California Consumer Privacy Act (as amended)
United States · Law · California Department of Justice
High impact. A reviewer confirms each change before it is listed here.
Our summary
This consumer privacy law grants California residents rights over their personal information held by businesses, including the ability to request disclosure, deletion, and correction of data, to opt out of sales and sharing, and to limit use of sensitive information. Amendments that took effect January 1, 2023 added rights to correct inaccurate information and to limit use of sensitive data. Businesses meeting specified thresholds must comply with these requirements and provide notices about their data practices.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
14 sections
Subscribe to Our Newsletter
1 section
Google™ Translate Disclaimer
Links to Topics
Frequently Asked Questions (FAQs)
10 sections
This section provides consumer information about CCPA rights and how to exercise them, but is not legal advice or regulatory guidance.
A. general information about the ccpa
California residents may request businesses disclose, delete, or correct their personal information, opt out of sales or sharing, and limit use of sensitive data; residents must be notified before or at collection, and only natural persons residing in California qualify. Personal information covers data identifying or reasonably linked to a consumer or household, including name, social security number, email, purchase records, browsing history, and inferred profiles; sensitive personal information includes government identifiers, financial credentials, precise geolocation, message contents, genetic data, biometric identifiers, health and sexual orientation information, and racial, ethnic, religious or union membership data. The CCPA applies to for-profit businesses in California with over 25 million dollars annual revenue, data on 100,000 or more residents, or 50 percent or more revenue from selling resident information.
B. right to opt-out of sale or sharing
Consumers may request businesses cease selling or sharing personal information for cross-context behavioral advertising; businesses cannot resume without consumer authorization and must wait at least 12 months before requesting re-authorization. Businesses may only sell personal information of children under 16 with affirmative authorization from the child (if aged 13-16) or parent/guardian (if under 13), must provide a clear and conspicuous opt-out link on their website without requiring account creation, and must respond within 15 business days using verification only to identify which personal information belongs to the consumer. Businesses may refuse requests if selling or sharing is necessary for legal compliance, if information is publicly available or exempt under the CCPA, or if the recipient is a service provider; businesses collecting personal information online must offer at least two opt-out methods and must honor user-enabled global privacy controls like the GPC as valid requests.
C. requests to know
Consumers may request disclosure of collected, used, shared, or sold personal information including categories and specific pieces, sources, purposes, and third-party recipients for the preceding 12 months at no cost; businesses must designate at least two submission methods including a toll-free number and website method (or email only if exclusively online), without requiring account creation, and must respond within 45 calendar days, extendable by another 45 days with notice, with verification solely to confirm identity. Businesses may refuse frivolous or excessive requests, requests made more than twice in 12 months, requests where verification is impossible, or requests that would interfere with legal obligations or claims; they must disclose categories of sensitive data but may withhold actual values, and may deny requests sent to service providers rather than the business itself.
D. requests to delete
Consumers may request deletion of their personal information and direct service providers to do likewise, with businesses required to designate at least two submission methods (toll-free number, email, website form, or hard copy, or email only if exclusively online) without account creation and respond within 45 calendar days, extendable by another 45 days with notice; verification may be requested solely to confirm the requester's identity. Businesses may retain personal information when exempt from the CCPA, including publicly available information (though law enforcement officers, public officials, Safe at Home participants, and reproductive health workers may request websites not to post their addresses), certain medical or consumer credit reporting information, when they cannot verify the request, when needed to complete a transaction or provide anticipated services, for security or compatible internal uses, to comply with legal obligations, or to exercise or defend legal claims; service providers must direct deletion requests to the business they serve rather than acting directly, and debt collectors may continue collection after deletion requests. Credit reporting agencies remain subject to the Fair Credit Reporting Act and may continue collecting and disclosing credit information despite consumer deletion requests under the CCPA.
E. requests to correct
Consumers may request that businesses correct inaccurate personal information. Businesses must provide at least two designated methods to submit correction requests (or only an email address if operating exclusively online), may not require account creation, and must respond within 45 calendar days with a possible 45-day extension if notified. Businesses may verify consumer identity for correction requests and may deny corrections when they cannot verify identity, the request is manifestly unfounded or excessive, or the information is publicly available or exempt from the CCPA.
F. requests to limit use of personal information (right to limit)
Consumers may direct businesses to limit use of sensitive personal information, such as social security numbers, financial account information, precise geolocation data, or genetic data, to specific limited purposes like providing requested services.
G. right to non-discrimination
Businesses cannot deny goods or services, charge different prices, or provide different quality based solely on consumers exercising CCPA rights, though they may refuse to complete transactions when personal information or its sale is necessary to provide the requested goods or services. Businesses may offer financial incentives for collecting or retaining personal information if reasonably related to its value, and consumers who request deletion or cessation of sale may lose access to such offers.
H. required notices
I Data brokers and the ccpa
Data brokers, defined as businesses collecting and selling personal information of consumers without a direct relationship, are exempt from the definition if they are regulated credit bureaus or certain financial or insurance entities. Data brokers must register with the California Privacy Protection Agency and maintain a registry indicating their practices.
Other Consumer Resources on CCPA
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 0 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 0 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 0 of 4
- Data governance and quality, not covered
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 0 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
- Record keeping and logging, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 0 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Accountability and governance roles, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 0 are shown.
Change history
No changes recorded since we began monitoring this policy.