All regulations / US Privacy
CCPA / CPRA
Know the rule before it knows you.
California's privacy law reaches any business of size with Californian users.
What it is
The CCPA gives California residents rights to know, delete, correct and opt out of the sale or sharing of their personal information, and limits use of sensitive data. It is enforced by the California Privacy Protection Agency and the Attorney General, with regulations on risk assessments, cybersecurity audits and automated decision-making.
This applies to you if
- You do business in California and exceed roughly USD 26 million in revenue, or handle data of 100,000 or more consumers or households, or earn half your revenue from selling or sharing personal data
- You use cross-context behavioural advertising with Californian users
- You are an EU company with US customers or employees in California
What it asks of you
- Privacy notice at collection; 'Do Not Sell or Share' link and honouring of opt-out preference signals
- Consumer rights processes within 45 days
- Contracts with service providers and contractors
- Risk assessments and, for some, cybersecurity audits and ADMT notices under the 2025 regulations
What it costs to ignore
Civil penalties per violation (higher for intentional violations and those involving minors), plus a private right of action for data breaches.
Key dates
CCPA since 2020; CPRA changes since 1 January 2023; new regulations phased in from 2026.
How we help
Not sure which apply to you? Send us three lines about what you sell and to whom, and we will tell you which rules matter and which do not.
Have a regulatory question?
Send a short description of your situation. We reply within one working day, usually with a view on scope and a fixed fee where possible.