Which businesses does the CCPA cover?
The CCPA, as amended by the CPRA, generally covers a for-profit entity that does business in California, determines the purposes and means of processing consumers' personal information, and meets at least one statutory threshold. The definition also covers certain commonly branded entities that control or are controlled by a covered business and with which that business shares consumers' personal information, qualifying joint ventures or partnerships, and entities that voluntarily certify compliance. On a touch screen, a tap shows all 3 sources in this group. For the revenue threshold, the CPPA adjustment effective January 1, 2025 sets $26,625,000.
The revenue test is not the only threshold in paragraph (d)(1): that paragraph also covers entities that annually buy, sell, or share the personal information of 100,000 or more consumers or households, or derive 50 percent or more of annual revenue from selling or sharing personal information .
An applicability review turns on three inputs: preceding-calendar-year gross revenue, the annual number of consumers or households whose personal information the entity buys, sells, or shares, and the share of annual revenue from selling or sharing personal information. The affiliate, joint-venture, and voluntary-certification paths require separate review. Posting a policy does not itself answer the CCPA coverage question. On a touch screen, a tap shows all 4 sources in this group.
California's Online Privacy Protection Act (CalOPPA) has a separate policy duty with no revenue or volume threshold: Cal. Bus. & Prof. Code § 22575(a) requires an operator of a commercial website or online service that collects personally identifiable information online about California residents who use or visit it to conspicuously post or make available a privacy policy. A site below the CCPA thresholds may still owe that policy.
For a covered business preparing its online notice, the privacy policy reviewer checklist provides a document-level review alongside the California-specific requirements below.
Sources for this answer
Paragraph (d)(1) covers a for-profit entity that determines the purposes and means of processing California consumers' personal information and meets at least one revenue, transaction-volume, or sale/share revenue threshold.
A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers’ personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers’ personal information, that does business in the State of California, and that satisfies one or more of the following thresholds: (A) As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to subdivision (d) of Section 1798.199.95. (B) Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households. (C) Derives 50 percent or more of its annual revenues from selling or sharing consumers’ personal information.
See Cal. Civ. Code § 1798.140(d)(1).
The CCPA definition also includes certain commonly branded entities that control or are controlled by a covered business and with which that business shares consumers' personal information.
Any entity that controls or is controlled by a business, as defined in paragraph (1), and that shares common branding with the business and with whom the business shares consumers’ personal information.
See Cal. Civ. Code § 1798.140(d)(2).
The CCPA definition also includes certain joint ventures or partnerships of covered businesses.
A joint venture or partnership composed of businesses in which each business has at least a 40 percent interest.
See Cal. Civ. Code § 1798.140(d)(3).
A person doing business in California can voluntarily certify CCPA compliance and agree to be bound by the statute.
A person that does business in California, that is not covered by paragraph (1), (2), or (3), and that voluntarily certifies to the California Privacy Protection Agency that it is in compliance with, and agrees to be bound by, this title.
See Cal. Civ. Code § 1798.140(d)(4).
What must your California privacy policy contain?
A CCPA-covered business must describe consumer rights and request methods in its online privacy policy or, without one, on its website . It must update that information at least once every 12 months . The implementing regulation specifies the policy's required contents . At or before collection, the business must separately identify the personal information categories collected and their purposes .
For a template privacy policy, that means the document is not a static disclaimer — it is a dated, annually-updated instrument that must, at minimum: (1) describe each consumer right under sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, and 1798.125; (2) list the categories of personal information collected, the sources, the business or commercial purposes, and the categories of third parties to whom information is disclosed or sold; and (3) state at least two methods for exercising rights. The notice at collection is a distinct, just-in-time disclosure given at the point of collection, not a substitute for the policy.
The CPPA's implementing regulation spells out the same obligation in granular form: it enumerates exactly what the privacy policy must include, beginning with a comprehensive description of the business's information practices . A template that maps each regulatory line item to a section of the policy is the most reliable way to demonstrate compliance.
Treat the requirement to update the policy at least once every 12 months as a hard maintenance obligation, not a courtesy. A privacy policy whose last-reviewed date has gone stale is itself a compliance gap, independent of whether the underlying practices changed — the statute makes the annual refresh a standalone duty .
Sources for this answer
A business must disclose CCPA-required information in its online privacy policy, including a description of consumer rights and request methods, and update it at least every 12 months.
Disclose the following information in its online privacy policy or policies if the business has an online privacy policy or policies and in any California-specific description of consumers’ privacy rights, or if the business does not maintain those policies, on its internet website, and update that information at least once every 12 months: (A) A description of a consumer’s rights pursuant to Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, and 1798.125 and two or more designated methods for submitting requests, except as provided in subparagraph (A) of paragraph (1) of subdivision (a).
See Cal. Civ. Code § 1798.130(a)(5).
At or before the point of collection, a business must inform consumers of the categories of personal information collected and the purposes for which they are used.
A business that controls the collection of a consumer’s personal information shall, at or before the point of collection, inform consumers of the following:
See Cal. Civ. Code § 1798.100(a).
The CPPA regulation enumerates the content a privacy policy must include, starting with a comprehensive description of the business's online and offline information practices.
The privacy policy shall include the following information:
See Cal. Code Regs. tit. 11, § 7011(e).
What must your contracts with vendors and service providers say?
The CCPA requires a written agreement when a business sells or shares personal information or discloses it to a service provider or contractor for a business purpose . The agreement must limit the recipient to specified purposes and require compliance with the CCPA .
This is the provision that makes a data processing agreement a statutory requirement rather than a best practice. A recipient that lacks a compliant contract does not qualify as a service provider or contractor, which means the disclosure can be treated as a sale or a share — triggering opt-out rights and disclosure obligations the business may not have planned for. The implementing CPPA regulation supplies the specific clauses a compliant template DPA must carry — including identifying the limited and specified business purposes and barring generic, contract-wide descriptions .
Sources for this answer
A business that sells, shares, or discloses personal information to a third party, service provider, or contractor must enter a contract specifying that the information is used only for limited and specified purposes and obligating CCPA compliance.
A business that collects a consumer’s personal information and that sells that personal information to, or shares it with, a third party or that discloses it to a service provider or contractor for a business purpose shall enter into an agreement with the third party, service provider, or contractor, that:
See Cal. Civ. Code § 1798.100(d).
The CPPA regulation requires a service-provider or contractor contract to identify the specific, limited business purposes for the processing and forbids describing them in generic, contract-wide terms.
Identify the specific business purpose(s) for which the service provider or contractor is processing personal information pursuant to the written contract with the business, and specify that the business is disclosing the personal information to the service provider or contractor only for the limited and specified business purpose(s) set forth within the contract.
See Cal. Code Regs. tit. 11, § 7051(a)(2).
Can a consumer sue your business after a data breach?
A California consumer may sue under the CCPA only for a qualifying data breach caused by a business's failure to maintain reasonable security . The claim covers specified nonencrypted, nonredacted personal information or an email address paired with account-access credentials .
There is no California appellate decision squarely defining the outer edges of this private right of action. The Ninth Circuit has, however, recognized that CCPA breach claims carry real settlement value: in reviewing a data-breach class settlement it noted the CCPA claims “potentially conferred statutory damages to the California subclass” and were weighed in assessing the settlement’s adequacy . For a business, the practical takeaway is that the litigation exposure is concentrated entirely at the security-failure-plus-breach boundary.
Sources for this answer
A consumer may bring a civil action when nonencrypted, nonredacted personal information is subject to unauthorized access as a result of the business's failure to maintain reasonable security.
Any consumer whose nonencrypted and nonredacted personal information, as defined in subparagraph (A) of paragraph (1) of subdivision (d) of Section 1798.81.5, or whose email address in combination with a password or security question and answer that would permit access to the account is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’ violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information may institute a civil action
See Cal. Civ. Code § 1798.150(a)(1).
In reviewing the adequacy of a data-breach class settlement, the Ninth Circuit recognized that CCPA claims potentially conferred statutory damages to the California subclass.
The district court also considered the California Consumer Privacy Act (CCPA) claims—which potentially conferred statutory damages to the California subclass—in assessing the adequacy of the settlement.
See In re California Pizza Kitchen, Inc., 129 F.4th 667 (9th Cir. 2025).
Do the new CPPA rules on AI, risk assessments, and cybersecurity audits apply to you?
The CPPA's new risk-assessment, cybersecurity-audit, and automated-decisionmaking rules apply only when a business's processing meets the relevant regulatory thresholds . The audit and automated-decisionmaking requirements phase in on different schedules .
There are three thresholds to map against your operations. First, a risk assessment is required before you begin any processing that presents significant risk to privacy — which the regulation defines to include selling or sharing personal information, processing sensitive personal information, and using ADMT for a significant decision . Second, an annual cybersecurity audit is required once your processing presents significant risk to security, with the first audit report due April 1, 2028 for the largest businesses and phasing in later for smaller ones . Third, if you use ADMT to make a significant decision about a consumer — in lending, housing, education, employment, or healthcare — you must reach compliance, including pre-use notices and opt-out and access rights, no later than January 1, 2027 .
For a template privacy program, inventory now where automated tools drive significant decisions and where high-risk processing occurs. The documentation obligations are dated: ADMT compliance by January 1, 2027 and the first cybersecurity-audit reports and risk-assessment submissions from April 1, 2028 — so the records need to exist before those dates, not after .
Sources for this answer
A business must conduct a risk assessment before initiating any processing that presents significant risk to consumers' privacy, including selling or sharing personal information, processing sensitive personal information, or using ADMT for a significant decision.
Every business whose processing of consumers’ personal information presents significant risk to consumers’ privacy as set forth in subsection (b) must conduct a risk assessment before initiating that processing.
See Cal. Code Regs. tit. 11, § 7150(a).
A business whose processing presents significant risk to consumers' security must complete a cybersecurity audit.
Every business whose processing of consumers’ personal information presents significant risk to consumers’ security as set forth in subsection (b) must complete a cybersecurity audit.
See Cal. Code Regs. tit. 11, § 7120(a).
The first cybersecurity audit report is due April 1, 2028 for businesses with more than $100 million in 2026 annual gross revenue, with later dates for smaller businesses.
April 1, 2028, if the business’s annual gross revenue for 2026 was more than one hundred million dollars ($100,000,000) as of January 1, 2027.
See Cal. Code Regs. tit. 11, § 7121(a)(1).
A business using ADMT to make a significant decision about a consumer must comply with the ADMT rules no later than January 1, 2027.
A business that uses ADMT for a significant decision prior to January 1, 2027, must be in compliance with the requirements of this Article no later than January 1, 2027.
See Cal. Code Regs. tit. 11, § 7200(b).