Question 1

Who does the CCPA/CPRA apply to?

Accepted Answer

The CCPA/CPRA applies to for-profit businesses that collect California residents' personal information and meet at least one threshold: $25 million+ annual gross revenue, buy/sell/share personal information of 100,000+ consumers or households, or derive 50%+ of annual revenue from selling/sharing personal information.

Question 2

What is the penalty for violating the CCPA/CPRA?

Accepted Answer

The statutory penalties are $2,500 per unintentional violation and $7,500 per intentional violation. For 2026, the CPPA has adjusted these amounts for inflation to $2,663 and $7,988 respectively. Consumers also have a private right of action for certain data breaches, with statutory damages between $107 and $799 per consumer per incident (also inflation-adjusted for 2026).

Question 3

Do businesses need to honor Global Privacy Control (GPC)?

Accepted Answer

Yes. Under the CPRA and CPPA regulations, businesses must treat GPC signals as valid opt-out of sale/sharing requests. Failure to honor GPC can result in enforcement action.

Question 4

Is there a cure period under the CCPA/CPRA?

Accepted Answer

No. The CPRA eliminated the 30-day cure period that was originally in the CCPA. Businesses can now face enforcement immediately upon a violation being identified.

Question 5

Does the CCPA apply to nonprofits?

Accepted Answer

No. The CCPA/CPRA applies only to for-profit businesses. Nonprofits, government agencies, and entities covered by HIPAA (for protected health information) are exempt. However, a nonprofit's for-profit subsidiary would need to comply if it meets the thresholds.

Question 6

Are employees' personal data covered by the CCPA?

Accepted Answer

Yes. Since January 1, 2023, the employee and B2B data exemptions expired. The CCPA/CPRA now fully applies to personal information of employees, job applicants, contractors, and B2B contacts. Businesses must provide privacy notices and honor rights requests for these individuals.

Question 7

What is the California Delete Act and how does it affect data brokers?

Accepted Answer

The California Delete Act (SB 362) requires data brokers to register with the CPPA and participate in the DELETE Request and Opt-out Platform (DROP). Launched January 1, 2026, DROP lets consumers submit a single deletion request to all registered data brokers. Brokers must check DROP every 45 days starting August 1, 2026. Non-registration carries fines of $200/day.

Question 8

How long does a business have to respond to a CCPA consumer request?

Accepted Answer

Businesses must acknowledge receipt within 10 business days and provide a substantive response within 45 calendar days. The response period can be extended by an additional 45 days (90 days total) if reasonably necessary, but the consumer must be notified of the extension.

Question 9

What qualifies as "selling" personal information under the CCPA?

Accepted Answer

The CCPA defines "selling" broadly as disclosing personal information to a third party for monetary or other valuable consideration. The CPRA added "sharing" — making personal information available to third parties for cross-context behavioral advertising, regardless of whether money changes hands. This means ad tracking pixels and third-party cookies can constitute a "sale" or "share."

Question 10

What are the current CPRA regulations and when did they take effect?

Accepted Answer

The most recent comprehensive CPRA regulation package was adopted by CalPrivacy in September 2025 and took effect January 1, 2026. It covers four major areas: (1) updates to core CCPA requirements, (2) insurance company-specific provisions, (3) mandatory cybersecurity audit requirements for high-risk processors, and (4) risk assessment and automated decision-making technology (ADMT) rules. CalPrivacy is also conducting preliminary rulemaking in 2026 on data broker audits, reducing friction in privacy rights exercise, and opt-out preference signals (OOPS).

Question 11

When did CPRA enforcement begin?

Accepted Answer

CPRA enforcement began immediately upon the law taking effect on January 1, 2023. Unlike the original CCPA, the CPRA eliminated the 30-day cure period, meaning enforcement can begin as soon as a violation is identified. The CPPA (CalPrivacy) won a key Court of Appeal decision in February 2024 confirming its authority to enforce regulations retroactively to July 1, 2023, overturning a Chamber of Commerce challenge. CalPrivacy has since ramped up enforcement significantly, issuing over $6 million in fines by early 2026.

Question 12

Where can businesses track California CCPA/CPRA enforcement actions?

Accepted Answer

This California guide summarizes the statutory exposure and compliance workflow for businesses operating under the CCPA/CPRA. PrivacyLawMap treats /penalties as the canonical enforcement database for CCPA and CPRA monetary actions, including company names, amounts, violation types, dates, and primary-source links.

Question 13

What are the CPRA automated decision-making technology (ADMT) rules?

Accepted Answer

CalPrivacy adopted ADMT regulations in September 2025 as part of its comprehensive regulation package. These rules require businesses that use automated decision-making technology to: (1) provide consumers with pre-use notice about ADMT usage, (2) allow consumers to opt out of ADMT-based significant decisions affecting financial services, housing, education, employment, or healthcare, (3) provide access to information about how the ADMT works and allow consumers to request human review, and (4) conduct risk assessments before deploying ADMT. While the broader regulations took effect January 1, 2026, the ADMT consumer opt-out rights have a separate compliance deadline of January 1, 2027.

Question 14

What is CalPrivacy and how is it different from the CPPA?

Accepted Answer

CalPrivacy is the new public-facing brand name for the California Privacy Protection Agency (CPPA). The agency rebranded in late 2025 but remains the same entity created by Proposition 24 (CPRA) in 2020. CalPrivacy is the first dedicated state privacy enforcement agency in the United States. It has rulemaking authority, enforcement power, and a growing staff including a new Audits Division formed in February 2026. The agency's official websites are cppa.ca.gov and privacy.ca.gov.

Question 15

What is the difference between the CCPA and the CPRA?

Accepted Answer

The CCPA is the original 2018 statute that took effect January 1, 2020. The CPRA is a 2020 ballot initiative (Proposition 24) that amended the CCPA — it took effect January 1, 2023. The CPRA did not replace the CCPA; the law is now most accurately called the CCPA-as-amended-by-the-CPRA, often shortened to CCPA/CPRA. Key CPRA additions: a new "sensitive personal information" category with a right to limit use, a "right to correct," opt-out of sharing for cross-context behavioral advertising, the elimination of the 30-day cure period, the creation of CalPrivacy (CPPA), and removal of the HR and B2B data exemptions effective January 1, 2023.

Question 16

Does the CCPA apply to small businesses?

Accepted Answer

It depends on what the business does, not its headcount. The CCPA only applies to a for-profit entity that meets at least one of three thresholds: more than $25 million in annual gross revenue, processing personal information of 100,000+ California consumers or households, or deriving 50%+ of annual revenue from selling or sharing personal information. A small online retailer with 10 employees that sells data via tracking pixels can still be in scope under the third threshold, while a staffing agency with $20 million in revenue and small consumer reach is typically out of scope. Use our free applicability calculator at /calculator to check your specific situation.

Question 17

What is the CCPA cybersecurity audit requirement?

Accepted Answer

Under the September 2025 CCPA regulations (effective January 1, 2026), businesses whose annual gross revenue exceeds $100 million and whose processing presents significant risk to consumer privacy must conduct annual cybersecurity audits and certify completion to CalPrivacy. The first audit certifications are due April 1, 2028. The audit must be performed by a qualified, independent assessor and cover access controls, encryption, vulnerability management, incident response, and vendor risk. Smaller businesses are not required to conduct the formal audit but are still expected to maintain reasonable security under §1798.100(e).

Question 18

Does the CCPA require data minimization?

Accepted Answer

Yes. The CPRA added an explicit data-minimization principle requiring that the collection, use, retention, and sharing of personal information be reasonably necessary and proportionate to achieve the disclosed purpose. The September 2025 CCPA regulations operationalize this by requiring businesses to document a specific purpose for each category of personal information collected, limit retention to the period necessary for that purpose, and obtain new consent or notice if the purpose changes. The principle applies to sensitive personal information with extra rigor — under §1798.121, sensitive PI processed for non-listed purposes triggers a consumer right to limit its use.

Question 19

What is a Notice at Collection under the CCPA?

Accepted Answer

A Notice at Collection is a separate, point-in-time disclosure that must appear at or before the moment a business collects personal information from a California consumer. Required content under §1798.100: the categories of personal information being collected, the categories of sensitive personal information being collected (if any), the purposes for which each category will be used, whether each category is sold or shared, the retention period for each category, and a link to the full privacy policy. The notice can be presented as a banner, a checkbox-adjacent disclosure, or a layered popup, but it must be clear and conspicuous before collection occurs.

Question 20

What is the CCPA risk assessment requirement?

Accepted Answer

Under the September 2025 CCPA regulations, businesses must conduct documented risk assessments before processing personal information in ways that present a significant risk to consumer privacy. Triggering activities include selling or sharing personal information, processing sensitive personal information for inferences, using automated decision-making technology (ADMT) for significant decisions, profiling for behavioral advertising of minors, and processing geolocation as sensitive data. The assessment must identify the processing's purpose, benefits, and risks; describe safeguards; and document the business's decision to proceed. Risk assessments must be retained for at least five years and submitted to CalPrivacy on request.

Question 21

Who enforces California's privacy laws?

Accepted Answer

Two agencies share CCPA/CPRA enforcement authority. The California Privacy Protection Agency (now branded as CalPrivacy) was created by the CPRA in 2020 and is the first dedicated state privacy enforcement agency in the United States — its rulemaking, audit, and administrative-fine powers cover CCPA/CPRA and the Delete Act (SB 362). The California Attorney General retains parallel civil-enforcement authority and has prosecuted major CCPA cases including Sephora, DoorDash, Healthline, Jam City, Sling TV, Disney, and General Motors. CalPrivacy and the AG sometimes coordinate, as in the Disney $2.75M action and the May 2026 General Motors connected-vehicle settlement. A separate Data Broker Enforcement Strike Force within CalPrivacy was launched in November 2025 to pursue unregistered data brokers under the Delete Act, with its first fines issued January 8, 2026.

Question 22

What is the difference between the CCPA cybersecurity audit and the California data broker audit?

Accepted Answer

California now has two separate 2028 privacy audit deadlines that are easy to confuse. The CCPA cybersecurity audit (September 2025 regulations, first certification due April 1, 2028) applies only to businesses with significant-risk processing and more than $100 million in annual gross revenue, and is certified to CalPrivacy. The Delete Act data-broker audit (Civil Code §1798.99.86) is different: every registered data broker — regardless of revenue — must obtain an independent third-party audit of its Delete Act compliance starting January 1, 2028 and once every three years after that, keep the report for at least six years, and submit it to CalPrivacy on written request. A company can owe one audit, both, or neither: a high-revenue retailer that is not a data broker owes only the cybersecurity audit, while a small registered broker owes only the triennial Delete Act audit. As of June 2026 the cybersecurity-audit rules are final, while CalPrivacy's detailed data-broker audit regulations are still in preliminary rulemaking (comment period closed May 7, 2026).

Question 23

How much in CCPA fines has California issued?

Accepted Answer

Combined CalPrivacy and California AG civil penalties under the CCPA, CPRA, and Delete Act exceed $24.6 million across more than a dozen publicly resolved actions since the first enforcement settlement in August 2022. The five largest to date are General Motors $12.75M (May 2026 — connected-vehicle location and driving-data sales), Disney $2.75M (February 2026 — record opt-out propagation case), Healthline $1.55M (July 2025), Jam City $1.4M (November 2025), and Tractor Supply $1.35M (September 2025 — CalPrivacy's largest direct penalty). Smaller but precedent-setting actions include Ford $375,703 for opt-out friction, PlayOn Sports $1.1M for student-privacy violations, Honda $632.5K for excessive verification and asymmetrical choices, Sling TV $530K for streaming opt-out friction, DoorDash $375K, Tilting Point $500K, and the first two Delete Act fines against Datamasters and S&P Global in January 2026. Statutory caps are $7,988 per intentional violation and $2,663 per unintentional violation for 2026 (inflation-adjusted), with the CPRA tripling those caps for violations involving consumers under 16. Aggregate fines are typically negotiated multiples of the per-violation cap multiplied by the number of affected consumers.

California Privacy Law

Overview

Applicability Thresholds

Consumer Rights

Key Changes in 2025-2026

Regulatory Timeline

Enforcement Details

California CCPA/CPRAFines & Penalties(2026 inflation-adjusted)

Notable Enforcement Actions

General Motors

Ford Motor Company

PlayOn Sports (GoFan)

The Walt Disney Company

Rickenbacher Data LLC (Datamasters)

S&P Global, Inc.

Jam City, Inc.

Sling TV L.L.C. and Dish Media Sales L.L.C.

Tractor Supply Company

Healthline Media LLC

American Honda Motor Co.

Tilting Point Media

DoorDash

Sephora

Zoom Video Communications

Sensitive Data Categories

Universal Opt-Out / GPC Requirements

Minor / Child Protections

Compliance Checklist