California Consumer Privacy Act (CCPA/CPRA)

The CCPA covers for-profit businesses that do business in California and meet any one of three tests:

• Annual gross revenue above $26,625,000 (the inflation-adjusted figure in effect since January 1, 2025).
• Buying, selling or sharing the personal information of 100,000 or more California consumers or households a year.
• Making 50% or more of annual revenue from selling or sharing personal information.

“Sharing” means cross-context behavioral advertising, which is what most advertising pixels are for. Nonprofits aren’t covered by the CCPA itself.

Californians can ask to know and access their information, delete it, correct it, opt out of its sale or sharing, and limit the use of sensitive information. You may not treat them differently for using these rights.

• Confirm a request to know, delete or correct within 10 business days, and answer within 45 calendar days (up to 90 with notice).
• Opt-outs: stop selling or sharing no later than 15 business days after the request, with no identity check.
• Records: keep requests and your responses for at least 24 months.
• How people ask: at least two ways; a business that operates only online and has a direct relationship with the consumer may offer just an email address for requests to know. Online opt-outs must also accept an opt-out preference signal such as Global Privacy Control.

The privacy policy must be updated at least once every 12 months and say, among other things, what categories of personal information you collect, where they come from, why you use them, whether you sell or share them, how an opt-out preference signal is processed, and when the policy was last updated.

Before or at the point you collect personal information, a notice at collection must tell people what you collect, why, whether it is sold or shared, how long you keep it, and link to your opt-out and privacy policy. Without it, the regulations say a business shall not collect the information.

Updated regulations approved in September 2025 took effect on January 1, 2026. For websites, the most visible change: a business must now show whether it processed a visitor’s opt-out preference signal, for example “Opt-Out Preference Signal Honored” or a switch showing they are opted out. The rules also phase in risk assessments (compliance from January 1, 2026, first submissions due April 1, 2028), cybersecurity audits for larger businesses (from April 1, 2028), and rules for automated decision-making technology used for significant decisions (from January 1, 2027).

The California Privacy Protection Agency and the Attorney General enforce the CCPA. Fines are up to $2,663 per violation, or $7,988 per intentional violation or violation involving minors (figures in effect since January 1, 2025). Businesses no longer get an automatic 30 days to fix a problem first. People can sue only over certain data breaches.

Recent actions show what regulators test on websites:

• Sephora (Attorney General, August 2022): $1.2 million for not disclosing sales and not processing Global Privacy Control.
• Honda (Agency, March 2025): $632,500, including a privacy choices tool that didn’t offer choices in a symmetrical way.
• Todd Snyder (Agency, May 2025): $345,178 after opt-outs went unprocessed for 40 days. The Agency said: “Using a consent management platform doesn’t get you off the hook.”
• Healthline (Attorney General, July 2025): $1.55 million; cookies and pixels kept sending data after visitors opted out, and GPC wasn’t honored.
• Tractor Supply (Agency, September 2025): $1.35 million for not offering an effective opt-out, including through Global Privacy Control.
• Ford (Agency, March 2026): $375,703 for requiring email verification before processing opt-outs.