CCPA compliance checklist: what the CCPA and CPRA require in 2026

The CCPA is no longer a law only big tech worries about. If you sell online to Californians, run ads with tracking pixels or employ people in California, it may well apply to you — and since 1 January 2026 it also asks some businesses for written risk assessments and, from 2028, independent cybersecurity audits. This checklist explains who is covered, what consumers can demand and how to keep CCPA obligations as tracked risks rather than a forgotten policy.

By Alex Martyushin, founder & risk consultant · Updated 30 October 2026 · 14 min read

What is the CCPA, and how does the CPRA fit in?

The California Consumer Privacy Act was passed in 2018 and took effect on 1 January 2020. In November 2020 California voters approved Proposition 24, the California Privacy Rights Act (CPRA), which rewrote large parts of the CCPA with most changes operative from 1 January 2023. People still say “CCPA” for the law as amended; “CPRA” usually refers to the amendments. There is one statute, in the California Civil Code from section 1798.100, plus detailed regulations in Title 11 of the California Code of Regulations.

The CPRA also created the California Privacy Protection Agency, which now uses the public name CalPrivacy. It shares enforcement with the California Attorney General, writes the regulations and runs the data broker registry. Unlike the GDPR, the CCPA is mainly an opt-out law: no lawful basis is needed to collect data, but you must be transparent and let people stop its sale or sharing. For EU or UK data, see our GDPR compliance checklist.

Who the CCPA applies to: thresholds in 2026

The CCPA applies to a business: a for-profit entity that does business in California, collects consumers’ personal information (or has it collected on its behalf), decides why and how it is processed, and meets at least one of three thresholds.

A few points that surprise smaller companies:

• Location does not matter. A business based in London or Austin that sells to Californians and meets a threshold is covered; the revenue test looks at total revenue.
• “Consumer” means any California resident. Since 1 January 2023 that includes employees, job applicants, contractors and business contacts — the temporary exemptions for HR and B2B data expired.
• Group companies can be pulled in. An entity that controls or is controlled by a covered business and shares common branding and personal information with it is also treated as a business.
• Service providers and contractors that process data on behalf of a business are not “businesses” for that processing, but they have direct obligations and must sign compliant contracts.

Common exemptions

Most exemptions apply to data, not to the whole company. Protected health information governed by HIPAA, data covered by the Gramm-Leach-Bliley Act, certain consumer report data under the Fair Credit Reporting Act and some clinical trial data are carved out. A clinic or bank therefore usually still needs CCPA compliance for its website visitors, marketing lists and employees. Most non-profits are outside the definition of a business. If you handle patient data, see our HIPAA guide for where the federal rules apply instead.

Personal information and sensitive personal information

Personal information is anything that identifies, relates to or could reasonably be linked with a consumer or household: names, emails, IP addresses, device identifiers, cookie IDs, purchase history, browsing behaviour, geolocation, inferences and profiles. Publicly available information and properly de-identified or aggregate data are excluded.

Sensitive personal information is a defined subset that attracts extra rights: government identifiers such as Social Security, driver’s licence and passport numbers; account log-ins and financial account or card numbers with security codes; precise geolocation; racial or ethnic origin, religious beliefs, union membership and citizenship or immigration status; the contents of mail, email and texts not addressed to the business; genetic and biometric data used for identification; and information about health, sex life or sexual orientation; and, following a 2024 amendment, neural data. Data about consumers under 16 carries its own opt-in rules, covered below.

Consumer rights under the CCPA

You must confirm receipt of requests to know, delete and correct within 10 business days, verify the requester’s identity in proportion to the sensitivity of the data, and offer at least two ways to submit requests (a business that operates only online and has a direct relationship with consumers may offer just an email address). Keep a record of requests and responses for at least 24 months. For children, opt-in rules apply: you need affirmative consent before selling or sharing the data of consumers under 16, and a parent’s or guardian’s consent for those under 13.

Notices, links and opt-out preference signals

The CCPA’s transparency rules are where most enforcement starts, because they are visible from the outside.

• Privacy policy. Describe the categories of personal information collected, sources, purposes, categories of recipients, whether you sell or share, retention periods, and how to exercise each right. Update it at least once every 12 months.
• Notice at collection. At or before the point of collection — a sign-up form, a checkout, an app permission, a job application — tell people what you collect, why, whether it is sold or shared, and how long you keep it.
• “Do Not Sell or Share My Personal Information”. If you sell personal information or share it for cross-context behavioural advertising, a clear link must appear on your homepage. If you use sensitive personal information beyond permitted purposes, add “Limit the Use of My Sensitive Personal Information”. The regulations allow a single “Your Privacy Choices” or “Your California Privacy Choices” link with the official icon instead of both.
• Notice of financial incentive. Loyalty schemes and discounts in exchange for data need a notice explaining the terms and a good-faith estimate of the value of the data.
• Opt-out preference signals. The regulations require businesses that sell or share to treat a browser signal such as Global Privacy Control as a valid opt-out request. From 1 January 2027, under the California Opt Me Out Act (AB 566, signed in October 2025), browsers must offer users a built-in way to send such a signal, so the volume of signals is likely to grow.

Avoid “dark patterns” such as opt-out flows with more steps than opting in: consent obtained through them is not valid, and asymmetrical cookie banners have featured in enforcement. Do not ask for ID to process an opt-out of sale or sharing.

Service providers, contractors and third parties

The CCPA distinguishes three kinds of recipient, and the label decides both the contract you need and whether the disclosure counts as a sale.

Without compliant terms, a vendor you think of as a processor may legally be a third party, turning a routine disclosure into a sale. Review vendor terms as part of your third-party risk assessment, and keep a list of which vendors receive personal information and under which label.

Reasonable security and data breaches

The CCPA requires reasonable security procedures appropriate to the nature of the personal information. It does not list controls, but the consequence of failure is specific: if certain non-encrypted and non-redacted personal information — such as a name with a Social Security number, financial account details or medical information, or an email address with a password — is breached because the business failed to maintain reasonable security, affected consumers may sue. Statutory damages are $107 to $799 per consumer per incident, or actual damages if greater (adjusted from $100–$750 in January 2025). This private right of action is the main reason CCPA class actions follow large breaches.

California’s separate breach notification law (Civil Code section 1798.82) sets when and how you notify. A tested data breach response plan covers both.

Risk assessments, cybersecurity audits and automated decisions

In 2025 the agency finalised a substantial package of regulations. The Office of Administrative Law approved them on 23 September 2025 and they took effect on 1 January 2026, with phased compliance dates. Exact applicability depends on the final text, so read the regulations themselves or take advice before relying on the summary below.

A CCPA risk assessment resembles a GDPR data protection impact assessment: describe the processing, its purpose, benefits, negative impacts on consumers and safeguards, and do not proceed if the risks to privacy outweigh the benefits. Link each assessment to the risks it found, so safeguards get owners and dates.

Data brokers and the Delete Act

Businesses that sell the data of consumers they have no direct relationship with must register as data brokers. Under the Delete Act, from 1 August 2026 registered brokers must check CalPrivacy’s Delete Request and Opt-out Platform (DROP) at least every 45 days and process the deletion requests it holds. If you buy lists or enrich leads, check that your suppliers are registered.

CCPA fines and enforcement

“Per violation” can mean per consumer, and the CPRA removed the original automatic 30-day cure period. Public enforcement has focused on visible failures: in 2022 the Attorney General settled with Sephora for $1.2 million over undisclosed sale of data through tracking and failure to honour Global Privacy Control; in 2025 the agency announced decisions against American Honda ($632,500), Todd Snyder ($345,178) and Tractor Supply ($1.35 million), covering issues such as excessive verification for opt-outs, asymmetrical cookie banners, misconfigured opt-out tools, contracts missing required terms and failure to notify job applicants. Larger settlements have been reported in 2026, and the agency has said it intends to increase enforcement.

CCPA compliance checklist

1. Scope and governance

• ☐ Test each threshold against last year’s figures, including group companies that share branding and data.
• ☐ Name an owner for privacy compliance and a deputy for requests.
• ☐ Identify exempt data (HIPAA, GLBA, FCRA) and the data that is still in scope.

2. Data mapping

• ☐ Inventory personal information by category, source, purpose, system, recipients and retention period — including employee and applicant data.
• ☐ Flag sensitive personal information and data of consumers under 16.
• ☐ List every tag, pixel and SDK on your websites and apps and what it sends where.

3. Notices and links

• ☐ Publish a complete privacy policy; diarise the 12-month review.
• ☐ Add notices at collection to forms, checkouts, apps and job applications.
• ☐ Add “Do Not Sell or Share” and, if needed, “Limit” links — or the combined privacy choices link.
• ☐ Honour Global Privacy Control and test that it actually switches off advertising tags.
• ☐ Review cookie banners and opt-out flows for symmetry and plain language.

4. Requests

• ☐ Provide at least two request methods; confirm within 10 business days; respond within 45 days.
• ☐ Set a proportionate verification method — opt-outs do not need identity verification.
• ☐ Log requests and responses and keep the log for 24 months.

5. Vendors and contracts

• ☐ Classify each recipient as service provider, contractor or third party.
• ☐ Put the required CCPA terms in service provider and contractor agreements.
• ☐ Pass opt-out requests on to third parties that received the data.

6. Security, assessments and training

• ☐ Maintain reasonable security based on a documented cybersecurity risk assessment; encrypt the data types that trigger the private right of action.
• ☐ Identify significant-risk processing and schedule CCPA risk assessments to meet the 2027 and 2028 dates.
• ☐ Check whether the cybersecurity audit rules apply and which revenue band sets your first deadline.
• ☐ Train staff who handle requests and anyone who adds marketing tools.

CCPA risks as risk register entries

A checklist tells you what to do once; a risk register keeps it done. Each gap that matters becomes a risk with a likelihood, impact, owner and treatment, scored on the same risk matrix as your other risks — that is also how compliance risk management works for any regulation.

Scores are illustrative on a 5×5 matrix. Useful key risk indicators include overdue requests, vendors without CCPA terms, untested opt-out signals and days since the policy was last reviewed.