California, USA
CCPA
The California Consumer Privacy Act, as amended by the CPRA, gives California residents rights over the personal information businesses collect about them, including the right to know, delete, correct, and opt out of sale or sharing.
14 sections
Risk assessments for processing that presents significant risk
Businesses whose processing of personal information presents a significant risk to consumers' privacy must conduct and document a risk assessment before initiating that processing, review it at least every three years, and submit attestations and summaries to the CPPA.
Annual independent cybersecurity audits
Businesses that meet specified revenue and data-volume thresholds must complete an annual independent cybersecurity audit and certify completion to the CPPA, with first certification dates staggered by revenue from 1 April 2028.
ADMT notice, opt-out and access rights
Businesses that use automated decisionmaking technology to make significant decisions must give consumers a pre-use notice, provide a right to opt out, and honour requests to access information about that use, from 1 January 2027.
Right to know about collection of personal information
Consumers have the right to know what personal information a business collects and how it is used and shared.
Right to delete personal information
Consumers have the right to request deletion of personal information collected by a business.
Right to know what personal information is being collected; right to access personal information
Consumers have the right to request that a business disclose the categories of personal information collected, sources, purposes, categories of third parties it is disclosed to, and the specific pieces of personal information collected about them.
Right to know what personal information is sold or shared
Consumers have the right to know what personal information is sold or shared and to whom.
Right to opt-out of sale or sharing of personal information
Consumers have the right to direct a business to not sell or share their personal information.
Right to limit use and disclosure of sensitive personal information
Consumers have the right to direct a business to limit its use of the consumer's sensitive personal information to that necessary to perform the services or provide the goods reasonably expected by an average consumer.
Consumers' right of no retaliation following opt-out or exercise of other rights
A business shall not discriminate against a consumer for exercising CCPA rights (e.g. denying goods/services, charging different prices, or providing a different quality of goods/services), though a business may offer financial incentives or different pricing reasonably related to the value of the consumer's data, subject to notice and opt-in consent requirements.
Notice, disclosure, correction, and deletion
Businesses must disclose their data practices in a privacy policy and respond to consumer requests within 45 days.
Notice, disclosure, correction, and deletion - additional requirements
Businesses must provide a clear and conspicuous link titled Do Not Sell or Share My Personal Information on their homepage.
Definitions
Key definitions including personal information, sensitive personal information, sale, sharing, and business purpose.
Private right of action for data breaches
Consumers have a private right of action for data breaches with statutory damages of $100-$750 per consumer per incident.
Turn CCPA into tracked tasks
eurocompliant maps these obligations to checklists and evidence, so you can prove compliance instead of re-reading the text.
Start free trial