California privacy laws center on the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). The CCPA applies to for-profit businesses that collect California residents’ personal information and meet a revenue or data-volume threshold, and it gives consumers rights to know, delete, correct, and opt out of the sale or sharing of their data. New regulations adopted in 2025 add risk assessments, cybersecurity audits, and rules for automated decision-making, phased in over the next several years.
An earlier version of this article described the CPRA as a new law taking effect in 2023. It has been in force for years, and the compliance picture has kept moving. Many companies that did a privacy project once now find their policies, vendor contracts, and website tools out of date. Here is where things stand.
Who the CCPA Covers
The CCPA applies to a for-profit business that does business in California, collects consumers’ personal information, and meets at least one of these thresholds:
- Annual gross revenue over $25 million, adjusted for inflation (about $26.6 million as of the most recent adjustment)
- Buying, selling, or sharing the personal information of 100,000 or more California consumers or households each year
- Deriving 50% or more of annual revenue from selling or sharing personal information
“Consumer” means any California resident, including employees, job applicants, contractors, and business-to-business contacts. The temporary exemptions for employee and B2B data expired at the start of 2023, so HR and sales data are now fully in scope.
Consumer Rights
Covered businesses must honor several rights, generally within set response deadlines:
- Right to know and access the categories and specific pieces of personal information collected, and how it is used and disclosed
- Right to delete personal information, subject to exceptions
- Right to correct inaccurate information
- Right to opt out of the sale or sharing of personal information, including sharing for cross-context behavioral advertising
- Right to limit the use of sensitive personal information, such as precise geolocation, government IDs, health data, and account credentials
- Right to non-retaliation for exercising these rights
Opt-Out Preference Signals
Businesses that sell or share personal information must treat a browser-based opt-out preference signal, such as Global Privacy Control, as a valid opt-out request. This is an active enforcement priority. Many sites use advertising pixels, analytics tools, or session replay that count as “sharing,” and a cookie banner alone does not satisfy the requirement. If your site runs third-party tracking, test whether it actually responds to the signal. Online retailers should also review our article on the legal aspects of e-commerce in California.
Notices, Contracts, and Data Minimization
The CCPA requires more than a privacy policy, although you need one of those too:
- Notice at collection describing the categories of information collected, purposes, and retention periods
- A privacy policy updated at least every 12 months. The separate California Online Privacy Protection Act (CalOPPA) also requires commercial websites and apps collecting personal information from California residents to post one.
- Contracts with service providers, contractors, and third parties that include CCPA-required terms limiting how they use the data
- Data minimization, meaning collection and use must be reasonably necessary and proportionate to the disclosed purposes, and data should not be kept longer than needed
- Reasonable security, which also matters under California’s data breach notification law
The 2025 Regulations: ADMT, Risk Assessments, and Audits
In 2025 California finalized regulations on three topics that will shape compliance work for the next several years. The general timeline is:
- Automated decision-making technology (ADMT). Businesses that use ADMT to make significant decisions about consumers, such as decisions on employment, lending, housing, or access to essential services, must provide pre-use notices, opt-out or appeal rights, and access information. Compliance is required beginning in 2027.
- Risk assessments. Processing that presents significant risk, including selling or sharing data, processing sensitive information, and certain ADMT uses, requires a documented risk assessment. Attestations and summaries are due to the regulator starting in 2028.
- Cybersecurity audits. Businesses whose processing presents significant security risk must complete independent annual audits, with first certifications phased in from 2028 through 2030 based on revenue.
Companies building AI products should map these rules against their models and data flows now. See our articles on regulatory compliance for AI-based products and cybersecurity laws for AI startups.
The Delete Act and Data Brokers
California’s Delete Act created a centralized deletion mechanism for data brokers. Since 2026, consumers can submit a single deletion request through a state platform, and registered data brokers must periodically retrieve and process those requests, with processing obligations beginning in August 2026. Businesses that buy or sell consumer data should confirm whether they meet the data broker definition and register if required.
Enforcement and Penalties
The CCPA is enforced by both the California Privacy Protection Agency, which began using the name “CalPrivacy” in 2025, and the Attorney General. Administrative fines run up to $2,500 per violation and $7,500 per intentional violation or violation involving the data of consumers under 16, with both amounts adjusted for inflation. Because violations can be counted per consumer, exposure adds up quickly. The original 30-day right to cure was removed by the CPRA, although regulators may still consider cooperation and remediation.
Consumers have a private right of action only for certain data breaches caused by a failure to maintain reasonable security, with statutory damages available.
The Takeaway
California privacy compliance is an ongoing program, not a one-time project. Confirm whether the CCPA applies, include employee and B2B data, test your site’s response to opt-out signals, update vendor contracts, and start planning now for the ADMT, risk assessment, and audit deadlines. Businesses that handle consumer data at scale should also check the data broker rules.
Frequently Asked Questions
Does the CCPA apply to small businesses?
Only if they meet a threshold. A business is covered if it exceeds the inflation-adjusted revenue threshold, buys, sells, or shares data of 100,000 or more California consumers or households, or earns half its revenue from selling or sharing personal information. Many smaller ad-supported and data-heavy businesses meet the 100,000 test.
Does the CCPA cover employee data?
Yes. The temporary exemptions for employee and business-to-business data expired at the start of 2023. Employees, applicants, and contractors now have the same rights as other California consumers.
Do I have to honor Global Privacy Control?
Yes, if you sell or share personal information. California treats opt-out preference signals like Global Privacy Control as valid opt-out requests. Businesses should confirm their websites detect and apply the signal.
Is there still a 30-day cure period under the CCPA?
No. The CPRA eliminated the automatic 30-day right to cure. Regulators may still weigh a business’s cooperation and remediation when deciding how to proceed.
How Sutter Law Can Help
We help companies assess whether California privacy laws apply, update privacy notices and vendor contracts, and plan for risk assessments and ADMT obligations. Learn more about our privacy compliance work, or contact us for a free consultation.
This article is general information, not legal advice. Reading it does not create an attorney-client relationship.
