Law / United States / 
California
California Consumer Privacy Act, as amended by the California Privacy Rights Act (Proposition 24)
Cal. Civ. Code section 1798.100 et seq. (CCPA, as amended by the CPRA)
In force since , effective .
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Obligation class
- Consent, Disclosure, Data subject rights, Security, Retention
- Audit expectation
- none
What it requires
- If your app is a for-profit business meeting the CCPA's revenue or data-volume threshold and it determines the purposes and means of processing a California consumer's personal information, honor the CCPA/CPRA's notice, opt-out, and non-discrimination duties before collecting, selling, or sharing that data.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCT.PO-P3
- Disclose at or before collection the categories of personal information you collect, your purpose for collecting it, and the retention period or the criteria you use to set it.NIST Privacy FrameworkCM.AW-P1
- Limit your collection, use, retention, and sharing of a California consumer's personal information to what is reasonably necessary and proportionate to the purpose you disclosed.NIST Privacy FrameworkGV.PO-P1
These lines are LexLint's reading of the law's text. Also read by: California Privacy Protection Agency, Enforcement Division (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Civ. Code section 1798.155(a): an administrative fine of not more than $2,500 for each violation, or $7,500 for each intentional violation or one involving the personal information of a consumer known to be under 16, as enacted, adjusted for inflation by the California Privacy Protection Agency under section 1798.199.95(d). The Agency's most recent adjustment, effective , raised the two figures to $2,663 and $7,988; the higher figure, for an intentional violation, is the per-violation amount, with the $2,663 base figure the lower tier for a non-intentional violation. The Attorney General holds a parallel civil-penalty power at the same as-enacted and adjusted amounts under section 1798.199.90(a).
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 7,988
Statutory damages
Civ. Code section 1798.150(a)(1)(A): a consumer whose nonencrypted, nonredacted personal information is breached because a business violated its duty to maintain reasonable security may recover not less than $100 and not more than $750 per consumer per incident, or actual damages, whichever is greater, as enacted. The amount is adjusted for inflation by the California Privacy Protection Agency under section 1798.199.95(d); its most recent adjustment, effective , set the range at $107 to $799 (the statute states a range rather than culpability tiers). Section 1798.150(b) allows a consumer to pursue statutory damages 'on an individual or class-wide basis,' so a class action is available.
- As of
- Currency
- USD
- Per person minimum
- 107
- Per person reckless
- 799
- Class action available
- Yes
Who enforces it
Enforcement body
California Privacy Protection Agency (administrative enforcement) and the California Attorney General (civil actions), sharing enforcement of the CCPA/CPRA.
Enforcement record
Count of distinct, dated CCPA enforcement announcements (a fine, order, or settlement against a named respondent) in the twelve months from to , read from the California Privacy Protection Agency's own newsroom archive (CalPrivacy moved its announcements from cppa.ca.gov/announcements/ to privacy.ca.gov/about-us/newsroom/ on ; both archives were read to cover the full window): Tractor Supply Company, $1.35 million (); a marketing firm fined for selling audiences without data broker registration (); a round of data broker enforcement actions announced together (, individual count not itemized in the headline read); Youth Sports Media Company (PlayOn Sports), a $1.10 million fine (); Ford Motor Company, ordered to change practices and pay a fine (); a $12.75 million General Motors settlement led by the Attorney General, described by the agency as the largest CCPA penalty in California to date (); a data broker action brought under both the CCPA and the Delete Act, LocateSmarter (); a second data broker enforcement action the same week (); and an action against a Virginia data broker (). This counts public administrative and Attorney General actions only; no private CCPA filings are tallied by any register found. Enforcement advisories, the Data Broker Enforcement Strike Force launch, and the sectoral audit announcement are excluded as not themselves completed actions. The register text does not give a dollar figure for every action; the figures above (Tractor Supply, PlayOn Sports, General Motors) are not totaled against the remainder. The newsroom is paginated: the to entries are on its first page, the Ford and PlayOn Sports decisions on its second, and the 2025 entries on the pages beyond and in the retired cppa.ca.gov/announcements/ index; only the first page is stored as the source snapshot for this count.
- As of
- Trend
- Rising
- Source link
- https://privacy.ca.gov/about-us/newsroom/
- Actions per year
- 9
Settledness
- As of
- Guidance link
- https://cppa.ca.gov/pdf/enfadvisory202401.pdf
- Guidance body
- California Privacy Protection Agency, Enforcement Division
- Open questions
- Does a trained artificial intelligence model count as an "artificial intelligence system that is capable of outputting personal information" under Civil Code section 1798.140(v)(4)(C), so that a consumer's right to delete reaches the model itself?
What it makes you log
Logging duty
Section 1798.100 requires notice at collection, including the planned retention period for each category, a limit on collection and retention, contract terms with recipients and reasonable security. Each is a disclosure or a limit on the personal information itself, and none names a log, a record the business keeps or a reader of one. The retention period in subdivision (a)(3) limits the personal information and is not a retention period for a record. Section 1798.100 states no territorial reach of its own; the Act reaches a business that does business in California (section 1798.140(d)) and protects consumers who are California residents (section 1798.140(i)), within the Act this row cites as a whole. The record-keeping duty of the regulations (11 CCR 7101) and the risk-assessment and cybersecurity-audit regulations are separate rows and are not read into this one.
- Kind
- None
- As of
What this law does
Governs private-sector for-profit businesses that meet the CCPA's revenue or data-volume threshold and determine the purposes and means of processing a California consumer's personal information. Duties run on a notice-and-purpose-limitation model rather than a consent-gated lawful basis, and are allocated among four defined roles: business, service provider, contractor, and third party.
The original CCPA (AB 375) became operative ; the California Privacy Rights Act (Proposition 24) substantially expanded it, and the amended law now in force became operative . AB 1008 (2024) separately expanded the personal-information definition to reach data held in AI systems capable of outputting it.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .