or households
• Derives 50% or more of annual revenue from selling or sharing personal information

"Consumer" means any California resident, including employees, job applicants and B2B contacts.

Service providers and contractors

IT vendors that process personal information on behalf of a business, such as SaaS providers, hosting companies, development agencies and support outsourcers, are typically service providers or contractors. They must have a written contract with prescribed terms, use the data only for the business purposes in the contract, and assist the business with consumer requests. A vendor that uses client data for its own purposes may be treated as a third party receiving a "sale" or "share".

Geography

California, with reach to businesses anywhere that do business in California. About 20 other US states have passed comprehensive privacy laws with similar but not identical rules, so many companies build a single US privacy programme around the CCPA.

Key requirements of the CCPA

Notices

A notice at collection, a comprehensive privacy policy updated at least every 12 months, a notice of the right to opt out of sale or sharing, and a notice of the right to limit, where applicable.

Consumer rights

• Right to know and access personal information, including in a portable format
• Right to delete
• Right to correct
• Right to opt out of sale and of sharing for cross-context behavioural advertising
• Right to limit use and disclosure of sensitive personal information
• Right to non-discrimination for exercising rights

Businesses must respond to requests to know, delete and correct within 45 calendar days, extendable once by another 45 days with notice.

Opt-out mechanisms

A "Do Not Sell or Share My Personal Information" link (or an alternative opt-out link), a "Limit the Use of My Sensitive Personal Information" link where applicable, and honouring opt-out preference signals such as Global Privacy Control as valid requests. For consumers known to be under 16, sale or sharing requires opt-in consent.

Data minimisation and purpose limitation

Collection, use, retention and sharing must be reasonably necessary and proportionate to the disclosed purposes. Retention periods for each category must be disclosed.

Contracts

Contracts with service providers, contractors and third parties must contain terms required by the statute and regulations, including limits on use and the right to take steps to stop unauthorised use.

Security

Reasonable security procedures appropriate to the nature of the information. A breach of certain unencrypted personal information caused by a failure to maintain reasonable security gives consumers a private right of action for statutory damages.

2026 regulations

Risk assessments, cybersecurity audits and ADMT deadlines

Requirement	Key date
Risk assessments for processing that presents significant risk (for example selling or sharing, sensitive data, certain ADMT uses)	Required for new processing from 1 Jan 2026; attestations and summaries for 2026 and 2027 due 1 Apr 2028
ADMT duties (pre-use notice, opt-out and access) for significant decisions	From 1 Jan 2027
First annual cybersecurity audit certification, businesses with revenue above USD 100 million	1 Apr 2028
Businesses with revenue of USD 50 to 100 million	1 Apr 2029
Businesses with revenue below USD 50 million that meet the audit threshold	1 Apr 2030

Cybersecurity audits apply to businesses whose processing presents significant risk to security, such as those deriving 50% or more of revenue from selling or sharing data, or meeting the revenue threshold while processing large volumes of personal or sensitive information. The audit must be performed by a qualified, independent auditor, which can be internal if independence safeguards are met.

How to implement CCPA compliance: step by step

1. Check applicability against the three thresholds and confirm your role (business, service provider, contractor or third party) for each data flow.
2. Map personal information by category, source, purpose, recipients, retention and whether it is sold or shared.
3. Review advertising and analytics tags to determine whether you "share" data for cross-context behavioural advertising.
4. Update notices and the privacy policy.
5. Implement opt-out links and honour Global Privacy Control signals.
6. Build rights handling with verification, 45-day tracking and records kept for 24 months.
7. Update contracts with service providers, contractors and third parties.
8. Set retention periods per category and automate deletion.
9. Run risk assessments for significant-risk processing and plan for cybersecurity audits if in scope.
10. Assess ADMT use in significant decisions ahead of 1 January 2027.
11. Train staff handling requests.

Documentation required

• Data inventory with categories, purposes, retention and disclosures
• Privacy policy and notices at collection
• Records of consumer requests and responses, kept for at least 24 months
• Service provider, contractor and third party contracts
• Risk assessment reports and attestations
• Cybersecurity audit reports and certifications, where required
• ADMT notices and opt-out records
• Information security policies

Audit and assessment requirements

From 2028, in-scope businesses must complete an annual independent cybersecurity audit and submit a certification of completion to the CPPA. Risk assessment information is also submitted to the agency. The CPPA conducts investigations and audits, and the Attorney General can bring civil actions. The previous mandatory 30-day cure period no longer applies.

Estimated implementation timeline

• Notices, opt-outs, rights handling and contracts: 2 to 4 months
• Risk assessment programme: 2 to 3 months to set up, then per project
• Cybersecurity audit readiness: 6 to 12 months before the first due date
• ADMT review and notices: 2 to 4 months

Cost considerations

• Privacy counsel for applicability, notices and contracts
• Consent and preference management platform supporting GPC
• Engineering work for rights, deletion and retention
• Independent cybersecurity auditor fees from 2028
• Staff time for risk assessments

Benefits of CCPA compliance

• Avoid fines, enforcement and breach litigation.
• Pass US enterprise privacy reviews, which treat the CCPA as the baseline.
• One programme that covers most other US state privacy laws.
• Cleaner advertising and analytics practices.

Risks and consequences of non-compliance

• Administrative fines up to USD 2,663 per violation and USD 7,988 per intentional violation or violation involving minors under 16, as adjusted for inflation; each affected consumer can count as a separate violation.
• Statutory damages in consumer class actions for certain breaches caused by unreasonable security (originally USD 100 to 750 per consumer per incident, now inflation-adjusted), or actual damages if greater.
• Injunctions and public settlements; the Attorney General's 2022 settlement with Sephora (USD 1.2 million) concerned failure to disclose sales and honour Global Privacy Control.

Common implementation mistakes

• Assuming B2B companies are exempt; employee and B2B data have been covered since 2023.
• Not recognising that advertising pixels can be "sharing".
• Ignoring Global Privacy Control signals.
• Using dark patterns in consent and opt-out flows, which make consent invalid.
• Vendor contracts that lack the required terms.
• Missing the 2026 risk assessment and audit timelines.

Compliance challenges for IT companies

• Vendors must prove they act as service providers and do not use client data for their own purposes, including AI training.
• Multi-state complexity: other states have different thresholds and definitions.
• ADMT rules affect HR tech, lending and insurance software.
• Cybersecurity audits require evidence of controls across many components, similar in scope to SOC 2 or ISO 27001 audits.

Best practices and recommendations

• Build one US privacy programme on CCPA requirements, with state-specific adjustments.
• Honour opt-out signals nationwide to simplify engineering.
• Reuse SOC 2 or ISO 27001 evidence for the cybersecurity audit.
• Keep a single data inventory shared with GDPR work.
• Review tags and SDKs quarterly.

Tools and technologies that help

• Consent management platforms with GPC support
• Privacy request portals with identity verification
• Data mapping and discovery tools
• Tag governance and website scanning tools
• Compliance automation platforms for security evidence

Relationship with other compliance frameworks

CCPA and related frameworks

Framework	Relationship
GDPR	GDPR requires a lawful basis for all processing; the CCPA centres on notice and opt-out rights, with opt-in for some cases
ISO 27701	Privacy management system that supports CCPA rights and contracts
HIPAA	PHI governed by HIPAA is exempt from the CCPA, but other health data is not
SOC 2	Security evidence that supports reasonable security and cybersecurity audits

Real-world implementation examples

The following are illustrative composites based on common patterns, not named clients.

B2B SaaS above the revenue threshold

A USD 40 million revenue SaaS company discovered that marketing pixels counted as sharing. It added an opt-out link, honoured GPC, updated vendor contracts and set up a request workflow for customers' end users, routing processor requests to customers.

Indian development agency as service provider

An agency building apps for US retailers added CCPA service provider terms to its master services agreement and committed not to use client data for its own analytics or AI training.

Frequently asked questions

Does the CCPA apply to companies outside California?

Yes, if they do business in California and meet one of the thresholds.

What is the CCPA revenue threshold?

Annual gross revenue above USD 26,625,000, as adjusted for inflation. The amount is reviewed every two years.

Does the CCPA apply to employee data?

Yes. Since 1 January 2023 employee, applicant and B2B contact data are fully covered.

What is the difference between selling and sharing?

Selling is disclosure for money or other valuable consideration. Sharing is disclosure for cross-context behavioural advertising, whether or not money changes hands.

Do we have to honour Global Privacy Control?

Yes. Opt-out preference signals must be treated as valid requests to opt out of sale and sharing.

How long do we have to respond to a request?

45 calendar days, extendable once by another 45 days with notice to the consumer.

What are the CCPA fines?

Up to USD 2,663 per violation or USD 7,988 per intentional violation or violation involving minors, as adjusted for inflation.

Who needs a CCPA cybersecurity audit?

Businesses whose processing presents significant security risk under the regulations, with first certifications due from 1 April 2028 to 1 April 2030 depending on revenue.

Is there a private right of action?

Only for certain data breaches caused by failure to maintain reasonable security.

What are the ADMT rules?

From 1 January 2027, businesses using automated decision-making technology to make significant decisions about consumers must give pre-use notices and, in most cases, offer an opt-out and access to information about the logic.

Conclusion and next steps

The CCPA has grown from a notice-and-opt-out law into a full privacy regime with risk assessments, audits and AI decision rules. Companies that build it once, properly, cover most of the US.

1. Confirm applicability and roles.
2. Fix notices, opt-outs and GPC.
3. Update vendor and client contracts.
4. Set up risk assessments and plan cybersecurity audits.
5. Review ADMT before 2027.

This guide is general information, not legal advice.

How we keep this guide up to date

We review this guide every six months and whenever the CPPA adjusts thresholds and fines, finalises regulations or publishes enforcement decisions, or the legislature amends the law.