Who has to comply with the CCPA/CPRA?

A for-profit business doing business in California that meets any one of three thresholds: over $26.625M annual revenue (CPI-adjusted from Jan 1 2025), buying/selling/sharing PI of 100,000+ consumers or households, or deriving 50%+ of revenue from selling or sharing PI. Location in California is not required. Nonprofits and government are generally exempt.

What consumer rights does the CCPA grant in 2026?

California residents can know/access, delete, correct, opt out of sale or sharing, and limit use of sensitive personal information, and businesses must honour the Global Privacy Control signal. Most verifiable requests must be answered within 45 calendar days (extendable by 45).

What changed in CCPA compliance on January 1, 2026?

CPPA regulations on automated decision-making technology (ADMT), risk assessments, and cybersecurity audits generally took effect Jan 1, 2026. Covered businesses that sell/share, process sensitive PI at scale, or use ADMT may need documented risk assessments and, for higher-risk processing, regular cybersecurity audits.

What are the CCPA penalty amounts?

Civil penalties are $2,500 per unintentional violation and $7,500 per intentional violation or violation involving a minor, calculated per consumer and per incident (Cal. Civ. Code 1798.155). A separate private right of action applies to certain data-breach scenarios.

Does the CCPA require a cookie banner like the GDPR?

The CCPA does not use the GDPR/ePrivacy consent-banner model, but it does require accurate disclosures of tracking and a working Do Not Sell or Share My Personal Information mechanism, and you must honour GPC. Cookie and tracker disclosures must match your privacy notice - see the cookie consent guide for the EU side.

CCPA/CPRA compliance guide for California privacy (2026)

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA), is the most comprehensive US state privacy law and the one many non-California businesses still have to obey. The CCPA took effect January 1, 2020; the CPRA — passed by ballot initiative in November 2020 — substantially amended it, with most provisions operational since January 1, 2023 (Recording Law — California data privacy laws; Security Compliance Guide). "CCPA compliance" in 2026 means the combined CCPA/CPRA framework, enforced by both the California Privacy Protection Agency (CPPA) and the Attorney General. If you also serve EU visitors, the GDPR compliance guide covers the parallel regime.

1. Who must comply (the three thresholds)

A for-profit business that does business in California and meets any one of these triggers is in scope (Jackson Lewis — CCPA FAQs):

Annual gross revenue over $26.625 million (CPI-adjusted from the original $25M, effective Jan. 1, 2025);
Buys, sells, or shares the personal information of 100,000 or more consumers or households; or
Derives 50% or more of annual revenue from selling or sharing consumers' personal information.

Physical presence in California is not required — an online retailer in another state (or country) that meets a threshold must comply. Nonprofits and government agencies are generally exempt, though control-chain and common-branding rules can pull related entities in.

2. The consumer rights you must honour

California residents hold an expanded set of rights, and you need working workflows to answer verifiable requests, usually within 45 calendar days (extendable by another 45): right to know/access, delete, correct, opt out of sale or sharing, and limit use of sensitive personal information (Recording Law). You must also honour the Global Privacy Control (GPC) signal as an opt-out. "Sensitive personal information" — SSNs, financial account credentials, precise geolocation, health, biometric, genetic, and similar — gets its own "limit use" right (Dataci — CCPA 2026).

3. New in 2026: risk assessments, cybersecurity audits, ADMT

Regulations adopted by the CPPA in 2025 — covering automated decision-making technology (ADMT), risk assessments, and cybersecurity audits — generally took effect January 1, 2026 (Jackson Lewis — clarifying regulations effective 1.1.26). Covered businesses that sell/share, process sensitive PI at scale, or use ADMT may need documented risk assessments and, for elevated-risk processing, regular cybersecurity audits. This pulls California meaningfully closer to GDPR's accountability model. A data inventory is the foundation both for rights requests and for these assessments.

4. Enforcement and penalties

The CPPA and the AG can pursue civil penalties of $2,500 per unintentional violation and $7,500 per intentional violation (or violations involving minors), calculated per consumer and per incident (Cal. Civ. Code §1798.155) (Security Compliance Guide). 2025 settlements included Tractor Supply ($1.35M), American Honda ($632,500), and Todd Snyder ($345,178). The statutory private right of action for certain breaches adds separate exposure.

5. A practical CCPA/CPRA checklist

Run the threshold test — revenue, 100k consumers, or 50% revenue from sale/share.
Build a data inventory of what PI you collect and where it flows (see PII detection methods).
Publish an accurate privacy notice — categories, purposes, recipients, retention, SPI.
Stand up rights-request workflows with 45-day SLAs and GPC honouring.
Add "Do Not Sell or Share" and "Limit Use of SPI" links.
Sign compliant vendor contracts limiting secondary use.
Prepare risk assessments / cybersecurity audits if 2026 regs apply.
Align cookie and tracker disclosures with your notice (see cookie consent best practices).

Decision-support note. PrivScan can surface likely privacy gaps — undisclosed trackers, missing or weak consent UX, and data-collection points — and return a prioritized checklist mapped to obligations like notice accuracy and opt-out mechanisms. It is a scanner, not legal advice, and does not certify CCPA/CPRA compliance.