The California Consumer Privacy Act is a state privacy law that gives California residents specific rights over how businesses collect, use, share, and sell their personal information. It can apply to a business anywhere in the country, or the world, if that business handles data from California residents and meets certain thresholds.<\/p>\n\n\n\n
The law has changed substantially since it first took effect on January 1, 2020. The California Privacy Rights Act amended it in 2023, and a new set of California Privacy Protection Agency regulations on cybersecurity audits, risk assessments, and automated decision-making took effect on January 1, 2026.<\/p>\n\n\n\n
This guide explains what the CCPA covers today, who has to comply, what changed most recently, and how businesses typically approach compliance. It is for general information only and is not legal advice.<\/p>\n\n\n\n\n\n
The California Consumer Privacy Act, or CCPA, is a state law that gives California residents the right to know, delete, correct, and limit how businesses use their personal information.<\/p>\n\n\n\n
Personal information under the law means data that identifies, relates to, or could reasonably be linked to a specific consumer or household, including names, contact details, online identifiers, geolocation data, and internet browsing activity. The CCPA also creates matching duties for businesses, including posting clear privacy notices, responding to consumer requests within set timelines, and offering opt-out mechanisms for the sale or sharing of data.<\/p>\n\n\n\n
The most significant 2026 change is a new regulatory package covering automated decision-making technology, mandatory cybersecurity audits, and formal risk assessments, finalized by the California Privacy Protection Agency<\/a> in late 2025.<\/p>\n\n\n\n These rules phase in over several years rather than all at once:<\/p>\n\n\n\n For most other businesses, the practical takeaway is that CCPA compliance is now an ongoing governance program, not a checklist to complete once and file away.<\/p>\n\n\n\n A business generally needs to comply with the CCPA if it does business in California, collects personal information from California residents, and meets at least one of three legal thresholds.<\/p>\n\n\n\n As of the 2025 inflation adjustment, those thresholds are:<\/p>\n\n\n\n\n
Businesses using ADMT to make significant decisions about consumers, such as in hiring or lending, must comply with notice and opt-out requirements starting January 1, 2027.<\/li>\n<\/ul>\n\n\n\n\n
Businesses engaged in higher-risk processing, such as selling personal information or using sensitive personal information, must complete risk assessments by December 31, 2027, with the first summary reports due to the CPPA by April 1, 2028.<\/li>\n<\/ul>\n\n\n\n\n
Businesses whose data processing presents a significant security risk must complete independent annual audits, phased in by company size between 2028 and 2030.<\/li>\n<\/ul>\n\n\n\nWho needs to comply with the CCPA?<\/strong><\/h2>\n\n\n\n