How to Be CCPA Compliant in 2026: Business Compliance Guide

What Is CCPA Compliance?

CCPA compliance means meeting the requirements of the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). Together, these laws give California residents control over how businesses collect, use, sell, and share their personal information. Any business that meets certain thresholds and handles data from California residents must comply — regardless of where the business is located.

As of 2026, CCPA is the most actively enforced state privacy law in the US. California regulators have issued over $4 million in fines in the first quarter of 2026 alone, signaling that enforcement is accelerating. For a focused look at the specific 2026 regulatory updates shaping the rules below — expanded opt-out rights, ADMT regulations, and risk-assessment requirements — see our CCPA/CPRA 2026 changes brief.

CCPA Compliance at a Glance (Last Verified: May 8, 2026)

If you are trying to become CCPA compliant, start by separating the legal threshold question from the operational readiness question. A business may be covered because it meets one statutory threshold, but it only looks enforcement-ready when it can prove the notices, opt-out flow, request workflow, vendor controls, and 2026 risk-governance work are actually operating.

Compliance area	2026 requirement to check	Evidence to keep
Applicability	For-profit business doing business in California and meeting one threshold: over $25M revenue, 100,000+ California consumers/households, or 50%+ revenue from selling or sharing California personal information.	Annual threshold memo, revenue backup, California consumer/household count, and sale/share revenue analysis.
Privacy notices	Notice at collection and privacy policy disclosures that explain categories collected, purposes, rights, request methods, and sale/share practices.	Published policy copy, change log, screenshot archive, and annual review owner.
Opt-out and GPC	If you sell or share personal information, provide a working opt-out method and honor opt-out preference signals such as Global Privacy Control.	Homepage/footer screenshots, GPC test logs, tag-manager suppression evidence, and opt-out confirmation logs.
Consumer requests	Receive, verify where needed, and fulfill access, deletion, correction, opt-out, and limit-use requests within the CCPA timelines.	DSAR queue export, request timestamps, verification rules, response templates, and service-provider deletion confirmations.
2026 risk governance	Businesses subject to the new CPPA risk-assessment rules began compliance January 1, 2026; cybersecurity audit certifications are staggered for 2028, 2029, and 2030 depending on revenue tier.	Risk assessment register, significant-risk activity inventory, audit scope, independent-auditor plan, and executive attestation calendar.

Primary sources: California OAG CCPA overview and applicability thresholds (oag.ca.gov/privacy/ccpa, date_retrieved: 2026-05-07); CPPA final regulations announcement covering cybersecurity audits, risk assessments, and ADMT (cppa.ca.gov/announcements/2025/20250923.html, date_retrieved: 2026-05-07); CPPA rulemaking page for approved regulations text (cppa.ca.gov/regulations/ccpa_updates.html, date_retrieved: 2026-05-07).

Does the CCPA Apply to Your Business?

The CCPA applies to for-profit businesses that collect personal information from California consumers and meet any one of these thresholds:

Annual gross revenue exceeds $25 million
Annually buys, sells, or shares the personal information of 100,000 or more California consumers, households, or devices
Derives 50% or more of annual revenue from selling or sharing California consumers' personal information

Not sure if you qualify? Use our Privacy Law Calculator to check which state laws apply to your business in under two minutes.

Key Consumer Rights Under the CCPA

California residents have several rights that your business must be prepared to honor:

Right to Know — consumers can request what personal information you collect, where it comes from, how it is used, and who it is shared with
Right to Delete — consumers can request you delete the personal information you have collected about them
Right to Opt Out — consumers can direct you to stop selling or sharing their personal information
Right to Correct — consumers can request you correct inaccurate personal information
Right to Limit Use of Sensitive Data — consumers can restrict how you use sensitive personal information such as Social Security numbers, precise geolocation, and health data
Right to Non-Discrimination — you cannot penalize consumers for exercising their privacy rights

What Businesses Must Do to Comply

1. Update Your Privacy Policy

Your privacy policy must disclose the categories of personal information you collect, the purposes for collection, consumer rights, and how to submit requests. It must be updated at least once every 12 months.

2. Provide Opt-Out Mechanisms

If you sell or share personal information, your website must display a clear "Do Not Sell or Share My Personal Information" link. You must also honor Global Privacy Control (GPC) signals as valid opt-out requests — this is a top enforcement priority in 2026.

3. Respond to Consumer Requests

You must acknowledge consumer requests within 10 business days and respond substantively within 45 calendar days. Verification procedures must be reasonable and not create unnecessary friction — Ford was fined $375,703 in March 2026 specifically for requiring email verification on opt-out requests.

4. Implement Data Security

The CCPA requires "reasonable security procedures and practices." Businesses that experience data breaches due to inadequate security face statutory damages of $100 to $750 per consumer per incident through the private right of action.

5. Train Your Team

All individuals handling consumer inquiries about privacy practices must be trained on CCPA requirements. This includes customer service representatives, IT staff processing data requests, and marketing teams managing tracking technologies.

6. Manage Service Providers

Contracts with service providers and third parties that receive personal information must include CCPA-compliant terms restricting how they can use the data you share.

CCPA Penalties and Enforcement in 2026

Penalties for CCPA violations have increased in 2026:

$2,663 per unintentional violation (adjusted for inflation)
$7,988 per intentional violation or violations involving minors
$100–$750 per consumer per incident for data breaches (private right of action)

Recent enforcement actions show regulators are actively pursuing cases:

Disney — $2.75M (Feb 2026) for failing to fully honor opt-out requests across properties
PlayOn Sports — $1.1M (March 2026) for tracking students without consent via GoFan platform
Ford — $375K (March 2026) for adding unnecessary verification to opt-out process

See the full enforcement history on our enforcement and penalties tracker.

CCPA Compliance Checklist

Map your data — inventory what personal information you collect, from whom, and where it flows
Check your thresholds — use our calculator to confirm the CCPA applies to you
Update your privacy policy — ensure it covers all required disclosures
Add opt-out links — display "Do Not Sell or Share" on your homepage
Implement GPC — detect and honor the Sec-GPC header on your website
Build a DSAR process — create workflows to receive, verify, and fulfill consumer requests
Review vendor contracts — add CCPA-compliant data processing terms
Train your team — ensure all consumer-facing staff understand CCPA obligations
Conduct risk assessments — evaluate processing activities that pose significant privacy risks, and check whether the new CCPA cybersecurity audit requirements apply to your business
Document everything — maintain records to demonstrate compliance if audited

For a detailed, step-by-step walkthrough, see our California CCPA/CPRA Compliance Checklist.

How CCPA Compares to Other State Laws

California's CCPA/CPRA remains the most comprehensive US state privacy law, but 19 other states have enacted their own. Key differences include applicability thresholds, consumer rights, and enforcement mechanisms. Use our state law comparison tool to see how California stacks up against other states.

Last updated: March 28, 2026.