Processes personal data, in California

Cal. Civ. Code sections 1798.85 to 1798.89 · Read the law's page

• Do not publicly post or publicly display an individual's social security number in any manner (section 1798.85(a)(1)).
• Do not print an individual's social security number on any card required to access products or services you provide (section 1798.85(a)(2)).
• Do not require an individual to transmit their social security number over the internet unless the connection is secure or the number is encrypted (section 1798.85(a)(3)).
• Do not require an individual to use their social security number to access an internet website unless a password, unique personal identification number or other authentication device is also required (section 1798.85(a)(4)).
• Do not print an individual's social security number on materials mailed to the individual unless state or federal law requires it. Applications and forms sent by mail may include it, but not on a postcard or other mailer without an envelope, and not visible on the envelope (section 1798.85(a)(5)).
• Do not sell, advertise for sale or offer to sell an individual's social security number. Release incidental to a larger transaction that is necessary to identify the individual for a legitimate business purpose, or that law specifically authorizes, is not a sale, and release for marketing is not permitted (section 1798.85(a)(6)).
• Do not encode or embed a social security number in a card or document, such as in a barcode, chip or magnetic strip, in place of removing it (section 1798.85(g)).
• Do not present for recording or filing with a county recorder a document required to be open to the public that displays more than the last four digits of a social security number (section 1798.89(a)).

Cal. Bus. and Prof. Code sections 22575 to 22579 · Read the law's page

• Conspicuously post a privacy policy if your commercial website or online service collects personally identifiable information (a name, address, email address, phone number, Social Security number or other identifier that permits contacting a person) online from California residents who use it: put the policy on the homepage or first significant page, or link to it there so a reasonable person would notice (for example a text link containing the word "privacy"). For an online service, which the Attorney General reads to include a mobile app, any other reasonably accessible means works.
• List in the policy the categories of personally identifiable information you collect and the categories of third parties you may share it with.
• Describe in the policy any process you maintain for a user to review and request changes to their information, how you notify users of material changes to the policy, and the policy's effective date.
• Disclose in the policy whether other parties may collect information about a user's online activities over time and across different sites when someone uses your service. If you collect that information yourself, also disclose how you respond to browser Do Not Track signals or similar choice mechanisms, or link to a description of the choice program you follow.
• Follow your own posted privacy policy: a knowing and willful, or negligent and material, failure to comply with it is a violation.
• Post a missing privacy policy within 30 days of being notified that it is missing.

Cal. Civ. Code sections 1798.83 and 1798.84 · Read the law's page

• If you are a business with 20 or more full-time or part-time employees, have an established business relationship with a California customer who deals with you primarily for personal, family, or household purposes, and in the preceding calendar year disclosed that customer's personal information to third parties you know or reasonably should know used it for their own direct marketing, answer the customer's request for the disclosures below, free of charge.
• Tell the customer, in writing or by email, which of the listed categories of personal information you disclosed to third parties for their direct marketing during the preceding calendar year. The categories include name and address, email address, age or date of birth, telephone number, occupation, the kind of product or service the customer bought, Social Security number, payment card numbers, payment history and creditworthiness.
• Tell the customer, in writing or by email, the names and addresses of all the third parties that received the information for their direct marketing during the preceding calendar year and, if the nature of a third party's business cannot reasonably be determined from its name, examples of the products or services marketed, if you know them.
• Designate a mailing address, an email address or, if you choose to take requests by telephone or fax, a toll-free number for these requests, and do at least one of three things: tell the managers and supervisors of employees who regularly deal with customers to give the designated contact to anyone who asks about your privacy practices; put a link titled "Your Privacy Rights" on your home page, or add those words to your privacy policy link; or make the designated contact available on request at every place of business in California where you regularly deal with customers.
• Answer a request received at a designated address or number within 30 days, and a request received anywhere else within a reasonable period that does not exceed 150 days from receipt.
• You need not answer the same customer more than once in a calendar year, and you may give the information in a standardized format without associating it with specific individuals.
• As an alternative to answering, if your privacy policy publicly states that you disclose customer information for third parties' direct marketing only after the customer first affirmatively agrees, or not if the customer has opted out, you may tell the customer of the right to prevent disclosure and give a cost-free way to use it, so long as you maintain and disclose that policy.
• A disclosure under a contract for processing, storage or services on your behalf, for your own marketing that discloses nothing to third parties, for servicing accounts, to or from a consumer reporting agency, or to a financial institution to obtain payment is not a disclosure for direct marketing purposes, and a financial institution subject to the California Financial Information Privacy Act is outside this section if it complies with the Financial Code sections the subdivision names.

Cal. Civ. Code section 1798.100 et seq. (CCPA, as amended by the CPRA) · Read the law's page

• If your app is a for-profit business meeting the CCPA's revenue or data-volume threshold and it determines the purposes and means of processing a California consumer's personal information, honor the CCPA/CPRA's notice, opt-out, and non-discrimination duties before collecting, selling, or sharing that data.
• Disclose at or before collection the categories of personal information you collect, your purpose for collecting it, and the retention period or the criteria you use to set it.
• Limit your collection, use, retention, and sharing of a California consumer's personal information to what is reasonably necessary and proportionate to the purpose you disclosed.

Cal. Civ. Code sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, 1798.120, 1798.125, 1798.130 · Read the law's page

• Provide a California consumer a verifiable way to request access to, deletion of, correction of, and a portable copy of their personal information, and respond within the CCPA's statutory timeline.
• Honor a Global Privacy Control signal or another recognized opt-out preference signal as a valid request to opt out of the sale or sharing of personal information.
• Do not deny goods or services, charge a different price, or provide a different quality of service to a California consumer because they exercised a CCPA right.

Cal. Civ. Code sections 1798.99.80 to 1798.99.85 · Read the law's page

• Register with the California Privacy Protection Agency on or before January 31 following each year in which you are a data broker (you knowingly collect and sell to third parties the personal information of consumers you have no direct relationship with), and pay the registration fee the Agency sets.
• You are not a data broker to the extent the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act or the Insurance Information and Privacy Protection Act covers you, or your processing is exempt under Civil Code section 1798.146.
• In the registration, give your name and primary physical, email and website addresses and your request metrics, and say whether you collect minors' personal information; names, dates of birth, ZIP Codes, email addresses or phone numbers; account logins or account numbers with the codes that unlock them; government identification numbers; mobile advertising, connected television or vehicle identification numbers; citizenship or immigration data; union membership; sexual orientation; gender identity or expression; biometric data; precise geolocation; or reproductive health care data. If you collect none of the names, dates of birth, ZIP Codes, email addresses or phone numbers, and none of the mobile advertising, connected television or vehicle identification numbers, name one to three of the most common types of personal information you collect.
• Also state in the registration whether in the past year you shared or sold consumers' data to a foreign actor, the federal government, other state governments, law enforcement (except under a subpoena or court order) or a developer of a generative artificial intelligence system or model; whether and to what extent you or a subsidiary is regulated by the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, the Insurance Information and Privacy Protection Act, the Confidentiality of Medical Information Act or the federal HIPAA privacy, security and breach notification rules; and, beginning January 1, 2029, whether you have undergone the independent audit of your deletion compliance and the most recent year you submitted its report to the Agency.
• Link in the registration to a page on your website, free of dark patterns, that explains how consumers can delete and correct their personal information, learn what you collect and how to access it, learn what you sell or share and to whom, opt out of its sale or sharing, and limit the use and disclosure of their sensitive personal information.
• By July 1 each year, disclose in the privacy policy posted on your website, and through a link included in that policy, how many deletion, access, opt-out and limit requests you received, complied with in whole or in part, and denied in the previous calendar year, and the median and mean number of days you took to respond substantively. For deletion requests made through the Agency's accessible deletion mechanism, give how many you denied because the request was not verifiable, was not made by a consumer, called for exempt information or for other reasons. For every deletion request, give how many each provision of section 1798.145 or 1798.146 excused, in whole or in part.

CCPA, Cal. Civ. Code sections 1798.146(a)(4) and 1798.148 · Read the law's page

• Do not reidentify, or attempt to reidentify, information that is deidentified under 45 CFR 164.514 and derived from patient information originally collected, created, transmitted, or maintained by an entity regulated by HIPAA, the Confidentiality of Medical Information Act or the Common Rule, except for treatment, payment or health care operations conducted by a covered entity or by a business associate at its written direction, public health activities, research under the Common Rule, a contract engaging a person to test or validate deidentification, or where otherwise required by law (Civ. Code section 1798.148(a)).
• If you engage a person to attempt reidentification to test, analyze or validate deidentification, put in the contract a ban on any other use or disclosure of the reidentified information and a requirement to return or destroy it when the work is complete (Civ. Code section 1798.148(a)(4)).
• Treat information you reidentify under an exception as subject to applicable federal and state data privacy and security laws, including HIPAA, the Confidentiality of Medical Information Act and the CCPA (Civ. Code section 1798.148(b)).
• When you sell or license deidentified patient information and a party resides or does business in California, put in the contract a statement that the information includes deidentified patient information, a statement that the purchaser or licensee may not reidentify or attempt to reidentify it, and a requirement that, unless otherwise required by law, the purchaser or licensee not disclose it further to a third party unless that party is contractually bound by the same or stricter restrictions and conditions (Civ. Code section 1798.148(c)).

Cal. Civ. Code section 1798.81.5, as amended by AB 825 (2021, Ch. 527) · Read the law's page

• This binds a business that owns, licenses, or maintains personal information about a California resident, and by contract extends the same duty to a nonaffiliated third party the business discloses that information to; it exempts a health care provider, plan, or contractor already regulated by the Confidentiality of Medical Information Act, a financial institution subject to the California Financial Information Privacy Act, a covered entity governed by the federal HIPAA medical privacy and security rules, and a business already subject to state or federal law providing greater protection on the same subject, deemed compliant with this duty instead.
• Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you own, license, or maintain, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• Covered personal information reaches a name paired with a Social Security, driver's license, state ID, passport, military ID, or tax ID number, a financial account or payment card number with its access code, medical or health insurance information, unique biometric data used to authenticate a person, or genetic data, when either the name or the data element is not encrypted or redacted; it also reaches a username or email address paired with a password or security question that unlocks an online account.
• A customer injured by a violation of this duty may bring a civil action for damages under Civil Code section 1798.84(b); where the violation is a breach of nonencrypted or nonredacted personal information, the CCPA/CPRA's own statutory-damages private right of action, Civil Code section 1798.150, is a separate and further remedy, researched as this jurisdiction's privacy row.

Cal. Civ. Code sections 56.18 to 56.186 · Read the law's page

• If you are a direct-to-consumer genetic testing company, give California consumers a plain-language summary of your privacy practices and a prominent, easily accessible privacy notice covering your data collection, consent, use, access, disclosure, maintenance, transfer, security, retention and deletion practices and how to file a complaint alleging a violation of the chapter, plus a notice that deidentified genetic or phenotypic information may be shared with third parties for research.
• Obtain a consumer's express consent, in response to a clear, meaningful and prominent notice and never by inaction or through a dark pattern, before you collect, use or disclose their genetic data, and obtain separate and express consent for each use of the data collected through the product or service (including who has access to it, how it may be shared and the specific purposes), for storing the biological sample after the initial testing, for each use of the data or sample beyond the primary purpose and inherent contextual uses, for each transfer or disclosure to a third party other than a service provider (naming the third party), and for marketing, or facilitating marketing, based on the data.
• Give a consumer effective mechanisms, without unnecessary steps and at least one through your primary medium of communication, to revoke consent. Honor a revocation as soon as practicable and no later than 30 days after it, and destroy the biological sample within 30 days of receiving a revocation of consent to store it.
• Implement and maintain reasonable security procedures and practices to protect a consumer's genetic data against unauthorized access, destruction, use, modification or disclosure.
• Develop procedures and practices that let a consumer easily access their genetic data, delete their account and genetic data (except data you must retain to comply with legal and regulatory requirements) and have their biological sample destroyed.
• Do not disclose a consumer's genetic data to an entity responsible for administering or making decisions about health insurance, life insurance, long-term care insurance, disability insurance or employment, or to an entity that advises one, unless section 56.181(f)(2) applies: the entity is not primarily engaged in those functions, receives the data in a different capacity, and bars any part of it that administers, advises on or decides those matters from accessing the data or sample.
• Do not discriminate against a consumer for exercising rights under the chapter, whether by denying goods, services or benefits, charging different prices or rates, providing a different level or quality, suggesting any of these, or treating the exercise of rights as a basis for suspicion of criminal wrongdoing. This duty binds a person or a public entity.
• Bind a service provider that collects, transports or analyzes a consumer's biological sample or genetic data for you, by contract, not to retain, use or disclose the sample, extracted genetic material, genetic data or any information about the consumer's identity for any purpose other than the contracted services, and not to associate or combine them with information it receives from or collects for others.

CCPA, Cal. Civ. Code section 1798.140(m) · Read the law's page

• To treat information as deidentified under the CCPA, take reasonable measures to ensure that it cannot be associated with a consumer or household (Civ. Code section 1798.140(m)(1)).
• Publicly commit to maintain and use the information in deidentified form and not to attempt to reidentify it, except that you may attempt to reidentify it solely to determine whether your deidentification processes meet the definition (Civ. Code section 1798.140(m)(2)).
• Contractually obligate every recipient of the information to comply with all provisions of the definition (Civ. Code section 1798.140(m)(3)).

Cal. Code Regs. tit. 11, sections 7002 to 7004 · Read the law's page

• Keep your collection, use, retention and sharing of a consumer's personal information reasonably necessary and proportionate to the purpose for which you collected or processed it, which must be consistent with the consumer's reasonable expectations, or to another disclosed purpose compatible with the context of collection (section 7002).
• Write disclosures and communications to consumers in language that is easy to read and understand, and make the disclosures Article 2 requires readable on smaller screens, available in the languages in which you ordinarily deal with California consumers, and reasonably accessible to consumers with disabilities (section 7003).
• Design the methods for submitting CCPA requests and obtaining consumer consent to be easy to understand, symmetrical in choice (the privacy-protective path is no longer or harder than the less protective one) and easy to execute, without unnecessary burden or friction (section 7004(a)).

Cal. Code Regs. tit. 11, sections 7010 to 7016 · Read the law's page

• Provide a privacy policy that describes your online and offline information practices and your consumers' rights, make it available in a format a consumer can print, and post it online through a conspicuous link using the word privacy on your website homepage or on your mobile application's download or landing page (sections 7010(a) and 7011).
• If you offer a mobile application, include a link to the privacy policy in the application's settings menu (section 7011(d)).
• If you control the collection of a consumer's personal information, give a notice at collection where consumers will encounter it at or before the point of collection, whether online, in an application or offline (sections 7010(b) and 7012).
• If you sell or share personal information, provide a notice of right to opt out of sale or sharing, or the alternative opt-out link (sections 7010(e), 7013 and 7015).
• If you use or disclose sensitive personal information for purposes beyond those listed in section 7027(m), provide a notice of right to limit or the alternative opt-out link (sections 7010(f) and 7014).
• If you offer a financial incentive or a price or service difference, provide a notice of financial incentive (sections 7010(g) and 7016).

Cal. Code Regs. tit. 11, sections 7020 to 7028 and 7060 to 7063 · Read the law's page

• If you operate exclusively online and have a direct relationship with the consumers you collect personal information from, give consumers an email address for requests to delete, correct and know. Every other business must give two or more designated methods, one of them a toll-free telephone number, and a website method such as a webform if you maintain a website (section 7020(a) and (b)).
• Confirm receipt of a request to delete, correct or know within 10 business days, and respond within 45 calendar days of receipt. You may extend once by up to 45 more days if you give the consumer notice and an explanation (section 7021).
• To comply with a request to delete, erase the personal information from your existing systems (archived and backup systems excepted), deidentify it or aggregate it, tell your service providers and contractors to delete it, and notify the third parties you sold or shared it with unless that proves impossible or involves disproportionate effort, in which case give the consumer a detailed explanation (section 7022(b)).
• Do not disclose specific pieces of personal information to a requestor you cannot verify, and tell the requestor that you cannot verify their identity (section 7024(a)).
• Establish, document and comply with a reasonable method for verifying that a person making a request to delete, correct or know is the consumer about whom you hold information (section 7060(a)).
• Do not require a consumer to verify their identity to opt out of sale or sharing or to limit use of sensitive personal information (section 7060(b)).
• If you sell or share personal information, process an opt-out preference signal that is in a commonly used format, and that the sending platform makes clear is meant to opt the consumer out of sale and sharing, as a valid opt-out request (section 7025(b)).
• If you collect personal information online and receive such a signal, treat it as a valid request to opt out for that browser or device and any profile associated with it, including pseudonymous profiles, and do not require the consumer to supply more than is necessary to send the signal (section 7025(c)(1) and (2)).
• Display on your website whether you have processed the consumer's opt-out preference signal as a valid request to opt out of sale or sharing (section 7025(c)(6)).
• If you sell or share personal information, provide two or more designated methods for requests to opt out, which for an online business must include an opt-out preference signal and one other listed method. A cookie banner or cookie controls alone do not count (section 7026(a)).
• If you use or disclose sensitive personal information for purposes beyond those in section 7027(m), provide two or more designated methods for requests to limit (section 7027(b)).
• Take a request to opt in after opting out through a two-step process, a clear request followed by a separate confirmation (section 7028(a)).

Cal. Code Regs. tit. 11, sections 7050 to 7053 · Read the law's page

• Use a written contract with each service provider and contractor that prohibits it from selling or sharing the personal information, identifies the specific business purposes (not described in generic terms), bars retaining, using or disclosing the information for any other purpose or outside the direct business relationship, and requires it to comply with the CCPA and the Regulations at the same level of privacy protection (section 7051(a)(1) to (5)).
• In that contract, reserve your right to take reasonable and appropriate steps to ensure consistent use and to stop and remediate unauthorized use, and require the service provider or contractor to tell you when it can no longer meet its obligations and to enable you to honor consumer requests (section 7051(a)(6) to (9)).
• If you are a service provider or contractor that subcontracts, have a contract with the subcontractor that complies with section 7051(a) (section 7051(b)).
• If you sell or share personal information with a third party, enter into an agreement that identifies the limited and specified purposes, limits the third party's use to them, requires the third party to comply with the CCPA and the Regulations at the same level of protection, and gives you the right to take reasonable steps to verify and to stop and remediate unauthorized use (section 7053(a)).

Cal. Code Regs. tit. 11, sections 7100 to 7102 · Read the law's page

• Inform everyone responsible for handling consumer inquiries about your information practices or your CCPA compliance of all the requirements of the CCPA and the Regulations and how to direct consumers to exercise their rights (section 7100(a)).
• Maintain records of consumer requests and how you responded for at least 24 months, as a ticket or log with the date, nature and manner of the request, the date and nature of your response, and the basis for any denial, protected by reasonable security procedures and practices (section 7101).
• If you know or reasonably should know that you buy, receive, sell, share or otherwise make available for commercial purposes the personal information of 10,000,000 or more consumers in a calendar year, establish, document and comply with a training policy (section 7100(b)), compile the request metrics section 7102(a)(1) lists, and disclose them by July 1 of each year in your privacy policy or on your website through a link in it (section 7102(a)).

Cal. Code Regs. tit. 11, sections 7300 to 7304 · Read the law's page

• Cooperate with an Agency audit, which the Agency may announce or conduct unannounced to check compliance with any provision of the CCPA (section 7304).

Cal. Civ. Code sections 1798.150, 1798.155, 1798.199.10, 1798.199.90 · Read the law's page

• Expect administrative enforcement from the California Privacy Protection Agency and the Attorney General, with civil penalties up to $7,988 for an intentional violation or one involving a consumer under 16 (the 2025 inflation-adjusted amount).
• Maintain reasonable security procedures for a California consumer's unencrypted, unredacted personal information; a breach caused by their absence exposes your business to a private lawsuit for $100 to $750 in statutory damages per consumer per incident, which cannot be cured by improving security after the fact.

Cal. Code Regs. tit. 11, sections 7600 to 7604 · Read the law's page

• If you are a data broker, register with the Agency during January 1 to 31 of each year through the Agency's website and pay the annual registration fee of $6,000 plus the payment-processing fee, which is not prorated or refunded (sections 7600 and 7602(a)).
• Have an employee or agent with sufficient knowledge of your practices register you and certify under penalty of perjury that the information submitted is true and correct, with accurate and functioning website links and email addresses (sections 7602(b) and 7603(a) and (b)).
• When you report the extent to which other laws regulate you, describe the types of personal information, the specific products or services and the approximate proportions of your data covered by those laws (section 7603(d)).

Cal. Civ. Code section 1798.82, as amended by SB 446 (2025, Ch. 319) · Read the law's page

• Notify affected California residents of a breach of their unencrypted personal information within 30 calendar days of discovery or notification.
• Notify the California Attorney General within 15 days of consumer notification when a breach affects more than 500 California residents.

Cal. Civ. Code section 1798.99.92 · Read the law's page

• Do not geofence an entity that provides in-person health care services in California to identify or track a person seeking, receiving or providing health care services, to collect personal information from such a person, or to send such a person notifications or advertisements related to their personal information or health care services (section 1798.99.92(a)).
• Do not sell personal information to, or share it with, a third party for use in violating that prohibition. A statement signed under penalty of perjury by a person authorized to bind the third party that the information will not be used for these purposes is prima facie evidence that it was not sold or shared in violation (section 1798.99.92(b)).
• Do not use personal information obtained in violation of the section (section 1798.99.92(c)).

Cal. Code Regs. tit. 11, Sections 7120 to 7124 · Read the law's page

• If your business meets the CCPA's business-scale thresholds, deriving 50 percent or more of annual revenue from selling or sharing personal information, or having more than $25 million in annual gross revenue and having processed the personal information of 250,000 or more consumers or households, or the sensitive personal information of 50,000 or more consumers, in the preceding calendar year, complete a cybersecurity audit.
• Complete that audit using a qualified, objective, independent auditor, who may be internal or external to the business, and who did not develop, implement, or maintain the cybersecurity program being audited.
• If you use an internal auditor, have the highest-ranking auditor report to, and have their performance evaluation and compensation determined by, a member of executive management who does not have direct responsibility for the cybersecurity program.
• Retain all documents relevant to each cybersecurity audit for at least five years, and give the audit report only to a member of executive management with direct responsibility for the cybersecurity program.
• Submit a written certification of completion to the California Privacy Protection Agency by April 1 following each year you were required to complete an audit, starting April 1, 2028 for the largest businesses and reaching every covered business by April 1, 2030.

Cal. Code Regs. tit. 11, sections 7150 to 7157 · Read the law's page

• Before you start processing that presents significant risk to consumers' privacy (selling or sharing personal information, processing sensitive personal information other than for the employment purposes section 7150(b)(2)(A) lists, using automated decisionmaking technology for a significant decision, the inferences about applicants, students, employees, contractors or people in a sensitive location that section 7150(b)(4) and (5) describe, or training automated decisionmaking or facial-recognition or emotion-recognition technology), conduct a risk assessment (section 7150).
• In the risk assessment, document a specific purpose for the processing, the categories of personal information (the minimum necessary), the operational elements of the processing, the benefits, the negative impacts to consumers' privacy and their sources, and the safeguards, and weigh whether the risks outweigh the benefits (section 7152(a)).
• Review and update each risk assessment at least once every three years, and update it as soon as feasible and within 45 calendar days of a material change in the processing (section 7155(a)(2) and (3)).
• For processing you began before January 1, 2026 that continues after that day, complete and document the risk assessment no later than December 31, 2027 (section 7155(b)).
• Retain risk assessments, original and updated, for as long as the processing continues or for five years after completion, whichever is later (section 7155(c)).
• Submit the risk assessment information section 7157(b) lists to the Agency, with an attestation under penalty of perjury from a member of executive management, by April 1, 2028 for assessments conducted in 2026 and 2027 and by April 1 of each later year (section 7157).

Cal. Civ. Code sections 1798.99.86 and 1798.99.82(d) · Read the law's page

• If you are a data broker, access the California Privacy Protection Agency's accessible deletion mechanism (the Delete Request and Opt-Out Platform) at least once every 45 days, and within 45 days of receiving a deletion request through it, delete all personal information related to the consumer who made it.
• You need not delete personal information it is reasonably necessary to keep for a purpose listed in section 1798.105(d), or whose deletion section 1798.145 or 1798.146 does not require. Use what you keep only for that purpose, never for marketing or any other purpose.
• Direct all your service providers and contractors to delete all personal information in their possession related to each consumer whose deletion request you process.
• If you deny a deletion request because it cannot be verified, process it within 45 days as an opt-out of the sale or sharing of the consumer's personal information, and direct your service providers and contractors to do the same.
• After deleting a consumer's data under a request, delete all of that consumer's personal information again at least once every 45 days, unless the consumer requests otherwise or section 1798.99.86(c)(2) excuses the deletion.
• After deleting a consumer's data under a request, do not sell or share new personal information about that consumer unless the consumer requests otherwise or section 1798.145 or 1798.146 permits it.
• Pay any access fee the Agency charges when you access the mechanism; it may not exceed the reasonable cost of providing that access.

Cal. Code Regs. tit. 11, sections 7610 to 7616 · Read the law's page

• If you are a data broker, create a DROP account before you first access the DROP, keep its credentials confidential and restricted to authorized persons, and tell the Agency immediately in writing of any unauthorized use of the account or breach of security related to the DROP (section 7610(a)(1)).
• If you begin operating as a data broker after the registration period, create a DROP account before operating, begin accessing the DROP within 45 calendar days of commencing operation, and pay the first-time access fee unless you have already paid a registration fee that year (section 7611(a)).
• Select every consumer deletion list whose identifiers match personal information in your records, and keep the selection current (section 7610(a)(3)).
• Access the DROP and download your selected consumer deletion lists at least once every 45 calendar days, manually if automated access fails (section 7612).
• Standardize your records as section 7613(a)(1) prescribes, hash them with the algorithm the deletion list uses, compare, and delete all personal information associated with each matched identifier, including inferences drawn from information collected from third parties, except what the statute exempts or you collected directly from the consumer as a first party (section 7613(a) and (b)).
• Keep a deletion request that matches nothing and compare newly collected records against it before you sell or share new personal information, and direct your service providers and contractors to delete matched information (section 7613(c) and (d)).
• At each access session report the status of every deletion request received in the previous session, with one of the response codes section 7614(b) lists (section 7614).
• Use the personal information the Agency provides only to comply with the Delete Act, never sell or share it, protect it with reasonable security procedures and practices, and do not contact a consumer to verify a DROP request (section 7616).

Cal. Labor Code sections 1051, 1052 and 1054 · Read the law's page

• Do not require, as a condition of securing or retaining employment, that an employee or applicant be photographed or fingerprinted by a person who wants the photograph or fingerprints to furnish them, or information about the employee or applicant, to another employer or third person, where they could be used to the employee's or applicant's detriment (section 1051).
• Do not knowingly cause, suffer or permit an agent, superintendent, manager or employee to commit that violation, and take all reasonable steps within your power to prevent it (section 1052).

AB 883 (Ch. 507, Stats. 2026), Cal. Civ. Code Sections 1798.99.86 and 1798.99.86.5 · Read the law's page

• If you are a data broker, access the California Privacy Protection Agency's accessible deletion mechanism at least once every 30 days, and within 30 days after receiving a deletion request through it, process the request and delete all personal information related to the consumer who made it (Civil Code Section 1798.99.86(c)(1)(A)).
• If you deny a deletion request because it cannot be verified, process it within 30 days of receiving it as an opt-out of the sale or sharing of the consumer's personal information (Section 1798.99.86(c)(1)(B)).
• After deleting a consumer's data under a request, delete all of that consumer's personal information again at least once every 30 days, unless the consumer requests otherwise or section 1798.99.86(c)(2) excuses the deletion (Section 1798.99.86(d)(1)).
• From July 1, 2027, process a deletion request you receive from a state or local elected official or a judge by complying with Section 1798.99.86 and its implementing regulations (Section 1798.99.86.5(f), (i)).

SB 923 (Ch. 482, Stats. 2026), Cal. Civ. Code Sections 1798.105 and 1798.130 · Read the law's page

• If you are a business under the California Consumer Privacy Act, honor a verifiable consumer request to delete any personal information about the consumer that you collected from or about the consumer, including information you obtained from a source other than the consumer: delete it from your records, notify your service providers and contractors to delete it, and notify all third parties to whom you sold or shared it to delete it, unless that proves impossible or involves disproportionate effort (Civil Code Section 1798.105(a), (c)(1)).
• Where you obtained a consumer's personal information from a source other than the consumer, keep only a record of the deletion request and the minimum data necessary to ensure the information remains deleted from your records and is not used for any other purpose (Section 1798.105(c)(2)).
• If your business operates exclusively online and has a direct relationship with the consumers from whom it collects personal information, provide an email address and also make an online method, such as a web form or online portal, available for submitting requests for information, deletion or correction (Section 1798.130(a)(1)(A)).