CCPA/CPRA
California Consumer Privacy Act, as amended by the California Privacy Rights Act
The CCPA grants California consumers rights over their personal information, and the CPRA expanded those rights and created the California Privacy Protection Agency. Businesses must honor rights to know, delete, correct, and opt out of sale or sharing, and must verify consumer identity before fulfilling requests. CPPA regulations on automated decisionmaking technology (ADMT), risk assessments and cybersecurity audits took effect on 1 January 2026, with ADMT compliance due from 1 January 2027 and the first audit certifications from 1 April 2028 for the largest businesses.
Who it applies to
For-profit businesses doing business in California that meet revenue or data-volume thresholds and collect California residents' personal information, plus their service providers and contractors.
Identity requirements
- Verify the identity of consumers making rights requests to a reasonable degree of certainty before disclosing or deleting personal information
- Provide and honor opt-out mechanisms for the sale and sharing of personal information, including recognized opt-out preference signals
- Obtain opt-in consent for sale or sharing of personal information of consumers under 16
- Implement reasonable security procedures and practices appropriate to the sensitivity of personal information
- Honor consumer rights to know, delete, correct, and limit use of sensitive personal information
- Maintain processes that avoid unauthorized disclosure when responding to identity-based access requests
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Customer identity & consent (CIAM) | Businesses must capture consent and opt-out preferences and manage them across customer identity systems. |
| Identity verification (KYC/proofing) | Consumer rights requests must be verified to a reasonable degree of certainty before data is disclosed or deleted. |
| Data residency & cross-border transfer | Obligations attach to California residents' personal information regardless of where it is processed, shaping data-handling and vendor controls. |
| Breach notification | California's breach law gives consumers a private right of action for breaches caused by failure to maintain reasonable security. |
Upcoming deadlines
- January 1, 2027 CCPA: automated decisionmaking technology rules apply
- December 31, 2027 CCPA: risk assessments due for processing that predates the regulations
- April 1, 2028 CCPA: first cybersecurity audit reports due for businesses over $100 million revenue
- April 1, 2028 CCPA: first risk assessment information submitted to the CPPA
Penalties
The CPPA and Attorney General can levy administrative or civil penalties per violation; the statutory amounts of 2,500 and 7,500 dollars are adjusted for inflation every two years and, from 1 January 2025, stand at up to 2,663 dollars per violation and 7,988 dollars per intentional violation or violation involving consumers under 16. Consumers also have a private right of action for certain data breaches.
Status and dates last verified against primary sources on 2026-10-31.
CCPA/CPRA: frequently asked questions
- What is the difference between CCPA and CPRA?
- The CPRA is a 2020 ballot measure that amended and expanded the CCPA, adding new rights, the sensitive personal information category, and the California Privacy Protection Agency; its amendments took effect 1 January 2023.
- Must businesses verify identity before responding to requests?
- Yes. Businesses must verify a consumer's identity to a reasonable degree of certainty before disclosing, correcting, or deleting personal information to prevent unauthorized access.
- Who enforces the CCPA and CPRA?
- The California Privacy Protection Agency has primary administrative enforcement and rulemaking authority, and the California Attorney General also retains civil enforcement power.
- What do the 2026 CCPA regulations mean for identity systems?
- Regulations approved in September 2025 and effective 1 January 2026 require risk assessments for higher-risk processing (including processing sensitive data such as biometrics), add pre-use notice and opt-out rights for automated decisionmaking technology used for significant decisions from 1 January 2027, and phase in annual cybersecurity audits, starting with certifications due 1 April 2028 for businesses with more than 100 million dollars in revenue.