Does California have a comprehensive privacy law? Yes. The California Consumer Privacy Act (CCPA) has been in effect since January 1, 2020, and the California Privacy Rights Act (CPRA) amendments approved by voters in November 2020 took effect on January 1, 2023.
- Status: In Effect
- Law: California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (AB 375, 2018; Proposition 24, 2020; Cal. Civ. Code § 1798.100 et seq.)
- Signed: Not yet verified · Effective: January 1, 2020 (CPRA amendments: January 1, 2023)
- Applies to: For-profit businesses that do business in California and that had annual gross revenues over $25,000,000 in the preceding calendar year (adjusted to $26,625,000 from January 1, 2025), annually buy, sell, or share the personal information of 100,000 or more consumers or households, or derive 50% or more of annual revenues from selling or sharing consumers’ personal information
- Cure period: No mandatory cure period. The California Privacy Protection Agency may choose to give a business time to cure; consumers suing for statutory damages after a data breach must first give 30 days’ written notice
- Enforcement: California Privacy Protection Agency (administrative fines) and Attorney General (civil penalties): up to $2,663 per violation or $7,988 per intentional violation or violation involving consumers under 16 (2025 amounts); consumers may sue over data breaches for $107 to $799 per consumer per incident or actual damages
- Last verified: November 4, 2026 · Official source: CCPA statute text (California Privacy Protection Agency)
- Related: What is the California Privacy Rights Act (CPRA)?
The CCPA gives California residents the right to know what personal information a business collects about them and how it is used and shared, the right to delete it, the right to opt out of its sale or sharing, and the right not to be discriminated against for using these rights. Since January 1, 2023, the CPRA amendments have added the right to correct inaccurate personal information and the right to limit the use and disclosure of sensitive personal information.
The California Privacy Protection Agency enforces the law through administrative actions and adopts its regulations, and the Attorney General can bring civil actions. The CPPA’s first CCPA regulations took effect on March 29, 2023, and further regulations on risk assessments, cybersecurity audits and automated decisionmaking technology took effect on January 1, 2026. The dollar thresholds and penalty amounts are adjusted for inflation every odd-numbered year.
For a full explanation of the CPRA changes, see our guide to the California Privacy Rights Act.