California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) (CCPA/CPRA)
California has enacted the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) (CCPA/CPRA). The law is currently in effect. It applies to annual gross revenue >$25m or processes personal data of >=100,000 consumers/households or derives >=50% of annual revenue from selling personal data. Consumers have the right to delete their data, correct inaccurate data, opt out of data sales. Violations can result in penalties of up to $7,500 per violation.
Important Notes
CCPA originally effective January 1, 2020. Significantly amended by CPRA (Prop 24), effective January 1, 2023. Enforcement of CPRA provisions began July 1, 2023.
Privacy Compliance Tools — Partner Services
Need help achieving CCPA/CPRA compliance? These tools help businesses manage consent, honor consumer requests, and maintain audit-ready records.
Sponsored. DataTactic may earn a referral fee from these partners. This does not affect our data or editorial content.
What is the CCPA/CPRA and who does it apply to?
The California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) (CCPA/CPRA) is California's comprehensive consumer privacy law, effective January 1, 2023. Annual gross revenue >$25M OR processes personal data of >=100,000 consumers/households OR derives >=50% of annual revenue from selling personal data
What rights do California consumers have under CCPA/CPRA?
Under the CCPA/CPRA, California consumers have the right to: access their personal data, request deletion of their data, correct inaccurate data, obtain a portable copy of their data, opt out of the sale of their personal data, opt out of targeted advertising, opt out of profiling for significant decisions, appeal a denial of their privacy rights request.
Does CCPA/CPRA require consent for sensitive data?
Yes. The CCPA/CPRA requires businesses to obtain affirmative consent before processing sensitive personal data. This includes data such as health information, biometric data, precise geolocation, and other sensitive categories.
What are the penalties for violating CCPA/CPRA?
Violations of the CCPA/CPRA can result in civil penalties of up to $7,500 per violation and up to $7,500 per willful violation. Note: Limited: data breach only, $100-$750 per consumer per incident or actual damages.
Does CCPA/CPRA require a data protection assessment?
Yes. The CCPA/CPRA requires businesses to conduct data protection assessments for high-risk processing activities such as targeted advertising, sale of personal data, sensitive data processing, and certain profiling activities.
Is there a universal opt-out requirement under CCPA/CPRA?
Yes. The CCPA/CPRA requires businesses to recognize universal opt-out preference signals effective 2023-01-01. This means businesses must honor browser-based or device-level opt-out signals such as Global Privacy Control (GPC).
How long does a business have to respond to a consumer request under CCPA/CPRA?
Businesses must respond to consumer privacy requests within 45 days under the CCPA/CPRA. An extension of up to 90 additional days is available with notice to the consumer. If a request is denied, businesses must provide an appeals process with a response within null days.
Official Source
California Privacy Protection Agency (CPPA)
More California Resources
Data Methodology
DataTactic researchers verify privacy law data directly against official government sources — California Privacy Protection Agency (CPPA) publications, state statutes, and agency websites. Each data point is cross-referenced against primary sources before publication. Records are reviewed and updated when laws or requirements change.
Last verified: 2026-06-01 · DataTactic provides reference information only. This is not legal advice. Consult a qualified attorney for compliance guidance.