CCPA is California's consumer privacy law giving residents rights over their personal information, later expanded by CPRA.

What's the difference between CCPA and CPRA?

CPRA amended and expanded CCPA, adding new rights (like correction and limiting sensitive data use) and creating the CPPA regulator.

Does my business need to comply with CCPA?

If you're a for-profit business meeting the revenue, data-volume, or revenue-share thresholds and doing business in California, yes.

What are the penalties for CCPA violations?

Up to $2,500 per violation, or $7,500 for intentional violations or those involving minors' data.

🇺🇸 Americas

CCPA/CPRA Compliance

Meet California's consumer privacy requirements

CCPA/CPRA is California's consumer privacy law, giving residents rights to know, delete, correct, and opt out of the sale or sharing of their personal information. It applies to for-profit businesses meeting revenue or data-volume thresholds, and is enforced by the California Privacy Protection Agency with fines up to $7,500 per violation.

California

Territorial scope

Consumer rights

45d

Response deadline

$25M+

Revenue threshold

2023

Current amendment

What is CCPA/CPRA?

The California Consumer Privacy Act (CCPA), as amended and
expanded by the California Privacy Rights Act (CPRA), gives
California consumers rights over their personal information and
creates the California Privacy Protection Agency (CPPA) to enforce
them.

Who needs to comply with CCPA/CPRA?

For-profit businesses doing business in California that meet at least
one threshold: over $25 million in annual gross revenue, buying/
selling/sharing personal information of 100,000+ consumers or
households, or deriving 50%+ of annual revenue from selling or
sharing personal information.

What are the key requirements
of CCPA/CPRA?

Clear, accessible privacy notices at or before the point of data collection

Mechanisms to exercise the rights to know, delete, correct, and opt out of sale/sharing

Honouring opt-out preference signals such as Global Privacy Control

Limiting use of sensitive personal information on request

Contracts with service providers and third parties covering CCPA obligations

Risk assessments and cybersecurity audits for higher-risk processing activities

What are the penalties for CCPA/CPRA non-compliance?

Civil penalties of up to $2,500 per violation, rising to $7,500 for intentional violations or violations involving minors' data, enforced by the CPPA and the California Attorney General.

$2,500

Fine per violation

$7,500

Fine per international violation

How does GDPRLocal help with CCPA/CPRA?

GDPRLocal supports you with everything CCPA/CPRA requires: privacy notices, consumer request handling, opt-out and Global Privacy Control mechanisms, service-provider contracts, risk assessments, and full privacy management tools tailored to California's evolving requirements.

Get started free