Law / United States / 
California
CCPA/CPRA Consumer Rights: Access, Deletion, Correction, and Opt-Out
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 1 January 2020, effective 1 January 2023.
A data subject rights rule binding private bodies.
As of 23 August 2026.
What it requires
- Provide a California consumer a verifiable way to request access to, deletion of, correction of, and a portable copy of their personal information, and respond within the CCPA's statutory timeline.
- Honor a Global Privacy Control signal or another recognized opt-out preference signal as a valid request to opt out of the sale or sharing of personal information.
- Do not deny goods or services, charge a different price, or provide a different quality of service to a California consumer because they exercised a CCPA right.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Civ. Code section 1798.155(a): an administrative fine of not more than $2,500 for each violation, or $7,500 for each intentional violation or one involving the personal information of a consumer known to be under 16, as enacted, adjusted for inflation by the California Privacy Protection Agency under section 1798.199.95(d) to $2,663 and $7,988 effective 2025-01-01 (the higher figure is recorded as per_violation_amount). This is the Act's general civil penalty, reaching any CCPA violation including the access, deletion, correction, and opt-out duties this row describes; it is not a duty-specific penalty. The Attorney General holds a parallel civil-penalty power at the same amounts under section 1798.199.90(a).
- Rule
- Per violation only
- As of
- 2 September 2026
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 7,988
Who enforces it
Enforcement body
California Privacy Protection Agency (administrative enforcement) and the California Attorney General (civil actions), sharing enforcement of the CCPA/CPRA.
Enforcement record
Count of distinct, dated CCPA enforcement announcements (a fine, order, or settlement against a named respondent) in the twelve months from 2025-09-02 to 2026-09-02, read from the California Privacy Protection Agency's own newsroom archive (CalPrivacy moved its announcements from cppa.ca.gov/announcements/ to privacy.ca.gov/about-us/newsroom/ on 2026-01-26; both archives were read to cover the full window): Tractor Supply Company, $1.35 million (2025-09-30); a marketing firm fined for selling audiences without data broker registration (2025-12-03); a round of data broker enforcement actions announced together (2026-01-08, individual count not itemized in the headline read); Youth Sports Media Company (PlayOn Sports), a $1.10 million fine (2026-03-03); Ford Motor Company, ordered to change practices and pay a fine (2026-03-05); a $12.75 million General Motors settlement led by the Attorney General, described by the agency as the largest CCPA penalty in California to date (2026-05-08); a data broker action brought under both the CCPA and the Delete Act, LocateSmarter (2026-08-11); a second data broker enforcement action the same week (2026-08-13); and an action against a Virginia data broker (2026-09-01). This counts public administrative and Attorney General actions only; no private CCPA filings are tallied by any register found. Enforcement advisories, the Data Broker Enforcement Strike Force launch, and the sectoral audit announcement are excluded as not themselves completed actions. fines_per_year is not recorded because not every action's dollar figure was confirmed from the register text itself; the confirmed figures above (Tractor Supply, PlayOn Sports, General Motors) are not totaled against the unconfirmed remainder. The newsroom is paginated: the 2026-05-08 to 2026-09-01 entries are on its first page, the Ford and PlayOn Sports decisions on its second, and the 2025 entries on the pages beyond and in the retired cppa.ca.gov/announcements/ index; only the first page is stored as the source snapshot for this count.
- As of
- 2 September 2026
- Trend
- Rising
- Source link
- https://privacy.ca.gov/about-us/newsroom/
- Actions per year
- 9
What it reaches
Obligation class
Data subject rights, Disclosure
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Gives California consumers the right to know and access what personal information a business holds and its source, the right to delete it, the right to correct it, a right to a portable copy, and the right to opt out of the sale or sharing of their personal information to third parties, all exercisable against the business rather than directly against its service providers or contractors. A business may not discriminate against a consumer for exercising these rights.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometrics
Read the law
Official codified statute text, California Legislative Information (leginfo.legislature.ca.gov)
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.