CCPA / CPRA

Who it applies to

For-profit businesses that do business in California and meet thresholds based on annual revenue, the volume of consumers' personal information bought, sold or shared, or the share of revenue from selling or sharing it.

Key requirements

• Notice at collection and a privacy policy.
• Consumer rights to know, delete, correct and opt out of the sale or sharing of personal information.
• A right to limit the use of sensitive personal information.
• Contracts with service providers, contractors and third parties.
• Reasonable security procedures appropriate to the nature of the information.
• Regulations adopted in 2025 add cybersecurity audit, risk assessment and automated decision-making requirements on a phased timeline.

Breach and incident notification

Breach notice to residents comes from California's separate breach notification statute. The CCPA adds a private right of action, with statutory damages, when certain personal information is breached because of a failure to maintain reasonable security.

Penalties

Administrative fines per violation (higher for intentional violations and those involving minors) enforced by the CPPA and the Attorney General, plus statutory damages in breach lawsuits.

Go deeper