WebBuilding

Laws and standards

CCPA and CPRA

Summary

The California Consumer Privacy Act of 2018 (CCPA), California Civil Code 1798.100 and following sections, gives California residents rights over the personal information businesses collect about them, including rights to know, delete and opt out of its sale or sharing. Governor Jerry Brown signed it on June 28, 2018, and it took effect on January 1, 2020. The California Privacy Rights Act (CPRA), approved by voters as Proposition 24 in November 2020, amended it from January 1, 2023, and created the California Privacy Protection Agency, which enforces the law alongside the Attorney General.

Web Building Encyclopedia · Laws and standards · Last reviewed October 22, 2026 · 12 min read

What the CCPA and CPRA are

The California Consumer Privacy Act of 2018 (CCPA) is a California state law that gives people more control over the personal information businesses collect about them. It is codified in the California Civil Code starting at Section 1798.100.12

The California Privacy Rights Act of 2020 (CPRA) is the voter initiative, Proposition 24, that rewrote large parts of the CCPA. The Attorney General’s office stresses that the CPRA amends the CCPA and is not a separate, new law.1 Its added protections began on January 1, 2023.1 The CPRA also created a new regulator, the California Privacy Protection Agency, which now calls itself CalPrivacy.3

The law turns on a few defined terms:

  • Consumer. A natural person who is a California resident.2 The Attorney General notes that residents keep their rights while temporarily outside the state.1
  • Personal information. Information that “identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”2
  • Sensitive personal information. A narrower list that includes government ID numbers, account log-ins with their passwords, precise geolocation, racial or ethnic origin, religious beliefs, union membership, the contents of private messages, genetic and neural data, biometric data used to identify someone, health information and information about sex life or sexual orientation.2
  • Sharing. Making personal information available to a third party for cross-context behavioral advertising, which the statute defines as targeting ads to a consumer based on personal information gathered from their activity across other businesses, websites, apps or services.2

How the law came about, 2018 to 2020

The CCPA began as a ballot initiative. Alastair Mactaggart, who chaired a group called Californians for Consumer Privacy, told the US Senate Judiciary Committee in 2019 that he spent about 18 months from January 2016 researching privacy before drafting a measure in 2017.4 Supporters gathered about 629,000 signatures from January to May 2018, well above the 366,000 needed to put it on the November 2018 ballot.4

In June 2018 Mactaggart reached a compromise with state legislators and withdrew the initiative. He told the committee that “the certainty of a law was preferable to the uncertainty of an election.” Assembly Bill 375 passed both houses unanimously, and Governor Jerry Brown signed it on June 28, 2018. A clean-up bill, SB 1121, passed in August 2018.4

The statute took effect on January 1, 2020, and businesses were expected to comply from that day. The Attorney General began enforcing it on July 1, 2020.56 Attorney General Xavier Becerra called it a first-of-its-kind data privacy law in America.6 His office’s first regulations went into effect on August 14, 2020, and further amendments followed on March 15, 2021.7

A second initiative followed in 2020. Proposition 24 calls itself the California Privacy Rights Act of 2020, and its findings note that more than 629,000 voters had signed petitions for the 2018 measure before the Legislature enacted the CCPA.8 On November 3, 2020, voters approved it with 9,384,625 votes in favor (56.2%) and 7,305,431 against (43.8%), according to the Secretary of State.9

The CPRA’s changes took effect on January 1, 2023. They included a right to correct inaccurate information and a right to limit the use of sensitive personal information.1 The measure also created the California Privacy Protection Agency, governed by a five-member board, to implement and enforce the law.3 Separately, the CCPA’s exemptions for employee data and business-to-business data expired on December 31, 2022.1

The new agency took over rulemaking from the Attorney General. It told the Attorney General on October 21, 2021, that it was ready, and the transfer took effect six months later.7 The agency dates the transfer of rulemaking authority to April 2022.10 Its updated CCPA regulations took effect on March 29, 2023. From July 1, 2023, consumers could file complaints with the agency about violations occurring on or after that date.1

Who it applies to

The CCPA covers for-profit businesses that do business in California and meet at least one of three thresholds. The statute sets them as:2

  1. annual gross revenue above $25 million as of January 1 of the calendar year (adjusted for inflation, see below)
  2. buying, selling or sharing the personal information of 100,000 or more consumers or households a year
  3. earning 50% or more of annual revenue from selling or sharing consumers’ personal information

The dollar figure moves with inflation. Under Civil Code 1798.199.95(d), the law’s main dollar amounts are adjusted in every odd-numbered year for increases in the Consumer Price Index, and the agency uses the California index to calculate them.11 As of October 2026, the current revenue threshold is $26,625,000, in effect since January 1, 2025.11 The sources do not all show the adjusted figure: the Attorney General’s CCPA page, updated August 28, 2026, still lists “over $25 million,” and the statute’s text still reads $25 million, with a footnote in the agency’s posted copy pointing to the updated amount.1211

Nonprofits and government agencies are generally outside the law.1 Only California residents have CCPA rights, so the law does not protect visitors from other states.1 A separate data broker law, Civil Code 1798.99.80 and following sections, defines data brokers as businesses that knowingly collect and sell to third parties the personal information of consumers they have no direct relationship with, and requires them to register.1 The Delete Act added a single deletion tool for those brokers, described below.12

Rights and business duties

The Attorney General lists six main rights for consumers:1

  • Right to know what personal information a business has collected, where it came from, why it is used and who receives it, free of charge, up to twice a year.
  • Right to delete personal information collected from the consumer, with exceptions.
  • Right to opt out of the sale or sharing of personal information.
  • Right to correct inaccurate information, from January 1, 2023.
  • Right to limit the use of sensitive personal information to certain purposes, such as providing the service the consumer asked for, from January 1, 2023.
  • Right to non-discrimination, so a business cannot charge more or offer worse service because someone used their rights.

For most adults the law works by opt-out, not opt-in. The exception is children: a business that knows a consumer is under 16 may sell that person’s data only with opt-in permission, given by a parent or guardian for children under 13 and by the young person for ages 13 to 15.1

Covered businesses also have duties that show up on their websites:1

  • Notice at collection. At or before the point of collection, a business must list the categories of personal information it collects and why. The notice must link to the privacy policy and, if the business sells or shares data, to its opt-out link.
  • Privacy policy. It must describe the business’s practices and explain how to use each right.
  • Request methods. A business must offer at least two ways to submit requests. For requests to know, one must be a toll-free phone number unless the business operates only online, in which case an email address is enough. A business cannot require a consumer to create an account to make a request.

Deadlines are short. A business must respond to requests to know, delete or correct within 45 calendar days and may extend that once by another 45 days if it tells the consumer.12 It must act on opt-out requests as soon as feasibly possible, and no later than 15 business days.1

The law spells out the wording of two links. Section 1798.135 refers to a “Do Not Sell or Share My Personal Information” link and a “Limit the Use of My Sensitive Personal Information” link.2 The Attorney General says businesses that sell or share personal information must provide the first as a clear and conspicuous link.1 The regulations allow a single alternative link titled “Your Privacy Choices” or “Your California Privacy Choices.”13

An opt-out can also arrive automatically from the visitor’s web browser. The statute calls this an opt-out preference signal: a signal that communicates the consumer’s choice to opt out of the sale and sharing of their personal information.2 The best-known example is Global Privacy Control (GPC). Browsers that support it send an HTTP header, Sec-GPC with the value 1, and expose the same setting to scripts on the page.14 GPC was introduced in the W3C Privacy Community Group in April 2020, and as of its September 24, 2026, version it is a W3C Working Draft on the Recommendation track, the process that leads to a W3C standard.1514 The project lists Brave and DuckDuckGo as supporting it, and Firefox as offering it in its settings.15

The Attorney General says GPC “must be honored by covered businesses as a valid consumer request.”1 The statute gives businesses a choice between posting the opt-out links and allowing opt-outs through preference signals under technical rules set by regulation.2 The agency’s regulations, separately, require any business that sells or shares personal information to treat a valid signal as an opt-out request for that browser or device, and to display whether it has processed the signal, for example with the words “Opt-Out Request Honored.”13

The regulations also police the design of privacy choices. Under Section 7004, the path to the more privacy-protective option must not be longer, harder or more time-consuming than the path to the less protective one. A cookie banner that offers only “Accept All” next to a link to more options fails this test, and the regulation suggests offering “Accept All” and “Decline All” instead.13 An interface that has the effect of substantially subverting or impairing user autonomy, decisionmaking or choice is a dark pattern, and agreement obtained through a dark pattern does not count as consent.13

Website cookies and tags are often where the obligations start. In a settlement announced on August 24, 2022, the Attorney General said that third-party tracking software on Sephora’s website and app let other companies monitor shoppers, and that these arrangements counted as a sale under the CCPA.16 (For how these tracking files work, see the entry on the HTTP cookie.)

Enforcement and penalties

Two public bodies enforce the CCPA: the California Privacy Protection Agency, through administrative enforcement actions, and the Attorney General, through civil actions in court. The Attorney General does not represent individual consumers but can act on patterns of misconduct.12

The statute sets fines of up to $2,500 for each violation and up to $7,500 for each intentional violation or violation involving consumers under 16.211 As of October 2026, the inflation-adjusted amounts in effect since January 1, 2025, are $2,663 and $7,988, for both the agency’s administrative fines and the civil penalties in Attorney General cases.11

Consumers can sue on their own only after certain data breaches. The right applies when nonencrypted and nonredacted personal information, such as Social Security numbers, financial account numbers with access codes or medical information, is stolen because a business failed to keep reasonable security.1 The statute allows actual damages or statutory damages of $100 to $750 per consumer per incident, whichever is greater, adjusted to $107 to $799 from January 1, 2025.211 Before suing, a consumer must give written notice and allow the business 30 days to cure the violation.1

Many of the actions announced so far have involved opt-outs, tracking and contracts with advertising companies. Selected actions, from the regulators’ own announcements (most resolve allegations through settlements or orders):

DateEnforcerBusinessAmountMain issues
August 24, 2022Attorney GeneralSephora$1.2 millionUndisclosed sale of data through trackers, GPC signals ignored16
March 12, 2025CPPAAmerican Honda Motor Co.$632,500Excessive verification, unequal privacy choices, ad tech contracts17
May 6, 2025CPPATodd Snyder$345,178Misconfigured privacy portal left opt-outs unprocessed for 40 days18
July 1, 2025Attorney GeneralHealthline.com$1.55 millionOpt-out failures, sharing of health-related article titles for ads19
September 30, 2025CPPATractor Supply$1.35 millionNo effective opt-out or GPC handling, missing notices20
February 11, 2026Attorney GeneralDisney$2.75 millionOpt-outs and GPC applied only to one service or device21
March 3, 2026CPPAPlayOn Sports$1.10 millionTracking consent required to use tickets, signals not recognized22
March 5, 2026CPPAFord Motor Company$375,703Email verification required before opt-outs23
May 8, 2026Attorney General with district attorneysGeneral Motors$12.75 millionSale of driver data to data brokers, data kept too long24

The “largest” labels come from the announcing offices. Healthline’s 2025 settlement was described as the largest to date, then Disney’s in February 2026, and then the General Motors settlement, which the Attorney General’s announcement calls the “Largest CCPA penalty in California history to date.” When announced, that settlement was subject to court approval.192124 The agency said the Tractor Supply fine was the largest in its own history when it was announced.20

The agency has made one point repeatedly. When it fined Todd Snyder, its head of enforcement, Michael Macko, said: “Using a consent management platform doesn’t get you off the hook for compliance.”18

Changes in 2025 and 2026

New regulations. The agency’s board adopted a large package of regulations on July 24, 2025, and the state’s Office of Administrative Law approved it on September 22, 2025. It took effect on January 1, 2026.25 The package updates the existing rules and adds rules on cybersecurity audits, risk assessments, automated decisionmaking technology (ADMT) and insurance companies.26 The deadlines are staggered:26

  • Risk assessment duties began on January 1, 2026, with attestations and summaries due by April 1, 2028.
  • Businesses that use ADMT to make significant decisions must comply with the ADMT rules from January 1, 2027.
  • Cybersecurity audit certifications are due by April 1, 2028, for businesses with revenue over $100 million, April 1, 2029, for those between $50 million and $100 million, and April 1, 2030, for those under $50 million.

Browsers must offer the signal. The statute as posted by the agency in December 2025 includes a new Section 1798.136 that becomes operative on January 1, 2027. From then, a business may not develop or maintain a browser that lacks a setting, easy for a reasonable person to find and configure, that sends an opt-out preference signal.2

Wider deletion rights. On September 27, 2026, Governor Gavin Newsom signed SB 923, the Expanding Privacy Rights Act, by Senator Josh Becker. From January 1, 2027, the right to delete also covers personal information a business obtained from third parties, and businesses that operate only online must offer an online way to submit requests, such as a webform, instead of relying only on an email address.27

The Delete Request and Opt-out Platform. Under the Delete Act, the agency launched DROP on January 1, 2026. One request asks every registered data broker to delete a resident’s personal information. Brokers had to start processing requests on August 1, 2026, and must repeat deletions every 45 days.12 As of August 25, 2026, the agency reported more than 500,000 sign-ups and 654 data brokers in the system.28

Timeline

  1. Governor Newsom signs SB 923, widening deletion rights from January 1, 202727
  2. Data brokers must begin processing deletion requests from the DROP platform12
  3. The Attorney General announces a $12.75 million General Motors settlement, which his office calls the largest CCPA penalty to date24
  4. The Attorney General announces a $2.75 million CCPA settlement with Disney21
  5. New CPPA regulations on risk assessments, cybersecurity audits and ADMT take effect25
  6. The CPPA fines Tractor Supply $1.35 million, which it calls the largest fine in its history20
  7. Consumers can file complaints with the CPPA for violations on or after this date1
  8. The CPPA's updated CCPA regulations take effect1
  9. The CPRA's amendments to the CCPA take effect1
  10. The Attorney General announces a $1.2 million settlement with Sephora16
  11. California voters approve Proposition 24, the CPRA, with 56.2% of the vote9
  12. The Attorney General's CCPA regulations take effect7
  13. The Attorney General begins enforcing the CCPA6
  14. The CCPA takes effect5
  15. Governor Jerry Brown signs AB 375, the California Consumer Privacy Act4

What it means for your website

This is general information, not legal advice. Whether the CCPA applies to a particular business, and what it requires of that business, depends on the facts, so check the regulators’ own guidance or ask a lawyer licensed in California. Below is what the law, the regulations and enforcement actions say about websites.

  • The thresholds come first. The revenue threshold is $26,625,000 as of October 2026, and the dollar amounts are adjusted in odd-numbered years.11 The 100,000-consumer test counts buying, selling or sharing, not only sales, so advertising trackers can matter below the revenue line.2
  • Tags and pixels can count as selling or sharing. In the Sephora case the Attorney General said third-party tracking on the website and app was a sale, and in the Healthline case it alleged that sharing with advertisers continued after visitors opted out.1619 On self-hosted WordPress, which we build on every week, such tags usually arrive through a plugin or a tag manager. Our page on websites and Google Ads covers conversion tags.
  • Global Privacy Control works as an opt-out. The regulations say a business that sells or shares must treat a valid signal as an opt-out request and display whether it processed it, and the Attorney General says covered businesses must honor GPC.131
  • Declining has to be as easy as accepting. The regulations give “Accept All” next to “Decline All” as an example of a symmetrical choice.13 The agency faulted Honda and Todd Snyder for demanding identity verification or extra information before opt-outs, and Ford for requiring email verification.171823 The Attorney General says a business cannot require an account to submit a request.1
  • Consent tools stay the business’s responsibility. A misconfigured privacy portal led to a $345,178 fine for Todd Snyder, and the agency said accountability rests with the businesses that use such tools.18
  • Notices and request methods. Covered businesses must give a notice at collection, post a privacy policy and offer at least two request methods.1 From January 1, 2027, online-only businesses must also offer an online method such as a webform.27
  • Vendor contracts. Several actions faulted missing privacy terms in contracts with ad tech and other companies.171920

Visitors from the EU bring different rules, covered in the GDPR entry. Our guide to website laws in the US covers other American rules.

See also

References

  1. California Consumer Privacy Act (CCPA). California Department of Justice, Office of the Attorney General. 2026-08-28. accessed October 22, 2026.
  2. California Consumer Privacy Act of 2018 (Civil Code 1798.100 to 1798.199.100), effective January 1, 2026, AB 137 and AB 566 update. California Privacy Protection Agency. 2025-12. accessed October 22, 2026.
  3. About CalPrivacy. California Privacy Protection Agency. accessed October 22, 2026.
  4. Written testimony of Alastair Mactaggart, Chair, Californians for Consumer Privacy, hearing of March 12, 2019. United States Senate Committee on the Judiciary. 2019-03-12. accessed October 22, 2026.
  5. Attorney General Becerra Reminds Consumers of Data Privacy Rights Under the California Consumer Privacy Act. California Department of Justice, Office of the Attorney General. 2020-06-30. accessed October 22, 2026.
  6. Attorney General Becerra Issues Statement on Day One of CCPA Enforcement: Know Your Responsibilities. California Department of Justice, Office of the Attorney General. 2020-07-01. accessed October 22, 2026.
  7. CCPA Regulations. California Department of Justice, Office of the Attorney General. accessed October 22, 2026.
  8. Text of Proposition 24, the California Privacy Rights Act of 2020. California Privacy Protection Agency. 2020. accessed October 22, 2026.
  9. Statement of Vote, General Election, November 3, 2020. California Secretary of State. 2020. accessed October 22, 2026.
  10. Laws & Regulations. California Privacy Protection Agency. accessed October 22, 2026.
  11. Updated Monetary Thresholds in CCPA. California Privacy Protection Agency. 2024-12-17. accessed October 22, 2026.
  12. CalPrivacy Celebrates Data Privacy Week with Practical Tools like DROP. California Privacy Protection Agency (CalPrivacy), Newsroom. 2026-01-26. accessed October 22, 2026.
  13. California Consumer Privacy Act Regulations (California Code of Regulations, Title 11, Division 6, Chapter 1), effective January 1, 2026. California Privacy Protection Agency. 2026-01-01. accessed October 22, 2026.
  14. Global Privacy Control (GPC), W3C Working Draft. World Wide Web Consortium, Privacy Working Group. 2026-09-24. accessed October 22, 2026.
  15. Global Privacy Control. Global Privacy Control project. accessed October 22, 2026.
  16. Attorney General Bonta Announces Settlement with Sephora as Part of Ongoing Enforcement of California Consumer Privacy Act. California Department of Justice, Office of the Attorney General. 2022-08-24. accessed October 22, 2026.
  17. Honda Settles With CPPA Over Privacy Violations. California Privacy Protection Agency. 2025-03-12. accessed October 22, 2026.
  18. CPPA Orders Clothing Retailer Todd Snyder to Pay Six-Figure Fine, Overhaul Privacy Practices. California Privacy Protection Agency. 2025-05-06. accessed October 22, 2026.
  19. Attorney General Bonta Announces Largest CCPA Settlement to Date, Secures $1.55 Million from Healthline.com. California Department of Justice, Office of the Attorney General. 2025-07-01. accessed October 22, 2026.
  20. Nation's Largest Rural Lifestyle Retailer to Pay $1.35M Over CCPA Violations. California Privacy Protection Agency. 2025-09-30. accessed October 22, 2026.
  21. California Won't Let It Go: Attorney General Bonta Announces $2.75 Million Settlement with Disney, Largest CCPA Settlement in California History. California Department of Justice, Office of the Attorney General. 2026-02-11. accessed October 22, 2026.
  22. Youth Sports Media Company to Pay $1.10 Million Fine, Change Practices Over Privacy Violations. California Privacy Protection Agency (CalPrivacy), Newsroom. 2026-03-03. accessed October 22, 2026.
  23. Ford to Change Practices, Pay Fine for Adding Unnecessary Friction to Opt-Out Process. California Privacy Protection Agency (CalPrivacy), Newsroom. 2026-03-05. accessed October 22, 2026.
  24. When It Comes to Data Privacy, Consumers Must Be in the Driver's Seat: Attorney General Bonta, Partners Secure $12.75 Million General Motors Privacy Settlement. California Department of Justice, Office of the Attorney General. 2026-05-08. accessed October 22, 2026.
  25. CCPA Updates, Insurance, Cybersecurity Audits, Risk Assessments, and ADMT Regulations. California Privacy Protection Agency. accessed October 22, 2026.
  26. California Finalizes Regulations to Strengthen Consumers' Privacy. California Privacy Protection Agency. 2025-09-23. accessed October 22, 2026.
  27. California Expands Privacy Protections by Strengthening Deletion Rights. California Privacy Protection Agency (CalPrivacy), Newsroom. 2026-09-27. accessed October 22, 2026.
  28. Half a Million Californians Have Signed up for DROP to Delete their Personal Information from Data Brokers. California Privacy Protection Agency (CalPrivacy), Newsroom. 2026-08-25. accessed October 22, 2026.

Web Building Encyclopedia. First published October 22, 2026. Last reviewed October 22, 2026. Every fact on this page is linked to a source we opened. Spotted an error? Write to [email protected].