California Consumer Privacy Act and California Privacy Rights Act

The California Consumer Privacy Act of 2018 gave California residents rights over the personal information that businesses collect about them. In November 2020 voters approved Proposition 24, the California Privacy Rights Act, which amended and extended the CCPA; its new protections began on 1 January 2023. The amended law is still called the CCPA, and the Attorney General's own page uses that name.

Two bodies enforce it. The Attorney General brings civil actions, and the California Privacy Protection Agency, created by Proposition 24, writes the regulations and runs administrative enforcement, including investigations and audits. Consumers can sue only over a data breach, and only in limited circumstances. The agency's latest regulations package, covering updates to the existing rules, insurance, cybersecurity audits, risk assessments and automated decisionmaking technology, was adopted by its board on 24 July 2025, approved by the Office of Administrative Law on 22 September 2025 and took effect on 1 January 2026.

This is California's law. Other states have passed their own comprehensive privacy laws, covered on the US State Privacy Laws page, and there is no federal equivalent of general application. No single privacy rule applies everywhere, and reading this page makes neither a business nor a laboratory compliant with anything.

The CCPA applies to for-profit businesses that do business in California and meet any one of three tests: gross annual revenue above the statutory threshold of 25 million dollars, which the agency adjusts and now lists as 26.625 million dollars or more from 1 January 2025; buying, selling or sharing the personal information of 100,000 or more California residents or households in a year; or deriving 50 percent or more of annual revenue from selling or sharing California residents' personal information. Non-profits and government agencies are generally outside it. A California resident is someone who lives in the state, even when temporarily outside it, and since the employment exemptions expired on 31 December 2022 employees and job applicants count.

A laboratory, training institute or incident response firm in India will rarely be a business under these tests. It is caught as the business's vendor, which the Act calls a service provider or contractor, bound by a written contract that limits what it may do with the data. When a California company engages you to examine a breached server or an employee's laptop, that contract is where the CCPA reaches you, and a breach you cause on your side becomes the business's breach to notify.

The CCPA does not stop a business from complying with a legal obligation or defending a legal claim; those are the stated exceptions to deletion, and the Attorney General's page says a business may keep data for them. It does not give consumers a right to sue for every violation; for most violations only the Attorney General or the agency may act. It does not apply to non-profits or government bodies, and it is not a certification scheme. The agency audits and investigates. It does not certify.

A report prepared for a California business names the data categories involved in the terms the Act uses, states whether personal information and sensitive personal information were affected, and records whether the data was encrypted and whether keys were exposed. It counts the California residents affected, because the sample notice to the Attorney General depends on the 500 threshold, and it separates fact from inference on how access was gained. It does not include consumers' personal information beyond what the finding needs, and it is prepared with counsel because it may be read in a consumer lawsuit.