A Guide to CCPA and CPRA Requirements and Checklists (2026)

If you’ve ever clicked a “Do Not Sell or Share My Personal Information” link at the bottom of a website, you’ve seen CCPA compliance at work. California’s privacy law shapes how companies collect and use data from website visitors, and it reaches well beyond companies based in California.

This CCPA compliance guide covers what the law requires, who it applies to, how the CPRA changed it, and what happens when companies get it wrong. From there, we’ll walk through how to become CCPA-compliant, plus a CCPA compliance checklist you can use to track your progress.

What Is CCPA Compliance?

CCPA compliance is meeting the requirements the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA), sets for how businesses collect, use, sell, share, and disclose the personal information of California residents, and being able to prove it when asked.

The law runs mostly on an opt-out model. Businesses can collect personal information without asking first, but they have to tell people what they’re collecting and why, and they have to make it easy to say no.

What Are the CCPA Requirements?

Compliance rests on two pillars.

First, a set of obligations that shape how you collect and handle personal information:

• Giving consumers a notice at or before the point of collection that lists the categories of personal information you collect and what you use them for
• Keeping a privacy policy that explains consumers’ rights and how to exercise them
• Posting a “Do Not Sell or Share My Personal Information” link if you sell or share personal information and honoring Global Privacy Control signals as valid opt-out requests
• Offering at least two ways for consumers to submit requests and responding within the deadlines the law sets

Second, a set of rights guaranteed to every California resident whose data you handle. These give consumers enforceable control over their information, and they give your organization documented work to do to honor them.

What Is CCPA?

The California Consumer Privacy Act of 2018 (CCPA) is a state law that gives California residents more control over the personal information businesses collect about them. It took effect on January 1, 2020, and it’s enforced by the California Attorney General and the California Privacy Protection Agency (CPPA), which now also goes by CalPrivacy.

Personal information under CCPA is anything that identifies, relates to, or could reasonably be linked with a person or their household. That includes names, email addresses, purchase records, browsing history, geolocation data, fingerprints, and inferences drawn from other data to build a profile of someone’s preferences.

The law also defines a narrower category called sensitive personal information. It covers things like Social Security numbers, account logins, precise geolocation, the contents of messages, genetic and biometric data, health information, and information about racial or ethnic origin, religion, or sexual orientation.

Some information falls outside the law entirely, including publicly available government records and certain medical and credit reporting information covered by other laws.

What Is CPRA?

The California Privacy Rights Act (CPRA) is a 2020 ballot measure, Proposition 24, that amended the CCPA. Its changes took effect on January 1, 2023.

The CPRA added new consumer rights, including the right to correct inaccurate information and the right to limit how businesses use sensitive personal information. It also expanded the opt-out right to cover “sharing” personal information for cross-context behavioral advertising, which is ad targeting based on someone’s activity across different websites. And when the CPRA took effect, the CCPA’s temporary exemptions for employee data and business-to-business data expired.

The CPRA didn’t create a separate law. California’s Attorney General refers to the combined law as “CCPA” or “CCPA, as amended,” which is why CCPA compliance and CPRA compliance mean the same thing today. A business that complies with the CCPA as it currently stands is complying with the CPRA’s requirements too.

Why Is CCPA Important?

CCPA was the first comprehensive consumer privacy law in the United States, and it’s still the broadest and most demanding state privacy law in the country. It gives California residents legal power over data that used to sit entirely in the hands of whoever collected it. For businesses, it set the standard that the more than 20 state privacy laws passed since have borrowed from.

For Consumers

The CCPA, as amended by the CPRA, gives California residents these rights:

• The right to know what personal information a business has collected about them, where it came from, why it’s used, and who it’s shared with, covering the previous 12 months, free of charge
• The right to delete personal information a business collected from them, with some exceptions, such as information the business is legally required to keep (starting in 2027 this also covers data a business got from third parties)
• The right to opt out of the sale or sharing of their personal information, including through a browser signal like Global Privacy Control
• The right to correct inaccurate personal information a business holds about them
• The right to limit how a business uses and discloses their sensitive personal information
• The right to non-discrimination, so a business can’t deny service or charge a different price because someone exercised their rights

Consumers also have the right to be told, at or before collection, what categories of personal information a business collects and what it does with them.

The deadlines are specific. Businesses have 45 calendar days to respond to requests to know, delete, or correct, with one 45-day extension if they notify the consumer. Opt-out requests must be honored as soon as feasibly possible, within 15 business days at most. After someone opts out, a business has to wait at least 12 months before asking them to opt back in.

For Businesses

For businesses, the most immediate reason CCPA matters is enforcement. California regulators can fine companies per violation, and on a website that processes thousands of visits a day, a misconfigured opt-out can turn into a lot of violations fast. We cover the penalties in detail below.

Trust matters too. 75% of consumers said they will not buy from a company they don’t trust with their data in Cisco’s 2024 Consumer Privacy Survey. A public enforcement action tells customers exactly the wrong thing.

CCPA compliance work also carries over. Many of the state privacy laws passed since 2020 share CCPA’s basic structure: notices, consumer rights, opt-outs, and vendor contracts. A program built for California gives you a strong starting point for the rest.

Who Does CCPA Apply To?

CCPA applies to for-profit businesses that do business in California, collect consumers’ personal information, and meet at least one of three thresholds set out in the law:

• Annual gross revenue over $26,625,000 in the preceding calendar year, adjusted for inflation from the original $25 million
• Buying, selling, or sharing the personal information of 100,000 or more California consumers or households each year
• Earning 50% or more of annual revenue from selling or sharing consumers’ personal information

Meeting any one of them is enough, and a company doesn’t need to be based in California to qualify.

The revenue threshold catches a lot of companies off guard. California is the only state whose privacy law applies on revenue alone, regardless of how much California consumer data a business handles. That pulls in B2B companies and professional services firms that collect very little consumer data.

CCPA also defines “consumer” more broadly than most state laws. Since January 1, 2023, it has covered personal information about employees, job applicants, contractors, and business contacts who live in California, which brings HR, recruiting, and sales teams into scope.

Nonprofits and government agencies generally fall outside the law.

The dollar figures here change every odd-numbered year with inflation, so check the CPPA’s current thresholds before relying on them.

What Are the Risks of Not Complying with CCPA?

CCPA fines reach $2,663 per violation, or $7,988 per violation when it’s intentional or involves the personal information of a consumer the business knows is under 16.

Those numbers look small next to GDPR’s percentage-of-revenue fines. But they apply per violation, and an opt-out that fails on a busy website fails for every visitor who uses it.

Two regulators enforce the law. The CPPA issues administrative fines through its Enforcement Division, and the California Attorney General brings civil cases, sometimes alongside county district attorneys.

CCPA Fines in Practice

Recent enforcement actions show how those per-violation amounts add up:

• General Motors, $12.75 million (May 2026). The largest CCPA penalty to date, still subject to court approval. The Attorney General alleged GM sold OnStar drivers’ location and driving data to data brokers without adequate notice or consent.
• Disney, $2.75 million (February 2026). Disney’s opt-out toggle often applied only to the streaming service and device the consumer was using, and Global Privacy Control signals were honored only on the device that sent them.
• Tractor Supply, $1.35 million (September 2025). The largest fine in the CPPA’s history. Tractor Supply’s privacy policy didn’t tell consumers or job applicants about their rights, its opt-out didn’t work with GPC, and it shared personal information without the required contracts. It also has to scan its digital properties to inventory its tracking technologies.
• Ford, $375,703 (March 2026). Ford required consumers to verify their email address before it would process an opt-out request. Along with the fine, Ford has to audit the tracking technologies on its website and honor opt-out preference signals like GPC.

The common thread is opt-outs. A majority of the Attorney General’s CCPA settlements have focused on opt-out failures, and a broken “Do Not Sell or Share” link or an ignored GPC signal is easy for a regulator to test from the outside.

Can Consumers Sue Under CCPA?

Only after certain data breaches. Consumers can sue if their unencrypted, unredacted personal information was stolen because a business failed to maintain reasonable security, for $107 to $799 per consumer per incident or actual damages, whichever is greater. Every other CCPA violation is enforced by the state.

If you’ve received a demand letter about website tracking, it most likely cites the California Invasion of Privacy Act (CIPA), not the CCPA. CIPA is a separate law, and CCPA compliance doesn’t protect you from it. California’s SB 690 ends private CIPA pen-register suits on January 1, 2027, but wiretapping claims remain. Here’s what SB 690 changes and what it doesn’t, and how to prepare your website before a CIPA demand letter arrives.

How Is CCPA Different From Other Privacy Laws?

CCPA runs on opt-out: businesses can collect and use personal information by default, as long as they tell people and let them say no. Most other US state laws use a similar opt-out model, but they require opt-in consent before processing sensitive data. CCPA covers more people and more businesses, and California is the only state with a dedicated privacy agency enforcing its law.

CCPA vs. GDPR

The biggest difference is the starting point. Under GDPR, you need a valid legal basis, often consent, before you collect anyone’s data. Under CCPA, collection is allowed by default, and the burden falls on the consumer to opt out. We cover GDPR in depth in our GDPR compliance guide.

GDPR’s fines are much larger per case, but CCPA’s per-violation structure can add up quickly on a high-traffic website.

CCPA vs. Other State Privacy Laws

More than 20 states have passed comprehensive privacy laws since CCPA, and most share its core rights: access, deletion, correction, and opting out of sale and targeted advertising. CCPA reaches further than most of them. It covers employees and B2B contacts, which most state laws exclude, and it’s the only state law that can apply to a company based on revenue alone.

How CCPA Is Changing

CCPA keeps evolving through new regulations and amendments, and several changes take effect on January 1, 2027. Here’s what’s new and what’s coming.

New CPPA Regulations

New CCPA regulations took effect on January 1, 2026. Along with updates to existing rules, they add requirements for cybersecurity audits, risk assessments, and automated decision-making technology (ADMT). The new requirements phase in over several years:

• January 1, 2026: Businesses subject to risk assessment requirements must begin complying.
• January 1, 2027: Businesses that use ADMT to make significant decisions must comply with the ADMT rules.
• April 1, 2028: Risk assessment attestations and summaries are due to the CPPA, along with the first cybersecurity audit certifications for businesses with revenue over $100 million.
• April 1, 2029: Cybersecurity audit certifications are due for businesses with revenue between $50 million and $100 million.
• April 1, 2030: Cybersecurity audit certifications are due for businesses with revenue under $50 million.

Not every covered business has to complete audits or risk assessments. These requirements depend on the kind of processing a business does and how much risk it creates for consumers.

SB 923: Broader Deletion Rights

Starting January 1, 2027, the right to delete will cover personal information a business holds about a consumer, no matter where it came from. Under the current law, a business doesn’t have to delete information it got from a third party rather than from the consumer directly. SB 923 closes that loophole and lets businesses keep a suppression list so deleted data stays deleted as new third-party data comes in.

SB 923 also requires online-only businesses to offer an online way to submit privacy requests, like a webform, instead of only an email address.

AB 566: Browser Opt-Out Signals

The California Opt Me Out Act requires browsers to include a built-in setting that sends an opt-out preference signal, starting January 1, 2027. Businesses already have to honor signals like Global Privacy Control, but once the setting ships in every browser, far more visitors are likely to send one. Here’s how AB 566 changes privacy compliance for websites.

What Didn’t Change

Governor Newsom vetoed AB 1542, which would have banned selling or sharing sensitive personal information outright. That leaves the CCPA’s current approach to sensitive data in place: consumers can limit how businesses use it, but there’s no outright ban.

CCPA Compliance Strategies

Knowing what CCPA requires is the first step. So how do you become CCPA-compliant?

Here are four key steps to become CCPA compliant:

1. Map the personal information you collect, sell, and share.
2. Tell consumers what you collect and why, at or before collection.
3. Honor consumer rights requests and opt-outs.
4. Keep the contracts and records that prove your practices hold up.

Each of these steps breaks down into concrete actions. Some apply to every covered business right away, like posting a privacy policy and setting up a request process. Others depend on what your business does, like risk assessments for higher-risk processing.

Treat these as the full set of capabilities a mature CCPA program needs:

• Build a data inventory. Document what personal information you collect, where it comes from, why you use it, and who receives it. You can’t write an accurate notice, answer a request to know, or tell whether you’re selling or sharing data without one.
• Collect only what you need. CCPA requires collection and use to be reasonably necessary for the purpose you disclosed. The GM settlement centered on data kept and sold for a purpose consumers didn’t expect.
• Publish a notice at collection and a privacy policy. The notice lists the categories of personal information you collect and how you use them. The privacy policy explains consumers’ rights and how to exercise them.
• Give consumers easy ways to opt out and limit. If you sell or share personal information, you need a “Do Not Sell or Share My Personal Information” link. If you use sensitive personal information beyond what the law allows, you need a way for consumers to limit that use. Opt-outs can’t require identity verification, which is where Honda and Ford ran into trouble.
• Set up a consumer request process. Offer at least two ways to submit requests to know, delete, and correct, verify the requester’s identity, and respond within 45 calendar days. Most companies use a request portal so nothing gets lost in a general inbox.
• Put the right contracts in place. Service providers, contractors, and third parties that receive personal information need contracts with CCPA-required terms. Missing contracts with ad-tech vendors came up in the Honda and Tractor Supply cases.
• Run risk assessments, cybersecurity audits, and ADMT reviews if they apply. The 2026 regulations require these for certain businesses, on the timeline covered above.
• Train your team and review annually. Privacy touches legal, marketing, engineering, HR, and customer support. A cross-functional privacy group keeps decisions about new vendors and data uses from happening in a silo.

Managing all of this in spreadsheets gets unwieldy fast, which is why many companies use a privacy management platform. OneTrust, TrustArc, Osano, Transcend, and Ketch all handle data mapping, request workflows, and consent records. It’s worth evaluating a few to see which fits your team’s size and complexity.

None of these tools prove that your website behaves the way your privacy program says it does. That’s where the website steps below come in.

CCPA Compliance for Websites

The steps above build the program, and your website is where most of it gets tested. It’s where visitors read your notices, click your opt-out link, and send GPC signals. It’s also where tags from marketing, analytics, and ad vendors can start collecting data before anyone on the privacy team knows they’re there.

Regulators can test all of this without ever contacting you. Most of the enforcement actions above came down to something visible on a website or app: an opt-out link that didn’t fully work, a GPC signal that was ignored, or a cookie banner that made opting out harder than opting in.

How Do You Check a Website for CCPA Compliance?

Five questions can tell you quickly whether your site has a CCPA problem:

1. Can you list every third party that receives data from your site, and say which ones count as selling or sharing under CCPA?
2. Does your “Do Not Sell or Share” link work without making visitors log in or verify their identity?
3. When a visitor opts out or sends a GPC signal, do the tags that sell or share data actually stop firing?
4. Is opting out as easy as opting in on your cookie banner?
5. If marketing added a new pixel last week, how would you find out?

What Are the Practical Steps for Website CCPA Compliance?

Here’s what to fix, and the part of CCPA each step answers to.

1. Inventory every tag, cookie, and vendor request. Your notice at collection has to list the categories of personal information you collect, and you can’t write it, or know whether you’re selling or sharing data, without a full list of what runs on your site. On a large site, that list changes too often to keep current by hand, which is where an automated scanner like ObservePoint comes in.
2. Identify which tags sell or share personal information. CCPA’s definition of a sale covers any exchange for “valuable consideration,” and “sharing” covers cross-context behavioral advertising. That can include advertising pixels, retargeting tags, and some analytics integrations.
3. Post a working “Do Not Sell or Share” link. It needs to be easy to find, and it can’t require an account or identity verification to submit.
4. Honor Global Privacy Control signals. Treat a GPC signal as a valid opt-out request, the same as a click on your opt-out link. Disney, Tractor Supply, and Ford were all cited for GPC problems.
5. Confirm opt-outs actually stop the tags. A banner that records the choice isn’t enough. Test your site under the default state, after an opt-out, and with GPC turned on, and confirm the tags that sell or share data stop firing.
6. Apply opt-outs everywhere they should apply. If a consumer is logged in, their opt-out needs to follow them across your sites, apps, and devices, which was the core of the Disney settlement.
7. Make opting out as easy as opting in. If “Accept All” takes one click, rejecting should take one click too. Honda was fined partly because opting out of advertising cookies took two steps.
8. Link your notice at collection and privacy policy where data is collected. That includes your homepage and any page with a form, checkout, or account signup.
9. Build an online request process. Starting in 2027, online-only businesses must offer an online way to submit requests, like a webform. Respond within 45 calendar days.
10. Put contracts in place with every ad-tech and analytics vendor. Vendors that receive personal information through your site need CCPA-compliant contracts.
11. Re-audit on a schedule. A site that passed in January can fail in March after a campaign launch or a vendor script update. The Ford and Tractor Supply orders both require ongoing reviews of website tracking technologies.

ObservePoint handles the testing-heavy steps (1, 2, 4, 5, and 11) and helps with step 6 by checking consent behavior across your sites. Steps 3 and 7 take a quick visual review of your banner and links, and steps 8, 9, and 10 belong to your legal, development, and privacy teams. ObservePoint’s job there is confirming that what those teams set up actually works on the live site.

A Website CCPA Compliance Checklist

Use this CCPA compliance checklist to track your website’s progress:

• Inventory every third-party tag, cookie, and vendor on the site
• Identify which tags sell or share personal information
• Link a notice at collection and privacy policy on every page that collects personal information
• Post a “Do Not Sell or Share My Personal Information” link that works without a login or identity verification
• Offer a way to limit the use of sensitive personal information, if it applies
• Confirm opting out takes no more steps than opting in
• Confirm tags that sell or share data stop firing after an opt-out
• Confirm Global Privacy Control signals are honored the same way as your opt-out link
• Confirm opt-outs apply across logged-in sites, apps, and devices
• Offer at least two ways to submit requests, including an online option
• Respond to requests to know, delete, and correct within 45 calendar days
• Sign CCPA-compliant contracts with every vendor that receives personal information
• Complete risk assessments and cybersecurity audits if they apply
• Re-audit the site on a regular schedule

How ObservePoint Helps With CCPA Compliance

ObservePoint is a web governance platform built to answer the technical half of CCPA compliance: does your website actually behave the way your privacy program says it does?

Regulators are asking the same question. The Ford and Tractor Supply orders both require ongoing reviews of the tracking technologies on their websites, and most CCPA cases so far have involved an opt-out that didn’t work the way the company thought it did.

Specifically, ObservePoint can:

• Build a tag and cookie inventory of every third party collecting data on your site, so you know which tags may count as selling or sharing
• Audit your site as a California visitor under Default, Accept-All, opt-out, and GPC consent states, and show exactly which tags fire in each, to verify your consent management platform works
• Flag tags that sell or share data and keep firing after a visitor opts out or sends a GPC signal
• Produce tag, cookie, and vendor-level reports with a dated history, ready to share with regulators, auditors, or counsel
• Run audits on a recurring schedule and alert you when new or unapproved tags appear, so a new pixel or a site redesign gets caught before it becomes a violation

Check out our recent webinar, What Every Website Needs to Know About US Privacy Compliance and Tracking Risk, for more on how US privacy laws apply to website tracking.

Learn more about how ObservePoint helps companies verify their CCPA compliance across every page, tag, and cookie on their site.