The California Privacy Rights Act passed in 2020 and took effect in 2023. In 2026 it changed again: new regulations on risk assessments, cybersecurity audits and automated decisionmaking took effect January 1, the state's data broker deletion platform went live the same day, and the agency has issued fines regularly since 2025. This page covers where California stands in October 2026.
The CPRA was Proposition 24, approved by voters on November 3, 2020. It didn't replace the California Consumer Privacy Act. It rewrote it, so the law in force is still called the CCPA (Civil Code § 1798.100 et seq., current text effective January 1, 2026), and "CPRA" now mostly refers to the 2020 amendments. Most of those amendments became operative January 1, 2023. This is not legal advice.
What the CPRA changed from the original CCPA
| Area | Original CCPA (2020) | After the CPRA (2023 on) |
|---|---|---|
| Volume threshold | Buys, sells, receives or shares data of 50,000 consumers, households or devices | Buys, sells or shares data of 100,000 consumers or households |
| Revenue-share threshold | 50% of revenue from selling | 50% of revenue from selling or sharing |
| Ad tech | Only "sale" was regulated | New "sharing" concept covers cross-context behavioral advertising, even without payment |
| Rights | Know, delete, opt out of sale | Adds correct, opt out of sharing, and limit use of sensitive personal information |
| Sensitive data | No separate category | "Sensitive personal information" with its own right to limit |
| Employee and B2B data | Mostly exempt (temporary carve-outs) | Carve-outs expired January 1, 2023; fully covered |
| Purpose and retention | Disclosure only | Data minimization and purpose limitation; retention periods disclosed at collection |
| Regulator | Attorney General only | A dedicated agency plus the Attorney General |
| Cure period | 30 days to cure after AG notice | No cure right; the agency may allow time to cure at its discretion (§ 1798.199.45) |
The cure period change has real effects. In its February 2024 DoorDash settlement, the Attorney General said plainly that "Violations cannot be cured." A company that gets a letter now negotiates a penalty. It doesn't get 30 days to fix the problem first.
Who has to comply: current thresholds
A for-profit entity doing business in California is a "business" under § 1798.140(d) if it meets any one of these:
- Annual gross revenue above $26,625,000 in the preceding calendar year. The statute says $25 million, but the agency must adjust it for inflation every odd-numbered year. The current figure took effect January 1, 2025 (CalPrivacy's threshold page), and the next adjustment is due January 2027.
- Annually buys, sells or shares the personal information of 100,000 or more consumers or households.
- Derives 50% or more of annual revenue from selling or sharing consumers' personal information.
The revenue test is not limited to California revenue, and it has no data-volume condition attached. A $30 million company with a few hundred California customers is covered. Utah, by contrast, requires both a revenue test and a volume test (compare on the Utah page).
The same CPI adjustment applies to penalties. Administrative fines and civil penalties are now up to $2,663 per violation, or $7,988 for intentional violations and violations involving consumers the business knows are under 16. Statutory damages in the private right of action for data breaches (§ 1798.150) are now $107 to $799 per consumer per incident.
Sensitive personal information
Under § 1798.140(ae), sensitive personal information covers:
- Social Security, driver's license, state ID and passport numbers
- Account log-in, or a financial account or card number combined with the code or password needed to use it
- Precise geolocation
- Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, union membership
- Contents of mail, email and texts unless the business is the intended recipient
- Genetic data and neural data (information generated by measuring nervous system activity)
- Biometric information processed to identify someone; health information; information about sex life or sexual orientation
Consumers can tell a business to limit its use of sensitive PI to what is necessary to provide the goods or services they asked for, plus a short list of permitted purposes. If you only use sensitive PI for those purposes, you don't need to offer the "Limit the Use of My Sensitive Personal Information" link. In practice, the hard part is proving that your analytics and ad pipelines don't touch sensitive fields. That is a data mapping problem more than a legal one.
The agency: California Privacy Protection Agency, now "CalPrivacy"
The CPRA created the California Privacy Protection Agency, governed by a five-member board. Its legal name hasn't changed, but since late 2025 it has called itself CalPrivacy in its own releases and on its laws and regulations page. Since January 26, 2026, its news appears on privacy.ca.gov. It enforces both the CCPA and the Delete Act, writes regulations, and has set up a separate Audits Division. Its first sectoral audit, announced July 2026, targets gig economy platforms.
The Attorney General keeps independent authority to bring civil actions under the CCPA, and several of the largest cases so far came from that office (see below).
The 2026 regulations: ADMT, risk assessments and cybersecurity audits
The CalPrivacy Board adopted the package on July 24, 2025. The Office of Administrative Law approved it on September 22, 2025, and it took effect January 1, 2026 (rulemaking record). It also updated the existing CCPA regulations and clarified how they apply to insurers. The three new obligations phase in on different schedules:
| Obligation | Who it hits | Deadline |
|---|---|---|
| Risk assessments (§§ 7150-7157) | Any business that sells or shares PI; processes sensitive PI (with a narrow HR carve-out); uses ADMT for a significant decision; infers traits of applicants, students or workers through systematic observation; infers traits from presence at sensitive locations; or uses PI to train ADMT or facial or emotion recognition | New processing: before you start, from January 1, 2026. Processing already under way: assessment done by December 31, 2027. Attestation and summary filed with CalPrivacy by April 1, 2028. Review at least every three years, and within 45 days of a material change. |
| Cybersecurity audits (§§ 7120-7124) | Businesses earning 50%+ of revenue from selling or sharing PI, or businesses over the revenue threshold that processed PI of 250,000+ consumers or households, or sensitive PI of 50,000+ consumers, in the prior year | First audit report by April 1, 2028 (revenue over $100M), April 1, 2029 ($50M-$100M), or April 1, 2030 (under $50M). Annual after that. The auditor must be qualified, objective and independent. |
| ADMT (§§ 7200-7222) | Businesses using ADMT to make a "significant decision" about a consumer | Compliance by January 1, 2027 for existing uses; from first use for anything new after that |
The final ADMT rule is narrow. ADMT means technology that processes personal information and uses computation to replace, or substantially replace, human decisionmaking. If a human reviewer actually examines the output and has authority to change the decision, the tool generally falls outside the definition. A "significant decision" is one that results in providing or denying financial or lending services, housing, education enrollment or opportunities, employment or contracting opportunities or compensation, or healthcare services. Behavioral advertising is not on the list. Covered businesses must give a pre-use notice, honor opt-outs (subject to exceptions such as a human appeal option), and answer ADMT access requests explaining the logic and the outcome.
The Delete Act and DROP
The Delete Act is separate from the CCPA, but CalPrivacy enforces both. Data brokers must register with CalPrivacy every January and pay a fee. Its centerpiece is the Delete Request and Opt-out Platform (DROP), a state-run site where a Californian can send one deletion request to every registered data broker.
- The DROP regulations were approved by the Office of Administrative Law in November 2025 and took effect January 1, 2026. Consumer sign-ups opened then. CalPrivacy reported half a million sign-ups by August 2026.
- From August 1, 2026, every registered data broker must log into DROP at least every 45 days, process the deletion requests that match its records (inferences included), and report each request's status within 45 days.
- Brokers must keep a list of deletion requests so that deleted consumers stay deleted when new data comes in.
- From January 1, 2028, brokers must undergo an independent compliance audit every three years.
- Fines are $200 per day for failing to register, and $200 per deletion request per day for failing to delete.
You don't have to call yourself a data broker to be one. In a decision announced in December 2025 against a marketing firm that built and sold custom audiences, the Board wrote that "A sale is a sale." Any business that sells personal information of consumers it has no direct relationship with should get a real legal answer on registration. For the request-handling side, see high-volume requests from agent services.
Laws signed since: browser opt-out signals and wider deletion
California Opt Me Out Act (AB 566). Signed October 8, 2025. It requires browsers to offer a built-in opt-out preference signal, and it takes effect in January 2027. Businesses already have to honor such signals (Global Privacy Control, for example). The difference is that far more visitors will be sending them.
Expanding Privacy Rights Act (SB 923). Signed September 27, 2026, effective January 1, 2027. The deletion right will cover personal information a business obtained from third parties, not just what it collected from the consumer. Businesses may keep a suppression list so that deleted data doesn't come back through enrichment. Online-only businesses must offer an online submission method such as a webform, not just an email address.
Enforcement to date
All of these are from CalPrivacy's Board decisions page and press releases, or from the Attorney General's announcements:
| Date | Company | Enforcer | Amount | Core issue |
|---|---|---|---|---|
| Aug 2022 | Sephora | AG | Settlement | Didn't disclose sales; ignored opt-out requests |
| Feb 2024 | DoorDash | AG | $375,000 | Marketing co-op treated as an undisclosed sale |
| Jun 2024 | Tilting Point Media | AG + LA City Attorney | $500,000 | Children's data in a mobile game |
| Mar 2025 | American Honda | CalPrivacy | $632,500 | Excess verification, asymmetric choices, agent hurdles, ad-tech contracts |
| May 2025 | Todd Snyder | CalPrivacy | $345,178 | Misconfigured opt-out tool; ID required to opt out |
| Jul 2025 | Healthline Media | AG | $1.55 million | Broken targeted-ad opt-out; health-related data sharing |
| Sep 2025 | Tractor Supply | CalPrivacy | $1.35 million | Notices, job applicant rights, GPC, vendor contracts |
| Mar 2026 | PlayOn Sports | CalPrivacy | $1.10 million | Forced tracking consent on student ticketing |
| Mar 2026 | Ford Motor | CalPrivacy | $375,703 | Email verification before opt-out |
| May 2026 | General Motors | AG + four DAs | $12.75 million (subject to court approval) | Sold driving and location data; first data minimization case |
CalPrivacy has also issued a steady run of Delete Act decisions against unregistered data brokers since late 2024. In August 2026 it brought its first case under both the CCPA and the Delete Act (LocateSmarter).
The pattern is consistent. Nearly every CCPA case involves the opt-out: tools that don't work, opt-outs gated behind identity verification, cookie banners that make "accept" easier than "decline", or Global Privacy Control signals that are ignored. The second most common issue is missing contract terms with ad-tech recipients. Honda, Todd Snyder and Ford were each penalized for asking for verification the regulations don't allow on opt-out requests. When CalPrivacy fined Todd Snyder, its enforcement head said "Using a consent management platform doesn't get you off the hook for compliance."
What to do now
- Test your opt-outs yourself. Turn on Global Privacy Control, load your site, and confirm in the network tab that third-party ad tags stop firing. Do the same with the "Do Not Sell or Share" link. This one test covers the most common enforcement theory.
- Remove verification from opt-out and limit requests. Verification belongs on access, deletion and correction, not on opt-outs.
- Inventory selling/sharing and sensitive PI flows and start risk assessments. Anything begun since January 1, 2026 needed one before launch. Legacy processing has until December 31, 2027.
- Decide whether you're in scope for cybersecurity audits and when your first audit period starts. A business over $100 million audits calendar 2027 and reports by April 1, 2028.
- List every automated tool in hiring, lending, housing, education or healthcare decisions. Either document meaningful human review or prepare pre-use notices and opt-out and access workflows by January 1, 2027.
- Prepare for January 2027: deletion that reaches third-party-sourced data (SB 923), a webform if you're online-only, and more browsers sending opt-out signals by default (AB 566).
- Check the data broker question if you sell data about people you don't deal with directly. If you're a broker, connect to DROP. The 45-day pull cycle has been running since August 2026.
- Fix vendor contracts. Every ad-tech and analytics recipient needs CCPA third-party or service-provider terms. See data processing agreements and sub-processor lists.
For request operations generally, see data subject request automation. For how California's regulators fit next to the FTC, other state AGs and foreign DPAs, see who regulates privacy where and the regulators directory.