California Consumer Privacy Act / California Privacy Rights Act Expert

California Consumer Privacy Act / California Privacy Rights Act Expert

Reference-depth expertise for the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). This skill paraphrases the statute and cites California Civil Code section by section — never reproduce verbatim statute text.

Framework identity

• SCF framework ID: usa-state-ca-ccpa-cpra-2026
• Region: Americas
• Country: United States
• Statute: California Civil Code §1798.100 et seq.
• Implementing regulations: 11 California Code of Regulations §7000 et seq.
• Regulators: California Privacy Protection Agency (CPPA) and the California Attorney General — both have civil-enforcement authority.

Framework in plain language

CCPA gives California residents ("consumers" in the statute, which includes households for some rights) the right to know what personal information a business collects about them, the right to delete and correct it, the right to opt out of its sale or sharing, and the right to limit a business's use of certain sensitive categories. CPRA — passed by California voters as Proposition 24 in November 2020 and operative January 1, 2023 with enforcement beginning July 1, 2023 — amended the original 2018 CCPA (effective 2020) by adding the right to correct, the right to limit use of Sensitive Personal Information, the new "share" concept covering cross-context behavioral advertising, the standalone CPPA agency, and a mandatory recognition of Universal Opt-Out Mechanisms such as the Global Privacy Control. CPRA also raised one of the applicability thresholds, removed the AG's prior 30-day mandatory cure period, and authorized CPPA rulemaking on risk assessments and cybersecurity audits for processing that presents significant risk.

Key dates and history

• June 2018: California Legislature enacts AB 375 (CCPA), Civil Code §§1798.100–1798.199.
• January 1, 2020: CCPA operative.
• July 1, 2020: Attorney General begins enforcement under original CCPA.
• November 3, 2020: Voters pass Proposition 24 (CPRA).
• January 1, 2023: CPRA amendments operative; B2B and HR partial exemptions sunset; CPPA rulemaking authority active.
• July 1, 2023: CPPA enforcement begins (the CPPA, distinct from the AG, takes over its share of administrative enforcement).
• 2024–2026: CPPA finalizes regulations on automated decision-making technology (ADMT), risk assessments, cybersecurity audits, and Universal Opt-Out Mechanisms — practitioners should track CPPA Board meeting agendas for current rulemaking status.

Territorial scope and applicability

CCPA/CPRA applies to a for-profit business that:

1. Does business in California, AND

2. Collects (or has collected on its behalf) personal information about California residents, AND alone or jointly determines the purposes and means of processing that information, AND

3. Meets at least one of the following three thresholds — see California Civil Code §1798.140(d) for the current text:

   • Revenue threshold: had annual gross revenues in excess of US $25 million in the preceding calendar year (the dollar figure was $25M from inception and is subject to periodic CPPA inflation adjustment — confirm current value at assessment time).
   • Volume threshold: alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more California consumers or households. (CCPA's original threshold was 50,000 consumers/households/devices and used "buys, receives, sells, or shares for commercial purposes." CPRA raised the count to 100,000, removed "receives," removed "devices," and added "shares" — narrowing what triggers the threshold but extending coverage to behavioral-advertising recipients.)
   • Revenue-derivation threshold: derives 50 percent or more of annual revenue from selling or sharing consumers' personal information. (CPRA added "sharing" — relevant for adtech businesses that exchange data without monetary consideration.)

Two additional categories of entity are also covered: