CCPA (2018) · amended by the CPRA · enforced by the CPPA
California gave its residents the strongest consumer-privacy rights in the United States. Here's the whole shape in one read — who has to comply, what you can demand, the difference between "sell" and "share," and what changed for 2026.
The one idea to hold onto
Behind the scenes, businesses collect, sell, and "share" data about you for advertising. The CCPA's core move is simple: it hands you a set of controls over that trade — and one big switch to stop it.
You can see what's collected, correct or delete it, and tell a business "do not sell or share" — and it can't punish you for asking. See · fix · stop: that's the whole consumer side.
"You don't have to accept being the product. You get an off-switch — and the right to use it without penalty."
See
Know & access your data
Fix
Correct or delete it
Stop
Opt out of the sale
Civil Code § 1798.140 · try it
It only covers for-profit businesses that do business in California and meet at least one of three thresholds. Adjust the dials to see when a business is caught.
Non-profits and government agencies generally aren't covered at all.
What you can demand
The distinction that trips everyone up
The CPRA added "share" precisely because companies argued they weren't "selling" data when no money changed hands. Now both are covered by one opt-out.
Disclosing personal information to another business or third party for monetary or other valuable consideration. The classic "we sold your data to a broker."
Disclosing personal information for cross-context behavioral advertising — targeting you across sites and apps — even when no money changes hands. This is the CPRA addition.
A single "Do Not Sell or Share My Personal Information" link must let you switch off both. Once you opt out, the business can't resume unless you later say yes — and the opt-out has to be at least as easy as opting in.
A category of its own
Some data is treated as higher-stakes. For these, you have an extra right: tell a business to limit its use to only what's needed to provide what you asked for — no profiling, no extras.
What it costs to get wrong
The CPPA and the Attorney General enforce the law. Fines are charged per violation, so a single bad practice across many consumers multiplies fast. Amounts shown are inflation-adjusted (2025).
What changed for 2026
In 2026 California finalized regulations on automated decision-making, risk assessments, and cybersecurity audits — phased in by company size over the following years.
Rules on automated decision-making technology (ADMT), privacy risk assessments, and cybersecurity audits become operative. Request and consent flows must be symmetrical — the privacy-protective choice can't be made harder.
Businesses must start conducting risk assessments for higher-risk processing activities.
Compliance obligations for automated decision-making technology already in use take effect.
First audits due Apr 1, 2028 for businesses over $100M revenue; Apr 1, 2029 for $50M–$100M; Apr 1, 2030 for under $50M.
Test yourself