Key Facts
- Regulator
- California Privacy Protection Agency (CalPrivacy) and California Attorney General
- Latest version
- CCPA as amended by the CPRA (Proposition 24); statute and regulations effective 1 January 2026
- Effective
- 22 September 2025
- Official text
- oag.ca.gov ↗
What is CCPA?
CCPA compliance means meeting the California Consumer Privacy Act, the California law that gives residents control over the personal information businesses collect about them. The California Attorney General explains it and, with the California Privacy Protection Agency, enforces it. It applies to for-profit businesses doing business in California that cross a revenue or data-volume threshold.
The statute is supported by regulations that explain how businesses put it into practice. You will see them called the CCPA regulations, and they matter as much as the Act itself when you write notices and handle requests.
The CPRA (Proposition 24) amended the CCPA rather than creating a separate law, and its amendments have applied since 1 January 2023. "CCPA", "CCPA and CPRA" and "CPRA" therefore point at one body of law, not two.
The current statute and regulations text took effect on 1 January 2026. The California Privacy Protection Agency (CalPrivacy) publishes both on its laws and regulations page, which also lists the rules on cybersecurity audits, risk assessments and automated decision-making technology that it adopted in September 2025. No further CCPA regulations are in formal rulemaking. The California Attorney General's CCPA page explains the rights in plain terms.
Why it matters
The deal is in California, the privacy policy was written for the UK, and nobody has checked whether the website offers a "Do Not Sell or Share My Personal Information" link. That is how most firms first meet the CCPA: through a customer, a market or a marketing tool, not through a regulator.
The risk is concrete. Administrative fines run up to $2,663 for each violation, or $7,988 for each intentional violation and each one involving a consumer known to be under 16.
A privacy policy that doesn't match what the website does isn't a notice.
Who it applies to
The CCPA is mandatory California law for for-profit businesses that do business in California and meet any one of three tests:
- over $26,625,000 in gross annual revenue (the statute's $25 million, adjusted for inflation from 1 January 2025; CalPrivacy publishes the current figures);
- buying, selling or sharing the personal information of 100,000 or more California residents or households;
- earning 50% or more of annual revenue from selling personal information.
Older articles quote a 50,000-consumer threshold. That figure is out of date.
The law generally excludes nonprofits and government agencies. Only California residents hold rights under it, wherever the business is based.
Where you are incorporated is not the test. Where you do business is.
For a firm that holds ISO 27001, the CCPA is a different kind of obligation: ISO 27001 manages information security, while the CCPA sets duties to consumers, such as notices, requests and opt-outs. The nearest Annex A control, A.5.34 Privacy and protection of PII, asks you to identify the privacy laws that apply to you and meet them, so a certificate on its own does not show CCPA compliance.
The UK position
A UK firm meets the CCPA only if it is a for-profit business doing business in California and crosses a threshold. UK residents have no rights under it, because only California residents do.
So a UK SaaS or services firm with a California customer base or a sizeable California audience should test itself against the three thresholds. A UK firm with none of these has no CCPA duty.
UK GDPR and the Data Protection Act 2018 are a separate regime that applies on its own terms. A UK firm trading into California meets the CCPA for California residents' data on top of UK GDPR, and the two differ in scope. The same applies to EU GDPR for firms that also serve EU residents, which is why "CCPA vs GDPR" is a common comparison.
Key requirements
The CCPA combines consumer rights with business duties. The rights come first.
Consumer rights
- Know what personal information a business collects about them.
- Delete personal information.
- Correct inaccurate personal information (added by the CPRA).
- Opt out of the sale or sharing of personal information.
- Limit use of sensitive personal information (added by the CPRA).
- Non-discrimination for exercising any of these rights.
What businesses must do
- Give a notice at collection. It lists the categories of personal information collected and the purposes they are used for.
- Keep a privacy policy that describes consumer rights.
- Offer an opt-out. A business that sells or shares personal information must provide a clear and conspicuous "Do Not Sell or Share My Personal Information" link. It must also honour a global privacy control such as GPC as a valid opt-out request.
- Respond on time. Requests to know, delete and correct get an answer within 45 calendar days, extendable by a further 45 days with notice. Opt-out requests must be handled within 15 business days.
- Protect minors. A business may sell the personal information of a child under 16 only with opt-in authorisation. For a child under 13, that opt-in comes from a parent or guardian.
Enforcement
The Attorney General and the California Privacy Protection Agency enforce the CCPA. Consumers can bring a private action only for certain data breaches, with statutory damages of $107 to $799 per consumer per incident, or actual damages if higher.
A global privacy control that your site ignores is an opt-out request you have already refused.
Frequently asked questions
CCPA stands for the California Consumer Privacy Act of 2018. Some older pages call it the "California Consumer Protection Act", which is not its name. The CCPA is part of the California Civil Code, and the CCPA regulations sit in Title 11, Division 6 of the California Code of Regulations, so a search for either finds the same law.
A UK company can be covered by the CCPA, because the test is doing business in California, not where the company is based. A UK firm below the revenue threshold can still cross the second test, which counts the California residents or households whose personal information it buys, sells or shares. Meeting UK GDPR does not discharge CCPA duties.
The CPRA is Proposition 24, which California voters approved in November 2020. The CPRA amended the CCPA rather than replacing it, added the rights to correct and to limit use of sensitive personal information from 1 January 2023, and created the California Privacy Protection Agency to enforce the CCPA alongside the Attorney General.
The link is the CCPA opt-out route that a business which sells or shares personal information must offer. A business that sells personal information must also include the link in its CCPA notice at collection. Once a consumer opts out, the business must wait at least 12 months before asking them to opt back in.
The California Attorney General and the California Privacy Protection Agency enforce the CCPA, and consumers have been able to complain to the Agency since July 2023. A consumer can sue under the CCPA only over a breach of nonencrypted, nonredacted personal information caused by a failure to keep reasonable security, and must first give the business 30 days' written notice to cure.