Privacy Map

California. Comprehensive data protection. Act

CCPA/CPRACalifornia Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code § 1798.100 et seq.)

In force

§1Summary

Synopsis

Gives California residents rights to know, delete, correct and opt out of the sale or sharing of their personal information, and to limit use of sensitive personal information. Imposes notice, contracting, data minimisation and purpose-limitation duties on businesses, enforced by a dedicated privacy agency and the AG.

Key themes
  • right to know
  • delete
  • correct
  • opt-out of sale/sharing
  • limit sensitive PI
  • Global Privacy Control
  • service provider contracts
  • data minimisation
Unique features

Only US state law with a dedicated privacy regulator and full coverage of employee and B2B data; private right of action for security breaches; opt-out preference signals mandatory.

SaaS relevance

Applies to for-profit businesses doing business in California with over $26.625m revenue, or handling data of 100,000+ consumers/households, or earning 50%+ revenue from selling/sharing; SaaS vendors are 'service providers' needing prescribed contract terms.

§2Obligations

Extraterritorial
Yes
Breach notification
See Cal. Civ. Code § 1798.82 (separate statute); private action for breaches under § 1798.150
DPO
No
Cross-border transfers
None
Maximum penalty
$2,663 per violation; $7,988 per intentional violation or involving minors under 16; breach statutory damages $107–$799 per consumer per incident

§3Dates

Key dates
  • Adopted
  • In force
  • CCPA effective 2020-01-01; CPRA (Proposition 24) approved 2020-11-03, operative 2023-01-01; agency renamed publicly as 'CalPrivacy' in 2025; monetary thresholds CPI-adjusted every odd year (latest 2025-01-01).

§4Text and authority

Text
Authority
California Privacy Protection Agency (CalPrivacy) and California Attorney General

§5Where it applies

Domestic law of
California

§6Sources and verification

Sources consulted
Verification

High confidence.

'CalPrivacy' is the agency's public-facing name; its statutory name remains the California Privacy Protection Agency.