The California Consumer Privacy Act, as amended by the California Privacy Rights Act, is the only US state privacy law that gives consumers a right to sue over a data breach and a dedicated regulator with its own security audit rules. Most write-ups treat it as a list of consumer rights. For a security team it is something else: a statutory duty to keep "reasonable security", a breach lawsuit regime with per-consumer damages, contract rules for every vendor that touches personal information, and from 2026 a set of regulations on cybersecurity audits, risk assessments and automated decisionmaking. This guide covers the law itself in depth: who it applies to, what it requires of security and privacy teams, the dated timeline, how enforcement actually works and what it means for AI agents and machine identities. It is written for security leaders, privacy engineers and compliance owners. For how California compares with the other state laws, see the US State Privacy Laws Guide.
Key takeaways
- Security is a statutory duty, not a best practice. Civil Code section 1798.100(e) requires a business to implement reasonable security procedures and practices appropriate to the nature of the personal information.
- Breaches carry per-consumer damages. Under section 1798.150 a consumer whose nonencrypted and nonredacted personal information is exposed through a failure of reasonable security can recover $107 to $799 per consumer per incident (CPI-adjusted from 1 January 2025), or actual damages if greater.
- Fixing security after a breach is not a cure. The statute says putting reasonable security in place after the breach does not cure that breach for the purposes of the 30-day notice.
- The 2026 regulations bring audits to the security team. Regulations effective 1 January 2026 add cybersecurity audits (first certifications due 1 April 2028 for the largest businesses), risk assessments (attestations due 1 April 2028) and ADMT duties from 1 January 2027.
- Enforcement is active and growing. The Attorney General and the California Privacy Protection Agency (which now publishes as CalPrivacy) have issued fines from $345,178 to $12.75 million, mostly for broken opt-outs, excessive verification and missing vendor contracts.
Scope: who and what is covered
The CCPA was enacted in 2018. Proposition 24, the California Privacy Rights Act, was approved by voters in November 2020 and its amendments took effect on 1 January 2023. The two are one statute today: Civil Code section 1798.100 and following, usually still called "the CCPA". The regulator created by Proposition 24 is the California Privacy Protection Agency (CPPA), which now also publishes under the name CalPrivacy.
The "business" test
The law applies to a for-profit entity that does business in California and meets one or more of the thresholds in section 1798.140(d)(1):
| Threshold | Statutory text | Current figure |
|---|---|---|
| (A) Revenue | Annual gross revenues over $25,000,000 in the preceding calendar year, adjusted for inflation | $26,625,000 from 1 January 2025 |
| (B) Volume | Alone or in combination, annually buys, sells or shares the personal information of 100,000 or more consumers or households | 100,000 (not adjusted) |
| (C) Data revenue | Derives 50 percent or more of annual revenues from selling or sharing consumers' personal information | 50 percent (not adjusted) |
The Attorney General notes that the law generally does not apply to nonprofit organisations or government agencies. Monetary figures are adjusted for inflation under section 1798.199.95(d); the most recent adjustment took effect on 1 January 2025, so check the CPPA thresholds page each January.
Who counts as a consumer
A "consumer" is a California resident. Since 1 January 2023 that includes job applicants, employees and independent contractors: the CPPA described its September 2025 Tractor Supply decision as the first to address privacy notices and rights for job applicants. Workforce data held in HR systems, identity providers and endpoint tools is therefore in scope, not only customer data.
Service providers, contractors and third parties
Section 1798.100(d) requires a written agreement whenever a business sells, shares or discloses personal information to a third party, service provider or contractor. The agreement must limit use to specified purposes, oblige the recipient to comply with the CCPA, let the business take reasonable steps to check compliance, require the recipient to say when it can no longer meet its obligations, and let the business stop and remediate unauthorised use. Cloud platforms, SaaS tools, AI model providers and analytics tags all sit in this chain.
Key obligations
The obligations a security and privacy team owns fall into five groups. Consumer rights handling is listed for completeness, because its failures are the most common enforcement finding.
| Obligation | Source | What it means in practice |
|---|---|---|
| Reasonable security | Civ. Code 1798.100(e) | Controls appropriate to the nature of the data; the standard behind breach lawsuits under 1798.150 |
| Collection and use limits | Regs section 7002 | Collection, use, retention and sharing must be reasonably necessary and proportionate to the disclosed purpose |
| Vendor contracts | Civ. Code 1798.100(d) | Written terms with every service provider, contractor and third party receiving personal information |
| Consumer rights | Civ. Code, including 1798.106 and 1798.121; regs sections 7020 to 7027 | Know, delete, correct (1798.106), opt out of sale or sharing, limit use of sensitive personal information (1798.121), non-discrimination |
| Opt-out preference signals | Regs section 7025 | Treat a browser signal such as Global Privacy Control as a valid request to opt out of sale or sharing |
| Cybersecurity audits | Regs Article 9, sections 7120 to 7124 | Annual independent audit and certification for businesses whose processing presents significant risk to security |
| Risk assessments | Regs Article 10, sections 7150 to 7157 | Assess listed high-risk processing before starting it and submit attestations and summaries |
| Automated decisionmaking technology | Regs Article 11 | Pre-use notice, opt-out and access rights where ADMT is used for a significant decision |
What "reasonable security" means here
The statute does not list controls. The best guide to what a regulator or court will expect is now the cybersecurity audit regulation itself: section 7123 lists the components an auditor must assess where applicable. Even a business below the audit thresholds should treat the section 7123 list as the benchmark for its reasonable security case. See the California CCPA Cybersecurity Audit and Risk Assessment Regulations Guide for the component-by-component detail.
Encryption and redaction as a liability boundary
The breach right of action under section 1798.150 applies only to nonencrypted and nonredacted personal information. Encryption is therefore not just a control: data that is encrypted (with keys not also taken) or redacted sits outside the statutory damages regime. That makes field-level encryption, tokenisation and redaction in logs and analytics stores some of the highest-value controls under this law.
Sensitive personal information
The CPRA created a "sensitive personal information" category and a right to limit its use (Civil Code section 1798.121; the CPPA's notice and request rules are regulation sections 7014 and 7027). Stores holding sensitive personal information deserve the strongest encryption, access review and logging, because they combine the highest regulatory and breach exposure.
Timeline and current status
Status as checked on the CPPA and Attorney General sites on 8 November 2026.
| Date | Event |
|---|---|
| 2018 | CCPA enacted |
| 14 August 2020 | Attorney General issues the initial CCPA regulations |
| November 2020 | Voters approve Proposition 24 (CPRA) |
| 1 January 2023 | CPRA amendments take effect; notice-and-cure before enforcement no longer required |
| 29 March 2023 | First CPPA regulations take effect |
| 1 July 2023 | CPPA can take complaints for violations on or after this date |
| 1 January 2025 | CPI adjustment: revenue threshold $26,625,000, fines and damages raised |
| 24 July 2025 | CPPA Board adopts cybersecurity audit, risk assessment and ADMT regulations |
| 22 September 2025 | Office of Administrative Law approves them |
| 1 January 2026 | Regulations effective; risk assessment compliance begins |
| 1 January 2027 | ADMT compliance date for businesses using ADMT for significant decisions |
| 1 April 2028 | Risk assessment attestations and summaries due; first audit certifications for businesses over $100 million revenue |
| 1 April 2029 | Audit certifications for businesses with $50 million to $100 million revenue |
| 1 April 2030 | Audit certifications for businesses under $50 million revenue |
Each audit covers a period ending on 1 January, with the report due by 1 April. The CPPA also has preliminary rulemaking open on employee data, opt-out preference signals, notices and disclosures, and reducing friction in exercising privacy rights, so further changes are likely. Treat this table as a snapshot and recheck the CPPA regulations page before relying on a date.
Enforcement and penalties
Three routes exist, and they reward different things.
| Route | Who | Amounts (from 1 January 2025) | Key condition |
|---|---|---|---|
| Administrative fines | CPPA Board (Civ. Code 1798.155) | Up to $2,663 per violation; up to $7,988 per intentional violation or where the business knows the consumer is under 16 | Administrative enforcement under regulation Article 13 |
| Civil penalties | Attorney General (Civ. Code 1798.199.90) | Same per-violation amounts | Civil action in court |
| Private right of action | Consumers (Civ. Code 1798.150) | $107 to $799 per consumer per incident, or actual damages if greater | Breach of nonencrypted, nonredacted personal information caused by a failure of reasonable security; 30 days' written notice before claiming statutory damages |
Two points shape breach exposure. First, damages are per consumer: a breach affecting a million Californians puts statutory exposure in the hundreds of millions before any argument about actual loss. Second, the cure route is narrow: a business can avoid statutory damages if it cures within 30 days and gives a written statement that no further violations will occur, but the statute says that implementing reasonable security after the breach is not a cure for that breach. For everything other than breaches, only the Attorney General or the CPPA can act, and since 1 January 2023 neither must offer a cure period first.
What regulators have fined
- CPPA, American Honda Motor Co., $632,500 (March 2025): excessive identity verification for opt-outs, asymmetric privacy choices, obstacles for authorised agents and ad tech sharing without the required contract terms.
- CPPA, Todd Snyder, $345,178 (May 2025): a misconfigured privacy portal left opt-out requests unprocessed for 40 days, and the firm demanded more information than needed and verification before opt-out.
- CPPA, Tractor Supply Company, $1,350,000 (September 2025): no notice to job applicants, no effective opt-out including Global Privacy Control, and disclosures to other companies without privacy contract terms.
- Attorney General actions: Sephora $1.2 million (August 2022), DoorDash $375,000 (February 2024), Tilting Point $500,000 (June 2024), Healthline $1.55 million (July 2025), Sling TV and Dish Media $530,000 (October 2025), Jam City $1.4 million (November 2025), The Walt Disney Company $2.75 million (February 2026) and General Motors $12.75 million (May 2026, CCPA and Unfair Competition Law).
- Data brokers: through 2025 and 2026 the CPPA ran repeated actions against data brokers, including its first joint CCPA and Delete Act action in August 2026. See the California Delete Act and Data Broker Registration Guide.
The pattern is consistent: technical failures in consent tooling, verification flows and vendor contracts, the kind of defect a security or engineering team could have caught with testing. Note that a misconfigured portal was enough for a six-figure fine.
What it means for AI agents and non-human identities
The CCPA is technology-neutral, but almost every obligation above runs through machine identities: the service accounts, API keys and OAuth grants that move personal information between systems, and now the AI agents that read and act on it.
- Reasonable security covers machine credentials: a leaked API key that opens a customer database is a failure of reasonable security in the same way as a weak human password. Inventory, owner assignment, rotation and least privilege for NHIs belong in the security case. See the NHI Inventory Reconciliation guide.
- AI providers and agent platforms are service providers or third parties: each one receiving personal information needs section 1798.100(d) contract terms, including purpose limits and the right to stop unauthorised use. A prompt containing customer records is a disclosure.
- Agents that decide are ADMT: the final regulations focus on ADMT that substantially replaces human decisionmaking for a significant decision. An agent that approves, denies or prices without human involvement can trigger pre-use notice, opt-out and access duties from 1 January 2027, plus a risk assessment. See the California AI Laws Guide.
- Risk assessments reach training and profiling: section 7150 lists the processing that requires a risk assessment, which law-firm summaries report includes processing sensitive personal information and training ADMT for significant decisions; check the regulation text. Agent projects need the assessment before launch, not after.
- Rights requests must reach agent memory: deletion and access requests apply to personal information in vector stores, conversation logs and agent memory as much as in the CRM. If you cannot find it, you cannot delete it.
- Logs are evidence and exposure: agent transcripts and tool-call logs prove what happened, but unredacted logs holding personal information are also breach material. Redact at write time and keep logs encrypted. See the AI Agent Audit Trails for Regulators Guide.
Compliance steps
- Confirm applicability: test each legal entity against the three thresholds using the current CPI figure, and record the result with the date.
- Map the data: build an inventory of personal information including workforce data, sensitive personal information and data held by agents, vector stores and logs. See the Data Mapping and ROPA Guide.
- Write the reasonable security case: map existing controls against the section 7123 components, record gaps and owners, and prioritise encryption and redaction for stores holding breach-qualifying data.
- Fix vendor contracts: list every service provider, contractor and third party (including AI model and agent vendors and ad tech tags) and confirm section 1798.100(d) terms are in place.
- Test the rights pipeline end to end: submit test requests, including opt-out by Global Privacy Control and via an authorised agent, and check that opt-outs take effect without verification and within the required time. The Todd Snyder and Honda decisions show this is where fines land.
- Stand up risk assessments: identify processing in the section 7150 trigger list, assess it now (compliance began 1 January 2026) and prepare the attestation and summary due 1 April 2028.
- Plan the audit: determine whether you meet the audit criteria, pick an independent auditor, align the audit period to the calendar year and book the first certification date by revenue band.
- Inventory ADMT before 1 January 2027: find agents and models making significant decisions without human involvement and decide whether to add human review or build the notice and opt-out flows.
- Prepare breach response: pair the CCPA with California's breach notification statute and pre-draft the response to a 30-day notice letter. See the Data Breach Notification Checklist.
Framework mapping
| CCPA requirement | NIST CSF 2.0 | ISO/IEC 27001:2022 Annex A |
|---|---|---|
| Know and manage legal duties | GV.OC-03 | A.5.31 Legal, statutory, regulatory and contractual requirements; A.5.34 Privacy and protection of PII |
| Reasonable security of data at rest | PR.DS-01 | A.8.24 Use of cryptography |
| Least privilege for people and machines | PR.AA-05 | A.5.15 Access control; A.8.2 Privileged access rights |
| Vendor contract terms | GV.SC-05 | A.5.20 Addressing information security within supplier agreements |
| Monitoring and audit evidence | DE.CM-09 | A.8.15 Logging; A.8.16 Monitoring activities |
| Breach notification | RS.CO-02 | A.5.26 Response to information security incidents |
Common failure patterns
- Treating the CCPA as a privacy-team problem: the breach right of action and the audit regulations are security obligations, and the security team is usually absent from the compliance plan.
- Broken opt-out plumbing: portals that silently fail, consent tools that ignore Global Privacy Control, and verification demanded for an opt-out. Every 2025 CPPA decision above included one of these.
- Missing contracts for tags and AI tools: ad tech pixels, analytics SDKs and AI assistants receiving personal information with no section 1798.100(d) terms.
- Plaintext copies outside the core database: exports, logs, data lakes and agent context windows holding unencrypted personal information that falls straight into the statutory damages regime.
- Forgetting workforce data: HR, recruiting and identity systems are in scope since 2023, as the Tractor Supply decision showed.
- Using stale thresholds: quoting $25 million or $750 after the 2025 adjustment, and missing the next adjustment.
Practitioner checklist
- Record the applicability test per entity with the current CPI revenue figure and the date checked.
- Maintain a personal information inventory that includes workforce data, sensitive personal information, logs, vector stores and agent memory.
- Encrypt or redact every store holding breach-qualifying personal information, and keep keys separate from the data.
- Map controls to the section 7123 audit components and track gaps with owners and dates.
- Confirm section 1798.100(d) contract terms for every vendor, AI provider and tag receiving personal information.
- Test opt-out, Global Privacy Control and authorised agent flows quarterly with synthetic requests.
- Run risk assessments for section 7150 processing and calendar the 1 April 2028 submission.
- Inventory agents and models making significant decisions before 1 January 2027.
- Assign owners, rotation and least privilege to every non-human identity that can read personal information.
- Recheck the CPPA regulations and thresholds pages every January and after each Board meeting.
Standards and references
- California Privacy Protection Agency: California Consumer Privacy Act statute (effective 1 January 2026)
- California Privacy Protection Agency: Approved regulations text, cybersecurity audits, risk assessments and ADMT (effective 1 January 2026)
- California Privacy Protection Agency: CCPA Updates, Cybersecurity Audits, Risk Assessments and ADMT rulemaking
- California Privacy Protection Agency: California Finalizes Regulations to Strengthen Consumers' Privacy
- California Privacy Protection Agency: CCPA monetary thresholds
- California Attorney General: California Consumer Privacy Act (CCPA)
- California Attorney General: Privacy Enforcement Actions
- California Privacy Protection Agency: Tractor Supply enforcement decision
Related NHI Mgmt Group resources: US State Privacy Laws Guide · California CCPA Cybersecurity Audit and Risk Assessment Regulations Guide · California AI Laws Guide · IAB TCF and Global Privacy Control Signals Guide · Privacy Programme Guide for Security Teams. This guide summarises the California Consumer Privacy Act as amended by the CPRA and its regulations as checked on 8 November 2026 and is not legal advice.