CCPA/CPRA: California Privacy Law Guide
Updated for 2026.
California's Consumer Privacy Rights Act (CPRA) took effect in 2023. It set up the California Privacy Protection Agency (CPPA). The CPPA is the first state privacy regulator in the US. In 2024, the CPPA issued over $100 million in fines. This is active enforcement — not a paper rule.
Who Must Comply
Three tests determine if the law applies. A business must meet any one of them.
- Annual revenue of $25 million or more.
- Personal data from 100,000 or more state consumers.
- More than 50% of revenue from selling personal information.
The state has 40 million residents. It is the fifth largest economy in the world. Most global companies meet at least one test.
19 Categories of Sensitive Data
The law creates a special tier for sensitive personal details. Companies must give consumers extra notice and a right to limit use. The 19 types are:
- Social Security, driver's license, state ID, passport numbers
- Financial account or card numbers with access codes
- Precise geolocation (within 1,852 meters)
- Racial or ethnic origin
- Religious or philosophical beliefs
- Union membership
- Private email or postal mail content
- Genetic information
- Biometric records for identification
- Health or medical records
- Sexual orientation or sex life
- Immigration status (added in 2024)
- Mental health records (added in 2024)
- Citizenship status
- Financial account numbers without access codes
- Disability status
- Employment status indicators
- Insurance policy information
- Criminal or arrest records
For each category, consumers can limit how a business uses and shares it. This right is separate from the general right to opt out of sale.
What the CPPA Targeted in 2024
The CPPA's 2024 actions fell into four areas.
Data broker registration. The state requires data brokers to register with the CPPA. The agency found hundreds of unregistered brokers selling consumer profiles.
Broken opt-out tools. Many consent platforms did not give a real opt-out. The button did not work, or the opt-out only covered some uses.
AI decisions without notice. The 2025 AI rules require notice when automated tools make key decisions. Jobs, credit, and housing all count. Several 2024 cases targeted AI tools used without this notice.
Children's records. California's Age-Appropriate Design Code applies to any service minors are likely to use. Those companies must complete a Data Protection Impact Assessment. The CPPA found many companies had not done this.
State Law vs. GDPR: Key Differences
GDPR compliance does not cover you in California. The laws share goals but differ on key points.
Opt-out versus opt-in. GDPR requires opt-in consent for most sensitive-data uses. The state law uses an opt-out model. Processing is allowed until the consumer objects.
Consumer rights. Both laws give access, deletion, and correction rights. State law adds a right to opt out of automated decisions. GDPR Article 22 covers this too, but with a narrower scope.
Employee records. State law covers employee personal details fully. GDPR does too, but EU member states have their own employment rules. Staff privacy in the state often needs its own compliance track.
Sensitive types. The 19 state types partly overlap with GDPR Article 9. Immigration status and standalone account numbers are state-specific.
See the legal compliance guide for how these duties stack.
AI Vendor Requirements
The 2025 AI rules create clear duties for companies that use AI tools on consumer records.
Vendor contracts. Service providers must sign a written agreement. The agreement must cover four things. First, use records only for the stated purpose. Second, delete records when the service ends. Third, pass through consumer rights requests. Fourth, keep adequate security in place.
Automated decision notice. If an AI tool helps decide on credit, fraud, or jobs — consumers must be told. They must also get an opt-out.
AI training limits. If consumer records trained an AI model, that model has limits. It cannot be used for purposes that conflict with the original collection reason.
The direct fix for most teams: remove personal IDs before records enter any AI system. This meets the AI decision rules and cuts sensitive-type risk at the same time.
Learn how anonym.legal removes identifiers before AI processing at /security-compliance.
Key Points
State law covers most global companies with customers in the state. It adds 19 sensitive types, an active enforcement agency, and AI notice rules. GDPR compliance does not replace state compliance. The clearest step: remove personal IDs before records enter AI tools.
Read about data minimization at /docs/faq.
Sources
- CPPA: California Privacy Protection Agency. cppa.ca.gov.
- California Privacy Rights Act (CPRA) full text. leginfo.legislature.ca.gov.
- CPPA: Automated Decision-Making Technology Regulations 2025. cppa.ca.gov.
- California Age-Appropriate Design Code. leginfo.legislature.ca.gov.