CCPA and CPRA: California Privacy Law Explained for IT Companies

The California Consumer Privacy Act (CCPA) is the most influential US state privacy law. It was significantly amended by the California Privacy Rights Act (CPRA), which created a dedicated regulator, the California Privacy Protection Agency (CPPA). Together they apply to businesses anywhere in the world that handle personal information about California residents and meet certain thresholds.

This guide is general information, not legal advice.

What is the CCPA/CPRA?

The CCPA gives California residents (“consumers”) rights over their personal information and puts duties on “businesses” that collect it. The CPRA, approved by voters in November 2020 as Proposition 24, expanded those rights and duties and became operative on 1 January 2023. People usually say “CCPA” to mean the law as amended.

Key definitions:

History and why it was introduced

California introduced the law because the US has no general federal privacy law, and public concern about data brokers, targeted advertising and data breaches was growing.

Main objectives:

1. Give consumers transparency and control over their personal information.
2. Let consumers stop the sale and sharing of their data.
3. Hold businesses and their vendors accountable through contracts and enforcement.
4. Require reasonable security for personal information.

Who needs to comply?

A for-profit business that does business in California and collects California residents’ personal information must comply if it meets any one of these thresholds:

The revenue threshold counts worldwide revenue, not only California revenue.

Is it mandatory?

Yes, for businesses that meet a threshold. Service providers and contractors have direct obligations too, including contract compliance and reasonable security.

Penalties:

Per-violation penalties can add up quickly, because each affected consumer can count as a violation. There is no longer an automatic 30-day cure period for regulator enforcement.

Key requirements

Consumer rights

Respond to requests to know, delete and correct within 45 days (extendable by another 45 days with notice). Act on opt-out requests within 15 business days. Offer at least two methods for submitting requests, including a toll-free number for most businesses (online-only businesses with a direct relationship can use an email address).

Opt-out preference signals

Businesses that sell or share personal information must treat a browser opt-out preference signal, such as Global Privacy Control (GPC), as a valid opt-out request. Enforcement actions have focused on this.

Notices

• Notice at collection at or before the point of collection: categories, purposes, whether sold or shared, and retention periods.
• Privacy policy describing practices and rights, updated at least every 12 months.
• Notice of financial incentive for loyalty programmes and similar offers.

Service provider contracts

Contracts with service providers and contractors must, among other things:

• specify the limited business purposes for processing;
• prohibit selling or sharing the data, and using it outside the direct business relationship;
• prohibit combining it with other data, with limited exceptions;
• require compliance with the CCPA and the same level of privacy protection;
• give the business rights to monitor compliance and to stop unauthorised use;
• require notice if the provider can no longer meet its obligations.

Without these terms, a disclosure to a vendor may count as a “sale” or “share”.

Data minimisation and purpose limitation

Collection, use, retention and sharing must be reasonably necessary and proportionate to the purposes disclosed. Don’t keep data longer than necessary for each disclosed purpose.

Security

Businesses must implement reasonable security procedures appropriate to the nature of the personal information. Breaches of certain data caused by inadequate security can lead to consumer lawsuits.

Regulations effective 1 January 2026

The CPPA’s regulations adopted in 2025 add three areas, with phased compliance dates:

Check the CPPA’s website for the final text and dates before relying on them.

How to implement CCPA compliance

1. Check the thresholds each year, including worldwide revenue and data volumes.
2. Map personal information, including employee, applicant and B2B data, and note which flows count as selling or sharing.
3. Audit tracking technologies such as advertising pixels and SDKs, which are a common source of “sharing”.
4. Update notices: notice at collection, privacy policy and any financial incentive notices.
5. Set up request handling for know, delete, correct, opt out and limit, with identity verification and the 45-day clock.
6. Implement opt-out links and GPC handling across your website and apps.
7. Update contracts with service providers, contractors and third parties.
8. Set retention periods for each category of personal information.
9. Review security against reasonable security expectations; the CPPA regulations list the controls a cybersecurity audit looks at, which make a useful checklist.
10. Plan for 2026 to 2028 obligations: inventory ADMT use, start risk assessments, and determine your cybersecurity audit deadline.
11. Train staff who handle consumer requests, and keep records of requests for 24 months.

Documentation and policies

• Privacy policy (reviewed every 12 months)
• Notice at collection and notice of financial incentive
• Data inventory and data flow maps
• Request-handling procedure, verification method and request log (kept for 24 months)
• Opt-out and GPC implementation records
• Service provider, contractor and third-party contracts
• Retention schedule
• Information security policy and evidence of reasonable security
• Risk assessments and ADMT notices (under the 2026 regulations)
• Cybersecurity audit reports (from the applicable deadline)
• Training records for staff handling requests

Audits, assessments and enforcement

• No certification. There is no official CCPA certificate.
• Regulator enforcement. The CPPA and the Attorney General both investigate and enforce. The CPPA has run sweeps on connected vehicles, data brokers and opt-out mechanisms.
• Cybersecurity audits under the 2026 regulations must be performed by a qualified, objective, independent auditor and certified to the CPPA.
• Customer audits of service providers, under contract.

Cost

Benefits

• Access to US enterprise customers, who expect CCPA-ready service provider terms.
• A foundation for the other US state privacy laws, which follow similar models.
• Lower exposure to breach lawsuits through reasonable security.
• Greater consumer trust.

Risks of non-compliance

• Per-violation fines that scale with the number of consumers affected.
• Data breach class actions.
• Public enforcement announcements.
• Losing deals when customers can’t sign compliant service provider terms with you.

Common mistakes

• Thinking it only applies to California companies. It applies to businesses anywhere.
• Ignoring advertising pixels. Sharing data with ad platforms for behavioural advertising is “sharing” even when no money changes hands.
• Not honouring Global Privacy Control.
• Forgetting employees and B2B contacts, who have had full rights since 2023.
• Missing contract terms with vendors, turning a vendor relationship into a “sale”.
• Asking for too much information to verify a request, or making opt-out harder than opt-in.

Challenges for IT companies

• Being a service provider and a business at once, with different duties for each.
• Deleting data across systems and backups and passing deletion requests to sub-processors.
• Product analytics and marketing tags that may count as sharing.
• AI features that may fall under the ADMT rules if they make significant decisions about people.
• Keeping up with other states, which have similar but not identical laws.

Best practices

• Build one privacy programme for all US states, using the strictest common requirements.
• Treat GPC as an opt-out everywhere, not just in California.
• Use a tag manager with consent controls for all advertising pixels.
• Offer a standard service provider addendum to customers.
• Keep request handling measurable: volumes, response times, outcomes.

Tools that help

How CCPA/CPRA relates to other frameworks

Real-world examples

• Sephora (2022). The California Attorney General’s first public CCPA settlement, USD 1.2 million, over failing to disclose the sale of data through tracking and failing to honour Global Privacy Control.
• American Honda Motor Co. (2025). The CPPA’s first enforcement action against a business, with a USD 632,500 penalty, involving excessive verification for opt-out requests and missing contracts with ad-tech vendors.
• Healthline Media (2025). A USD 1.55 million settlement with the Attorney General, involving targeted advertising and purpose limitation.
• Illustrative scenario, not a real company: a US HR SaaS company passes the revenue threshold. It discovers its marketing site shares data with ad platforms, adds GPC handling and a “Do Not Sell or Share” link, updates its service provider addendum for customers, and starts an inventory of AI features that might count as ADMT.

Frequently asked questions

Does the CCPA apply to companies outside California? Yes, if they do business in California, collect California residents’ personal information and meet a threshold.

What is the difference between the CCPA and the CPRA? The CPRA amended the CCPA, adding rights such as correction and limiting sensitive data, creating the CPPA, and adding data minimisation and audit duties.

Does the CCPA cover employee data? Yes, since 1 January 2023.

What is Global Privacy Control? A browser signal that tells websites the user opts out of sale and sharing. Businesses that sell or share must honour it.

Is there a CCPA certification? No.

How long do we have to respond to a request? 45 days for requests to know, delete or correct, extendable once by 45 days. Opt-outs must be processed within 15 business days.

Are B2B SaaS companies affected? Yes, as businesses for their own data and as service providers for customer data.

What are the penalties? Up to USD 2,663 per violation or USD 7,988 per intentional violation (2025 inflation-adjusted amounts), plus breach lawsuits.

Next steps

• Check this year’s thresholds against your worldwide revenue and consumer counts.
• Audit your website and apps for pixels and SDKs that share data.
• Implement GPC handling and the required links.
• Update service provider terms in both directions.
• List any automated decision-making in your product ahead of the 2027 ADMT deadline.