The California Consumer Privacy Act (CCPA), enacted in 2018 and effective January 1, 2020, gives California residents specific rights over their personal information — to know, delete, opt out of sale, and non-discriminatory treatment. It was amended by the California Privacy Rights Act (CPRA) in 2020, which expanded rights, added a correction right, created the California Privacy Protection Agency (CPPA), and established ongoing rulemaking authority. Together they are often called CCPA/CPRA.

Who does CCPA apply to?

CCPA applies to for-profit businesses that do business in California and meet at least one of three thresholds: (1) annual gross revenues over USD 25 million, (2) annually buy, sell, or share personal information of 100,000 or more consumers or households, or (3) derive 50% or more of annual revenue from selling personal information. Non-profit organizations and government agencies are exempt, as are businesses that do not meet any threshold.

What are consumer rights under CCPA/CPRA?

Consumers have the right to know (request disclosure of what personal information is collected and how it is used), the right to delete (request deletion subject to exceptions), the right to opt out of sale or sharing, the right to correct inaccurate personal information (added by CPRA), the right to limit use of sensitive personal information, and the right to non-discrimination for exercising these rights. Businesses must respond to most requests within 45 days.

What are the penalties for CCPA violations?

The CPPA can impose administrative fines up to USD 2,500 per unintentional violation and USD 7,500 per intentional violation under California Civil Code § 1798.155. For violations involving children's personal information, every violation is treated as intentional. Additionally, Civil Code § 1798.150 creates a private right of action allowing consumers to sue for USD 100 to USD 750 per consumer per incident (or actual damages, whichever is greater) for data breaches involving unencrypted personal information.

What is sensitive personal information under CPRA?

CPRA added a special category: 'sensitive personal information' (SPI) defined in Civil Code § 1798.140(ae). SPI includes: Social Security Number, driver's license, passport, financial account credentials, precise geolocation (within 1,850 feet), racial/ethnic origin, religious beliefs, union membership, contents of mail/email/text messages, genetic data, biometric data for unique identification, health data, and sex life or sexual orientation. Consumers can direct businesses to limit the use and disclosure of SPI to what is necessary for the service.

CCPA Compliance: Data Security Requirements Explained

Q: What is 'reasonable security' under CCPA?

CCPA's Civil Code § 1798.150 creates a private right of action when 'nonencrypted and nonredacted' personal information is breached due to a business's failure to implement and maintain 'reasonable security procedures and practices.' California courts and the CPPA have used the CIS Critical Security Controls as a benchmark for reasonableness. Encryption of personal information effectively eliminates private CCPA breach liability because the statutory language requires unencrypted data to be involved.

Introduction

In its first two years of active enforcement, California’s Privacy Protection Agency opened formal investigations resulting in settlements including the largest CCPA fine to date — a USD 1.2 million penalty against a global company for failing to honor consumer opt-out requests at the point of data collection. The enforcement pace has accelerated, and the CPPA has made clear that technical non-compliance is not a defense: if your data flows contradict your privacy disclosures, you are in violation regardless of your internal intentions.

CCPA compliance sits at the intersection of privacy law and data security engineering. The law’s private right of action under Civil Code § 1798.150 specifically targets unencrypted and unredacted personal information exposed in a breach. An organization that encrypts its personal information eliminates its exposure to that statutory private right of action — because the law explicitly requires the breach involve “nonencrypted and nonredacted personal information.” That is a direct legislative incentive to implement encryption.

The California Privacy Rights Act (CPRA), which took effect January 1, 2023, significantly expanded CCPA’s scope: it created the California Privacy Protection Agency (CPPA) as an independent enforcement body, added new consumer rights, introduced the “sensitive personal information” category with opt-in restrictions, and mandated annual cybersecurity audits for high-risk businesses. For encryption requirements under similar privacy frameworks, see our guide on GDPR encryption requirements. This article covers both laws together as the operating CCPA/CPRA framework.

CCPA Compliance: What Is CCPA/CPRA?

The California Consumer Privacy Act (California Civil Code §§ 1798.100–1798.199.100) and its amendment, the California Privacy Rights Act (CPRA) (Proposition 24, 2020), form California’s comprehensive privacy framework. The CPPA’s enforcement regulations are codified at 11 CCR § 7000 et seq.

Who must comply: For-profit businesses doing business in California that meet at least one of:

Annual gross revenues over USD 25 million (§ 1798.140(d)(1))
Processing personal information of 100,000+ consumers or households annually (§ 1798.140(d)(2))
Deriving 50%+ of annual revenue from selling or sharing personal information (§ 1798.140(d)(3))

Service providers: Entities that process personal information on behalf of a business under a contract restricting use to the contracted service are “service providers” under § 1798.140(ag). Service providers are partially exempt from CCPA’s consumer-facing requirements but must implement the required security safeguards and cannot sell or use the data for their own purposes.

Enforcement: The CPPA can initiate investigations and impose fines without requiring consumer complaints. The CPPA has a dedicated enforcement division and has stated that both technical and operational compliance will be examined.

How CCPA Works

Consumer Rights and Response Requirements

Right to Know (§ 1798.100): Consumers may request what personal information is collected, the purposes for which it is used, and whether it is sold or disclosed. Businesses must disclose this in their privacy policy and respond to individual requests within 45 days.

Right to Delete (§ 1798.105): Consumers may request deletion of their personal information, subject to specific exceptions (completing a transaction, legal obligation, security research, internal use proportionate to the consumer’s relationship). The business must also direct service providers to delete the information.

Right to Opt Out of Sale/Sharing (§ 1798.120): Consumers may opt out of the sale or sharing of their personal information. Businesses must provide a “Do Not Sell or Share My Personal Information” link on their homepage. The CPPA’s regulations (11 CCR § 7026) specify technical requirements for recognizing opt-out signals including the Global Privacy Control (GPC).

Right to Correct (§ 1798.106, added by CPRA): Consumers may request correction of inaccurate personal information, balancing the correction against the nature of the inaccuracy and the purposes of processing.

Right to Limit Use of Sensitive Personal Information (§ 1798.121, added by CPRA): Consumers may direct businesses to limit use of sensitive personal information to what is necessary for providing the service. Businesses that use SPI for additional purposes must provide a “Limit the Use of My Sensitive Personal Information” link.

Right to Non-Discrimination (§ 1798.125): Businesses cannot discriminate against consumers who exercise their CCPA/CPRA rights — no denying goods or services, charging different prices, or providing a different level of service.

Reasonable Security — The Encryption Connection

Civil Code § 1798.150 creates a private right of action available to any California resident whose nonencrypted and nonredacted personal information is subject to unauthorized access, exfiltration, theft, or disclosure as a result of the business’s failure to implement and maintain reasonable security procedures.

The implication is precise: encrypting personal information removes it from the scope of the § 1798.150 private right of action for breach liability. This is not a loophole — it is how the legislature intended to incentivize encryption. An encrypted database that is breached does not expose the business to class action liability under this provision, provided the encryption meets a reasonable standard.

What is reasonable security? California courts and the CPPA have used the CIS Critical Security Controls v8 as a benchmark for what constitutes reasonable security for CCPA purposes. The Shields Health Care breach settlement and subsequent CPPA guidance have identified access controls, encryption, multi-factor authentication, and regular security assessments as baseline requirements.

This video explains the CCPA framework and consumer rights obligations. After watching, use the compliance checklist below to map the technical and operational requirements to controls your organization must implement.

CCPA/CPRA Compliance Checklist

Use this checklist to structure your compliance program. Citations reference California Civil Code (CIV) sections and 11 CCR (CPPA Regulations) sections.

Privacy Disclosures and Notices

Privacy policy updated to reflect CPRA requirements — lists all categories of personal information collected and purposes (CIV § 1798.130(a)(5))
“Do Not Sell or Share My Personal Information” link on homepage for all applicable businesses (CIV § 1798.120)
“Limit the Use of My Sensitive Personal Information” link if SPI is used beyond necessary service purposes (CIV § 1798.121)
Privacy notice at collection: consumers informed at or before collection what categories are collected and for what purposes (CIV § 1798.100(b))
Global Privacy Control (GPC) recognition: technical implementation to detect and honor browser-level GPC opt-out signals (11 CCR § 7026)

Consumer Request Handling

Intake mechanism: at least 2 methods for submitting requests (toll-free number + web form minimum) (CIV § 1798.130(a)(1))
Identity verification process documented — balances verification rigor with undue burden on the consumer
45-day response timeline tracked — extension to 90 days requires notice to consumer (CIV § 1798.130(a)(2))
Deletion workflow: request triggers deletion from primary systems AND service providers (CIV § 1798.105(c))
Opt-out workflow: stops sale and sharing of personal information within 15 business days; notifies service providers (11 CCR § 7025(e))
Correction workflow: reviews request, corrects or provides explanation for denial (CIV § 1798.106)
Request log: tracks all consumer requests with date received, type, response date, and outcome

Data Inventory and Mapping

Complete data inventory: every category of personal information collected, source, purpose, retention period, and recipients
Sensitive personal information identified and tagged separately (CIV § 1798.140(ae))
Data flow map: shows where personal information moves between internal systems and third parties
Third-party contracts: all data sales and shares documented with CCPA-compliant contracts (CIV § 1798.140(ag))
Service provider contracts: include data processing restrictions and deletion requirements

Security Safeguards — Reasonable Security Standard

Personal information encrypted at rest: all databases, file shares, and backups containing personal information use AES-128 minimum (AES-256 recommended)
Personal information encrypted in transit: TLS 1.2 minimum for all endpoints handling personal information
Access controls: least-privilege access to personal information databases; privileged access reviewed quarterly
MFA: enforced for all employee access to systems containing California personal information
Vulnerability management: regular vulnerability scanning and patch management — documented schedule
Penetration testing: annual penetration test of systems handling personal information
Security awareness training: documented training for employees with access to personal information

Annual Cybersecurity Audit (required for high-risk businesses per 11 CCR § 7012)

Determine if business qualifies (significant risk to consumer privacy or security based on processing volume or nature)
If required: engage independent auditor to assess network security, access controls, encryption, and incident response annually
Audit report retained and available for CPPA examination

Data Protection Risk Assessments (required per 11 CCR § 7101 for high-risk processing)

Determine if any processing activities require a DPIA (selling/sharing SPI, significant profiling, processing at scale)
If required: conduct risk assessment documenting purposes, benefits, risks, and mitigations before starting the processing activity
Risk assessment updated when the nature of the processing materially changes

Breach Response

Incident response plan covering CCPA breach scenarios — specifically: unauthorized access to unencrypted personal information
Breach notification procedure: California Civil Code § 1798.82 requires notification to affected consumers without unreasonable delay (in most cases, within 30 days)
Attorney General breach notification for incidents affecting more than 500 California residents (CIV § 1798.82(f))
Encrypted data breach: confirm encryption status before invoking § 1798.150 private right of action safe harbor

Dimension	CCPA/CPRA (California)	GDPR (European Union)
Scope trigger	Revenue or data volume thresholds	Any processing of EU resident personal data
Consumer/subject rights	Know, delete, opt out, correct, limit SPI	Access, erasure, portability, rectification, object
Lawful basis	No general lawful basis requirement (opt-out model)	Requires one of 6 lawful bases for each processing activity
Sensitive data	Opt-in for SPI uses beyond service (CPRA)	Explicit consent or specific bases required (Article 9)
Security standard	”Reasonable security” (CIS Controls benchmark)	“Appropriate technical measures” (state of the art)
Private right of action	Yes — for unencrypted breach (§ 1798.150)	No general private right of action
Regulatory penalties	USD 7,500 per intentional violation	€20M or 4% of global annual turnover
Enforcement agency	CPPA (independent agency)	54 national DPAs in EU Member States
Children’s age threshold	Under 16 (opt-in for sale/sharing)	Under 16 (Member State discretion to 13)

The most significant practical difference is the opt-out versus opt-in model. GDPR requires a lawful basis before processing begins — you must affirmatively establish legal authority. CCPA/CPRA allows processing as a default and gives consumers the right to opt out. This means GDPR compliance is harder to implement for new data collection activities, while CCPA compliance is harder to operationalize for respecting ongoing opt-out signals.

Real-World Use Cases

SaaS companies selling data to advertisers: A SaaS platform that monetizes user data by selling it to data brokers or sharing behavioral data with advertisers must display both the “Do Not Sell or Share” link and implement GPC recognition. Under CPRA’s expanded definition of “sharing,” passing data to ad-tech partners for cross-context behavioral advertising is sharing even if no money changes hands.

Healthcare apps not covered by HIPAA: A consumer wellness app — meditation, fitness tracking, nutrition — that is not a HIPAA-covered entity still processes sensitive personal information (health data) under CPRA. Users can direct the app to limit use of their health data to what is necessary for the service. If the app sells that data to insurance companies, it is selling sensitive personal information — which requires opt-in consent, not merely an opt-out opportunity.

E-commerce breach scenario: A California e-commerce company suffers a database breach exposing customer names, email addresses, and purchase history. If the database was unencrypted, the company faces both: (a) CPPA administrative fines if they failed to implement reasonable security, and (b) class action liability under § 1798.150, with each affected consumer entitled to USD 100–USD 750 in statutory damages. With AES-256 encrypted databases and a key not compromised in the breach, the § 1798.150 private right of action does not apply to the exposure itself.

Common Mistakes to Avoid

Ignoring GPC signals. The CPPA’s regulations (11 CCR § 7026) require businesses to recognize and honor the Global Privacy Control browser signal as a valid opt-out of sale and sharing of personal information. Many businesses have implemented a “Do Not Sell” button but have not updated their tag management or consent infrastructure to detect GPC. The CPPA has explicitly stated this is an enforcement priority.

Not mapping third-party data sharing. Many businesses share personal information with analytics platforms, advertising partners, and data enrichment vendors without realizing these transfers constitute “sharing” under CPRA. If an analytics vendor uses the shared data for cross-context behavioral advertising, you are sharing personal information — subject to the opt-out right and the annual audit requirement if your processing is at sufficient scale.

Assuming service provider agreements are automatic. Simply calling a vendor a “service provider” in a contract does not make them one under CCPA. The contract must include specific CCPA language: the vendor is prohibited from selling or sharing the personal information, retaining, using, or disclosing the information outside the contracted service, and combining the information with data from other sources. Auditors review the actual contract language.

Getting Started

Start by determining whether CCPA/CPRA applies to your organization. If you are a for-profit business doing business in California and meet one of the three thresholds, you are subject to the law. “Doing business in California” does not require a physical presence — operating a website accessible to California residents that collects their personal information can qualify.

Conduct a data inventory. Map every category of personal information collected, its source, its purpose, its retention period, and every third party it is shared with or sold to. This inventory is the foundation of your privacy policy, your consumer request response capability, and your risk assessment.

Review your contracts with data processors and third-party service providers. Ensure all have CCPA-compliant language. Terminate any third-party relationships that involve selling personal information without consent if you lack the consumer opt-out infrastructure to manage it.

Implement encryption for personal information at rest and in transit. This is the single most impactful control for reducing CCPA breach liability under § 1798.150.

For the encryption standards that satisfy CCPA’s reasonable security requirement, see what is data security: definition, types, and risks. For the intersection of CCPA and GDPR for global businesses, read GDPR encryption requirements: Article 32 explained.