California Privacy Compliance Checklist

California Consumer Privacy Act / California Privacy Rights Act — Step-by-step guide to compliance

Reviewed by PrivacyLawMap editorial teamLast verified: August 13, 2026

What is the CCPA/CPRA compliance checklist?

The CCPA/CPRA compliance checklist is a 15-step plan for meeting the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), California's consumer privacy law, which took effect January 1, 2020. It is enforced by the California Privacy Protection Agency (CPPA) and California Attorney General, with civil penalties up to $7,988 per violation and no cure period. Work through every step below, then confirm your specific obligations with the free applicability calculator.

Compliance Steps

Effective: January 1, 2020

1
Conduct a CCPA-aligned data inventory mapping all 11 categories of personal information defined in Civil Code §1798.140(o), including IP addresses, browsing history, geolocation, biometric identifiers, and inferences drawn from any of the above
2
Publish a Notice at Collection at or before the point of data collection listing the categories collected, the purposes of use, and the retention period for each category, as required by §1798.100
3
Update the privacy policy at least every 12 months and include all CPRA-required disclosures: categories sold or shared in the past 12 months, sources of personal information, purposes of disclosure, and a description of the consumer rights request process
4
Implement automated Global Privacy Control (GPC) signal recognition at both the server layer (Sec-GPC HTTP header) and the client layer (navigator.globalPrivacyControl), and verify that GPC suppresses sale and sharing immediately and consistently across all sub-domains and ad-tech partners
5
Add a "Do Not Sell or Share My Personal Information" link in the website footer, and a separate "Limit the Use of My Sensitive Personal Information" link if you process sensitive PI for non-permitted purposes
6
Establish a rights-request workflow that acknowledges consumer requests within 10 business days and substantively responds within 45 calendar days, with a documented basis for any additional 45-day extension
7
Audit every contract with service providers, contractors, and third parties for CPRA-mandated DPA terms — purpose limitation, no further sale, certification of compliance, and audit rights — and remediate gaps before the next contract review cycle
8
Conduct and document data protection assessments for high-risk processing — including the sale of personal data processing of sensitive data and profiling of consumers — under the September 2025 CCPA risk assessment rules and retain assessments for at least three years
9
Prepare a written information security program; if your business has $100 million or more in annual revenue, scope the cybersecurity audit you must certify to CalPrivacy by April 1, 2028
10
Inventory every use of automated decision-making technology (ADMT) that produces a legally or similarly significant effect on a consumer in financial services, housing, education, employment, or healthcare; document logic, training data, and human-review process before the January 1, 2027 ADMT opt-out deadline
11
Confirm whether your business meets the data broker definition under SB 362, and if so register with CalPrivacy and integrate with the DROP platform to process universal deletion requests at least every 45 days starting August 1, 2026
12
Provide a dedicated employee privacy notice covering HR, applicant, contractor, and B2B contact data — California is the only state where these data subjects retain full CCPA rights including access, deletion, correction, and portability
13
Document retention periods for each category of personal information, including the criteria used and any legitimate business need that justifies retention beyond the initial collection purpose
14
Train employees who handle consumer inquiries, marketing, ad-tech configuration, and HR on CCPA/CPRA requirements, response procedures, and the broad sale-or-share definition that catches common cookie-based and pixel-based advertising
15
Subscribe to CalPrivacy rulemaking notices so the team is alerted to active proceedings on data broker audits, opt-out preference signals (OOPS), and friction-reduction rules expected in 2026

Key Enforcement Details

Enforced By

California Privacy Protection Agency (CPPA) and California Attorney General

Penalty / Violation

$7,988

Cure Period

None

Private Right of Action

Yes

Related Resources

California Privacy Law — Full Guide
Compare California with Other States
California Enforcement Actions & Privacy Fines
2026-2027 Privacy Law Compliance Deadlines
All State Privacy Laws

CCPA/CPRA Compliance Checklist FAQ

What is the CCPA/CPRA compliance checklist?

It is a 15-step plan for-profit businesses use to meet the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), which took effect January 1, 2020. The steps below cover consumer-rights request handling, privacy-notice disclosures, opt-out mechanisms, data-processing agreements, and security safeguards required under California law.

Who has to comply with the California Consumer Privacy Act / California Privacy Rights Act?

The CCPA/CPRA generally applies to for-profit businesses that handle California residents' personal data above the law's revenue and data-volume thresholds. Whether it applies to you depends on the specifics — check your exact obligations with the free applicability calculator at /calculator rather than assuming.

What is the penalty for CCPA/CPRA non-compliance?

The California Privacy Protection Agency (CPPA) and California Attorney General can impose civil penalties of up to $7,988 per violation and no cure period. Consumers also have a limited private right of action for certain violations. Figures verified August 13, 2026.

Put CCPA/CPRA Into Practice on Your SiteSponsored

Termly builds and maintains a California-ready privacy policy, a consent banner that recognizes universal opt-out signals like GPC, opt-in consent capture for sensitive data, and a workflow for the access, deletion and correction requests CCPA/CPRA grants.

Start Free with Termly

Does this law apply to you?

Use our free calculator to check if California Consumer Privacy Act / California Privacy Rights Act applies to your business.

Check Applicability

Official Resources

CalPrivacy (CPPA) Official Website
CalPrivacy Newsroom (Latest Announcements)
CCPA/CPRA Regulations (Effective January 1, 2026)
DROP Platform Regulations
CCPA/CPRA Full Text (California Legislative Information)
California Attorney General Privacy Page