A consumer-rights framework that reshapes how companies collect, use, sell, and share personal information about Californians, and by extension shapes US privacy practice nationwide.
The CCPA does not regulate data; it creates rights over data. Each right binds covered businesses to act on a verified consumer request, on stated timelines, with no charge and no retaliation. Tap any right to inspect.
Coverage is the threshold question. The CCPA only binds for-profit entities that do business in California, determine the purposes and means of processing California residents' personal information, and clear at least one of three doors. Hit any one and you are in.
A for-profit entity that does business in California and determines the purposes and means of processing consumers' personal information is a "business" if it satisfies any one of these three thresholds. The first is CPI-adjusted every odd-numbered year per § 1798.199.95(d). Current values are effective from 1 January 2025.
"Personal information" is broader than most non-California regimes. It captures anything that identifies, relates to, or could reasonably be linked to a particular consumer or household, in eleven categories, plus a twelfth, sensitive personal information, with its own dedicated right. Tap each to see what it covers.
A heightened category that triggers the right to limit use and disclosure under § 1798.121. Businesses processing sensitive PI for purposes beyond what an average consumer would expect must offer a "Limit the Use of My Sensitive Personal Information" link. SB 1223 added neural data in 2025.
Social Security number, driver's license, state ID, or passport number.
Account log-in or financial-account, debit, or credit card number combined with any required security or access code, password, or credentials.
Data derived from a device that locates a consumer within a circle of radius 1,850 feet or less.
Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
The contents of mail, email, or text messages, except where the business is the intended recipient of the communication.
A consumer's genetic data, however obtained, including raw genetic testing results.
Information generated by measuring activity of a consumer's central or peripheral nervous system, not inferred from non-neural data. Added by SB 1223.
Processing of biometric information for the purpose of uniquely identifying a consumer: facial recognition, voiceprints, fingerprints, gait or keystroke matching.
Personal information collected and analysed concerning a consumer's health (when not already covered by HIPAA or CMIA).
Personal information collected and analysed concerning a consumer's sex life or sexual orientation.
The CCPA defines four roles. Liability and obligations turn on which one you occupy. The contracts between them are not optional: § 1798.100(d) requires specific terms in every business-to-service-provider, business-to-contractor, and business-to-third-party arrangement.
From the moment a verifiable consumer request lands in your intake channel, the response window is 45 days, extendable once by another 45 days where reasonably necessary. Statutory aggregate cap: 90 days. This is the operational backbone every covered business must build.
The CPPA's first major regulatory package became effective 1 January 2026. It does not amend the statute, but it operationalises three of its most contested provisions. Implementation is phased through 2028–2029 to give businesses runway.
CCPA enforcement is unusual: it pairs a robust public-enforcement track (the CPPA and Attorney General) with a private right of action for security breaches. The 2025 CPI adjustment lifted every monetary cap by ~6.5%. Current values run through 2026 until the next biennial review.
CCPA exemptions are precise: not blanket carve-outs for whole industries, but targeted exclusions for data already governed by sector-specific federal regimes. Two notable temporary exemptions for employee and B2B data sunset on 1 January 2023; everything else remains active.
Protected health information held by covered entities and business associates, plus medical information under California's CMIA. Health-app and wearable data outside HIPAA may still be in scope.
Data on creditworthiness, character, or reputation handled by consumer-reporting agencies, furnishers, and users under the federal Fair Credit Reporting Act. The § 1798.150 breach action still applies.
Financial information governed by Gramm-Leach-Bliley or California's Financial Information Privacy Act. The § 1798.150 breach right of action still applies independently.
Personal information processed under the federal Driver's Privacy Protection Act of 1994 (motor-vehicle records). Breach action under § 1798.150 still applies.
Personal information collected as part of a clinical trial or biomedical study conducted under the federal Common Rule, ICH GCP, or FDA human-subject protections.
Vehicle and ownership information shared between dealers and manufacturers solely to effectuate a warranty repair or recall. Narrow purpose-bound carve-out, not a full exemption.
Information that meets the statutory deidentification standard or is aggregate consumer information. Reidentification flips it back into scope.
Commercial conduct that takes place wholly outside California. Storing California-collected PI on a device that travels out of state does not strip protection.
Sections 1798.105, 1798.106, 1798.110, and 1798.115 do not apply to household data, but the opt-out and limit-use rights still do.
Sections 1798.105 and 1798.120 do not apply to commercial credit-reporting agencies' use of business-controller information about owners, directors, and officers.
The temporary exemption for HR data ended on 1 January 2023. Applicants, employees, owners, directors, officers, medical-staff and contractor data is now fully in scope, including the right to non-discrimination.
The temporary exemption for personal information reflecting communications between businesses also ended on 1 January 2023. Account contacts at customer companies now have full CCPA rights.
A guided walk through the Act's logic. Answer up to five questions to identify whether the CCPA covers your operation and what to do next. This is a heuristic, not legal advice. The wording of §§ 1798.140(d), 1798.145, and 1798.146 governs the actual classification.