California
California Data Privacy Laws: CCPA, CPRA & Consumer Rights (2026)
Independently fact-checked against primary sources (last audited August 14, 2026). · Reviewed by the RecordingLaw editorial team. · Law checked current as of August 14, 2026. · 32 primary sources cited on this page. How we verify our legal content
California's data privacy law, the CCPA as amended by the CPRA (Cal. Civ. Code §§ 1798.100-1798.199.100), gives residents six enforceable rights: to know, delete, correct, and opt out of the sale or sharing of their personal information, to limit use of sensitive data, and to be free from discrimination for exercising those rights.
California has the most comprehensive data privacy framework in the United States. The state's protections go well beyond what federal law requires, giving residents powerful rights over how businesses collect, use, and share their personal information.
The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), forms the foundation of that framework. Additional statutes covering data breaches, student data, online privacy policies, data brokers, and specific data categories layer further protections on top.
This guide covers every major California data privacy law currently in effect, including the latest 2025-2026 regulations and enforcement actions.
The CCPA and CPRA: California's Core Privacy Law
The California Consumer Privacy Act was signed into law in 2018 and took effect January 1, 2020. California voters then approved Proposition 24 in November 2020, creating the CPRA. The CPRA did not replace the CCPA. Instead, it amended and expanded the existing law, added new consumer rights, and created the California Privacy Protection Agency (CPPA) as the first dedicated state privacy regulator in the country.
The CPRA amendments took effect January 1, 2023. The combined law is codified at California Civil Code Sections 1798.100 through 1798.199.100 and is still commonly called the CCPA. Two additional amendments signed in September 2024 took effect January 1, 2025: AB 1008, which clarified that personal information includes data embedded in AI and other abstract digital systems, and SB 1223, which added neural data to the sensitive personal information category.
Which Businesses Must Comply
The CCPA applies to for-profit businesses that do business in California and meet at least one of three thresholds, adjusted for inflation in January 2025:
- Annual gross revenue of $26.625 million or more
- Buy, sell, or share the personal information of 100,000 or more California residents or households
- Derive 50% or more of annual revenue from selling or sharing California residents' personal information
Nonprofit organizations and government agencies are not subject to the CCPA. Certain data categories are also exempt, including medical information covered by HIPAA, consumer credit data under the FCRA, and data collected under the Gramm-Leach-Bliley Act.
What Counts as Personal Information
Under Section 1798.140, personal information is any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to a particular consumer or household. Examples include names, Social Security numbers, email addresses, purchase histories, browsing activity, geolocation data, fingerprints, and inferences used to build consumer profiles.
AB 1008, effective January 1, 2025, clarified that personal information retains its character regardless of format, including when it is embedded in generative AI systems or other abstract digital environments.
Sensitive Personal Information
The CPRA introduced a separate sensitive personal information category with stronger protections. Sensitive personal information includes:
- Social Security numbers, driver's license numbers, and state ID numbers
- Financial account numbers combined with access credentials
- Precise geolocation data
- Racial or ethnic origin, religious or philosophical beliefs, and union membership
- Contents of mail, email, and text messages (unless the business is the intended recipient)
- Genetic data
- Biometric information used for identification
- Health information
- Information about sex life or sexual orientation
- Neural data (added by SB 1223, effective January 1, 2025)
Consumers have the right to direct businesses to limit their use and disclosure of sensitive personal information to what is necessary to provide the requested goods or services.
Six Core Consumer Rights Under the CCPA
California residents have six fundamental privacy rights under the CCPA. Businesses must honor these rights regardless of whether the consumer is a current customer.
Right to Know
Consumers can request that a business disclose what personal information it has collected about them, the sources of collection, the business purposes, and the categories of third parties with whom the information is shared. Businesses must respond to a verifiable consumer request within 45 calendar days and may extend by an additional 45 days with notice. Consumers may submit this request up to twice per year at no cost.
Right to Delete
Consumers can request deletion of personal information a business has collected about them. The business must also direct its service providers and contractors to delete the data. Exceptions exist for data needed to complete a transaction, detect security incidents, or comply with legal obligations, among others listed in Section 1798.105.
Right to Correct
Added by the CPRA and effective since January 1, 2023, consumers can ask businesses to correct inaccurate personal information. Businesses must make commercially reasonable efforts to correct the information within 45 calendar days of receiving a verified request.
Right to Opt-Out of Sale or Sharing
Consumers can direct a business to stop selling or sharing their personal information. Businesses that sell or share personal information must display a clear and conspicuous "Do Not Sell or Share My Personal Information" link on their website.
Businesses must also honor Global Privacy Control (GPC) browser signals. Once a consumer opts out, the business must wait at least 12 months before requesting the consumer opt back in.
Right to Limit Use of Sensitive Personal Information
Consumers can direct businesses to limit use of their sensitive personal information to what is necessary to perform the requested service. Businesses must provide a "Limit the Use of My Sensitive Personal Information" link, or combine it with the opt-out link.
Right to Non-Discrimination
Businesses cannot penalize consumers for exercising their CCPA rights. A business may not deny goods or services, charge different prices, or provide a different level of quality based on a consumer's exercise of privacy rights.
Business Obligations Under the CCPA
Privacy Notice Requirements
Businesses must provide a notice at collection listing the categories of personal information being collected and the purposes for each category, provided at or before the point of collection. Businesses must also maintain a privacy policy covering all personal information collected in the past 12 months, the sources, the purposes, the categories of third parties to whom it is disclosed, and a description of each consumer right.
Request Handling
Businesses must provide at least two methods for consumers to submit requests, including a toll-free telephone number and a website address. Businesses must acknowledge receipt within 10 business days and respond substantively within 45 days. For opt-out requests, businesses must comply within 15 business days.
Service Provider Contracts
Written contracts with service providers must prohibit the service provider from selling or sharing personal information, using it for purposes outside the contract, or retaining it after the business relationship ends.
Child Privacy Protections
The CCPA prohibits selling or sharing the personal information of consumers known to be under 16 without affirmative authorization. For children under 13, a parent or guardian must opt in. For consumers aged 13 to 15, the minor must opt in. The California AG has actively enforced these provisions against gaming and streaming companies.
2025-2026 CCPA Regulation Updates
The ADMT, Cybersecurity Audit, and Risk Assessment Package
The CPPA Board adopted a major regulation package on July 24, 2025. The Office of Administrative Law approved and filed the regulations with the Secretary of State on September 22, 2025. Most requirements took effect January 1, 2026. The package covers four areas:
Automated Decisionmaking Technology (ADMT): Consumers gain rights to receive notice about, access information regarding, and opt out of a business's use of ADMT for decisions with legal or similarly significant effects. Businesses that use ADMT in significant-decision contexts must comply starting January 1, 2027. Businesses using ADMT for profiling in workplace or educational contexts have until January 1, 2028.
Cybersecurity Audits: Businesses whose processing of personal information presents significant risk to consumers must complete annual cybersecurity audits. Which businesses qualify depends on data type and volume thresholds defined in the regulations.
Risk Assessments: Businesses engaged in high-risk processing activities must conduct and submit risk assessments to the CPPA. Assessments must evaluate the benefits and risks of each processing activity and identify safeguards.
Insurance Company Compliance: The regulations clarify when insurance companies must comply with CCPA requirements, addressing a prior gap in the regulatory framework.
CCPA Penalties and Enforcement
CCPA enforcement is concurrent. The California Privacy Protection Agency (CPPA) brings administrative enforcement actions and issues administrative fines under Civil Code 1798.155. The California Attorney General (AG) brings civil actions for penalties and injunctive relief under Civil Code 1798.199.90, and that authority carries no cutoff date. Enforcement of the provisions the CPRA added or amended did not begin until July 1, 2023 and reaches only violations occurring on or after that date. Consumers have a limited private right of action in data breach cases.
Penalty Structure
As of January 2025, penalties are adjusted for inflation and stand at:
| Violation Type | Penalty Amount |
|---|---|
| Unintentional violation | Up to $2,663 per violation |
| Intentional violation | Up to $7,988 per violation |
| Violation involving a minor under 16 | Up to $7,988 per violation |
These amounts adjust every odd-numbered year based on the California Consumer Price Index.
Private Right of Action for Data Breaches
Under Section 1798.150, consumers may sue businesses directly when their unencrypted and unredacted personal information is stolen because the business failed to maintain reasonable security. Statutory damages range from $107 to $799 per consumer per incident, or actual damages, whichever is greater. The 30 days' written notice requirement applies only to claims for statutory damages. Section 1798.150(b) states that no notice is required before a consumer brings an action solely for actual pecuniary damages. The cure defense is narrow as well: it applies only where a cure is possible, and the statute provides that implementing reasonable security procedures after a breach does not cure that breach.
Recent Enforcement Actions: CPPA
The CPPA has brought the following notable actions since its enforcement authority took effect in 2023:
Honda Motor Co. (March 2025): The CPPA settled with American Honda for $632,500 over violations including requiring consumers to provide excessive personal information before exercising CCPA opt-out rights, making the verification process unduly burdensome.
Todd Snyder, Inc. (May 2025): The clothing retailer paid $345,178 for failing to properly configure its opt-out infrastructure for 40 days, requesting more consumer information than necessary, and requiring identity verification for opt-out requests.
Tractor Supply Company (September 2025): The CPPA issued its largest fine to date, $1,350,000, for failing to maintain proper privacy notices, failing to inform job applicants of their privacy rights, lacking effective opt-out mechanisms including Global Privacy Control, and sharing data with third parties without contractual privacy protections.
Recent Enforcement Actions: California Attorney General
Sephora (August 2022): The AG secured a $1,200,000 settlement for failing to disclose that it was selling consumers' personal information and failing to honor Global Privacy Control opt-out signals.
DoorDash (February 2024): The AG obtained a $375,000 settlement after DoorDash sold customers' personal information through a marketing cooperative without providing notice or an opt-out opportunity.
Tilting Point Media (June 2024): The AG and Los Angeles City Attorney secured a $500,000 settlement against the maker of "SpongeBob: Krusty Cook-Off" for collecting and sharing children's personal data without parental consent, violating both the CCPA and the federal COPPA.
Healthline Media (July 2025): The AG obtained what was at the time the largest AG-led CCPA settlement, $1,550,000 for sharing health-related user data with third-party advertisers without required protections, including data suggesting users may have serious medical conditions.
General Motors (2025-2026): The AG, together with multiple district attorneys and with CPPA support, announced a $12,750,000 settlement against GM for selling hundreds of thousands of Californians' OnStar driving and location data to data brokers, which then sold the data to insurance companies for rate-setting purposes. The settlement is subject to court approval. At $12,750,000, this is the largest CCPA settlement in California history to date.
Disney (February 2026): The AG secured a $2,750,000 settlement against The Walt Disney Company for failing to honor opt-out requests across Disney+, Hulu, and ESPN+. This was the largest CCPA settlement in California history until the AG's $12,750,000 General Motors settlement, announced three months later in May 2026.
California Data Breach Notification Law
California's data breach notification law, Civil Code Section 1798.82, was one of the first of its kind in the nation when enacted in 2003.
When Notification Is Required
A business or person who owns or licenses computerized personal information and does business in California must notify affected residents when their unencrypted personal information is acquired, or reasonably believed to have been acquired, by an unauthorized person. If encrypted data is breached along with the encryption key, notification is still required.
What Triggers Notification
A data breach notification is required when the compromised data includes a person's first name or initial and last name combined with any of the following:
- Social Security number
- Driver's license number or California identification card number
- Financial account number or credit or debit card number combined with any required access code
- Medical information or health insurance information
- Biometric data collected for authentication
- Genetic data
- Tax identification number, passport number, or military identification number
- Automated license plate recognition (ALPR) system data, as defined in Civil Code Section 1798.90.5 (added by SB 446, effective January 1, 2026)
A breach of a username or email address combined with a password or security question and answer also requires notification.
Notification Timeline and Requirements
Businesses must notify affected consumers within 30 calendar days of discovering the breach. A reasonable delay is permitted for law enforcement purposes or to determine the breach's scope. When a breach affects more than 500 California residents, the business must submit a sample notice to the Attorney General within 15 days.
The required notice must be written in plain language, use a minimum 10-point font, and contain five labeled sections: "What Happened," "What Information Was Involved," "What We Are Doing," "What You Can Do," and "For More Information."
California's Delete Act and the DROP Platform
The California Delete Act, signed in 2023, established the Delete Request and Opt-Out Platform (DROP), a state-hosted website where California residents can submit a single deletion request that applies to every registered data broker in the state. The DROP launched in January 2026.
Starting August 1, 2026, registered data brokers must check the DROP at least every 45 days and process deletion requests for any matching consumer records. Data brokers must report the status of each deletion request within 45 days of retrieving it.
Data Broker Registration Requirements
Businesses operating as data brokers must register with the CPPA by January 31 each year and pay an annual fee of $6,000. The CPPA manages the registry (transferred from the AG effective January 1, 2024) and has launched a dedicated data broker enforcement strike force.
The CPPA has already fined unregistered data brokers. In January 2026, it fined Rickenbacher Data LLC $45,000 for selling personal information of millions of people with serious health conditions without registering.
Other California Privacy Statutes
California Online Privacy Protection Act (CalOPPA)
CalOPPA (Bus. & Prof. Code §§ 22575-22579), enacted in 2003, requires operators of commercial websites and online services that collect personal information from California residents to post a privacy policy. The policy must identify the categories of personal information collected, the categories of third parties with whom information may be shared, the process for consumers to review and request changes to their information, and how the operator responds to "Do Not Track" browser signals.
Shine the Light Law
California's "Shine the Light" law (Civil Code §§ 1798.83-1798.84) gives consumers the right, once per year, to request a list of the categories of personal information shared with third parties for direct marketing purposes and the names and addresses of those third parties. Businesses may instead offer consumers an opt-out from such sharing.
Student Online Personal Information Protection Act (SOPIPA)
SOPIPA (SB 1177, 2014) prohibits operators of K-12 educational technology services from using student data to build profiles for non-educational purposes, selling student information, or engaging in targeted advertising based on student data. Operators must maintain reasonable security procedures to protect student information.
Age-Appropriate Design Code Act
California enacted the Age-Appropriate Design Code Act (AB 2273) in 2022, requiring online businesses likely to be accessed by children to conduct data protection impact assessments and implement default privacy protections. A federal district court initially blocked enforcement on First Amendment grounds, and the AG appealed. On March 12, 2026, the Ninth Circuit narrowed that injunction in NetChoice v. Bonta, No. 25-2366. Several provisions, including the age estimation requirement, are no longer blocked, and the case has returned to the district court to develop the record on the remaining claims and severability. The data-use restriction on activity "materially detrimental" to a child's "best interests" or "well-being" and the dark patterns prohibition remain enjoined because the panel found those specific terms unconstitutionally vague. The data protection impact assessment requirement and the 90-day notice-and-cure provision also remain blocked, under the Ninth Circuit's earlier First Amendment ruling in the same litigation.
Federal Privacy Law Overlay
Several federal statutes apply alongside California's state law.
HIPAA covers covered entities and their business associates in the healthcare sector. GLBA applies to financial institutions. FCRA governs consumer reporting agencies. COPPA protects children under 13 in online contexts and was central to the Tilting Point enforcement action described above.
FTC Act Section 5 gives the Federal Trade Commission authority to pursue deceptive and unfair data practices by businesses outside the sectors covered by sector-specific laws.
TAKE IT DOWN Act (Pub. L. 119-12, signed May 19, 2025): This federal law criminalizes knowingly publishing or threatening to share non-consensual intimate imagery, including AI-generated images of real identifiable individuals. Criminal provisions took effect immediately at signing. Platform notice-and-takedown obligations, enforced by the FTC, took effect May 19, 2026. Platforms must remove reported images within 48 hours.
American Privacy Rights Act (APRA): A bipartisan federal comprehensive privacy bill was introduced in 2024 as H.R. 8818 but expired at the end of the 118th Congress in January 2025 without passing. The bill has not been reintroduced in the current Congress. No federal comprehensive privacy law has been enacted as of May 2026.
How California Compares to Other State Privacy Laws
California's privacy framework stands apart from other state laws in several respects:
Dedicated enforcement agency: California is the only state with a standalone privacy enforcement agency (the CPPA). Every other state relies on its attorney general for CCPA-type enforcement.
Private right of action: California allows consumers to sue directly for data breaches. Most other state privacy laws provide no private right of action at all.
Data broker registry and DROP: No other state requires data brokers to register and provides a centralized one-click deletion mechanism.
Revenue threshold: California's $26.625 million revenue threshold has no equivalent in Virginia, Colorado, Connecticut, or most other states with comprehensive privacy laws.
Sensitive data scope: California's sensitive personal information category, now including neural data, is among the broadest of any state law. For a full comparison across all 50 states, see the world data privacy laws overview.
Practical Compliance Steps for Businesses
Businesses subject to the CCPA should take these steps to reduce enforcement risk:
First, confirm whether you meet any of the three CCPA thresholds (revenue, data volume, or revenue-from-sale percentage). If you do, audit the personal information you collect, process, and share. Map it to the categories in Section 1798.140 and identify which categories are sensitive.
Second, update your privacy policy to cover all 12-month collection activity and add the required opt-out links. Verify that your opt-out and limit-sensitive-data links are conspicuous and functional. Configure your privacy portal to accept Global Privacy Control signals automatically.
Third, put written contracts in place with every service provider and contractor that receives personal information. Contracts must include the restrictions specified in Section 1798.140(ag).
Fourth, review your data retention practices. Businesses should only retain personal information as long as reasonably necessary for the disclosed purpose. The GM case illustrates the risk of retaining data beyond its original purpose and then selling it.
Fifth, if your processing activities will trigger the new cybersecurity audit or risk assessment requirements under the September 2025 regulations, begin planning those processes now. ADMT-specific opt-out mechanisms are required for businesses with significant-decision use cases beginning January 1, 2027.
How California Residents Exercise Their Rights
California residents can submit requests through any covered business's designated request methods, which must include at minimum a toll-free telephone number and a web form. Businesses must respond within 45 days (with a possible 45-day extension).
For opt-out requests specifically, businesses must comply within 15 business days. Consumers who have installed a Global Privacy Control-compatible browser or extension can trigger opt-out automatically without submitting a manual request.
For data broker deletions, the CPPA DROP platform at cppa.ca.gov accepts single deletion requests that apply to all registered data brokers starting in 2026. Data brokers must process matching requests within 45 days of retrieving them.
To file a complaint about a CCPA violation, consumers can contact either the CPPA or the California AG. Both agencies enforce the CCPA.
More California Legal Guides
Explore related California legal guides:
- California Recording Laws - Consent rules for recording conversations
- California Background Check Laws - Employment screening and Ban the Box
- All US Data Privacy Laws - Compare privacy laws across all 50 states
More California Laws
Frequently Asked Questions
Does the CCPA apply to small businesses in California?
The CCPA applies only to for-profit businesses meeting at least one of three thresholds: annual gross revenue of $26.625 million or more; buying, selling, or sharing personal information of 100,000 or more California residents or households; or deriving 50% or more of annual revenue from selling personal information. Businesses that do not meet any threshold are not covered. However, all California businesses remain subject to the state data breach notification law (Civil Code § 1798.82) and to CalOPPA if they operate a commercial website.
How do I opt out of the sale of my personal information in California?
Click the 'Do Not Sell or Share My Personal Information' link required on covered businesses' websites. You can also use a browser extension that sends a Global Privacy Control signal, which covered businesses must honor automatically. Starting in 2026, you can also use the state-run DROP platform at cppa.ca.gov to send a single deletion request to all registered data brokers.
What are the penalties for CCPA violations in 2025 and 2026?
As of January 2025, the CPPA or AG can impose fines of up to $2,663 per unintentional violation and up to $7,988 per intentional violation or any violation involving a consumer under 16. For data breaches caused by a business's failure to maintain reasonable security, affected consumers can sue for $107 to $799 per consumer per incident, or actual damages, whichever is greater. Penalty amounts are adjusted every two years based on the California Consumer Price Index.
What is the California DELETE Act and the DROP platform?
The Delete Act, signed in 2023, created the Delete Request and Opt-Out Platform (DROP), a state-run website where California residents can submit one deletion request that applies to every registered data broker in the state. The DROP launched in January 2026. Beginning August 1, 2026, data brokers must check the platform at least every 45 days and process matching deletion requests within 45 days. Data brokers must register with the CPPA annually and pay a $6,000 fee.
Does California's privacy law cover neural data and AI systems?
Yes. SB 1223, signed September 28, 2024 and effective January 1, 2025, added neural data to the sensitive personal information category under the CCPA. Neural data is defined as information generated by measuring the activity of a consumer's central or peripheral nervous system. AB 1008, also effective January 1, 2025, clarified that personal information includes data embedded in generative AI and other abstract digital formats.
What is the difference between AG enforcement and CPPA enforcement?
The two enforce the CCPA concurrently. The CPPA brings administrative enforcement actions and issues administrative fines under Civil Code 1798.155, while the Attorney General brings civil actions for penalties and injunctive relief in court under Civil Code 1798.199.90. The Attorney General's authority carries no cutoff date and is not limited to older violations, which is why the AG has continued to announce CCPA settlements through 2025 and 2026. The Attorney General was the sole CCPA enforcer before enforcement of the CPRA-added provisions began on July 1, 2023. The CPPA also administers the Delete Act's data broker registry program.
What are the new automated decisionmaking regulations effective in 2026?
The CPPA Board adopted ADMT regulations on July 24, 2025, approved by the Office of Administrative Law on September 22, 2025, with general regulations effective January 1, 2026. These give consumers the right to receive notice about, access information regarding, and opt out of a business's use of automated decisionmaking technology for decisions with legal or similarly significant effects. Businesses with significant-decision use cases must comply by January 1, 2027; businesses using ADMT for workplace or educational profiling must comply by January 1, 2028.
Does California's privacy law apply to employees and job applicants?
Yes. CPRA amendments that took effect January 1, 2023 removed a prior partial exemption for employee and job applicant data, bringing that data fully under the CCPA's requirements. The Tractor Supply enforcement action in September 2025 specifically cited the company's failure to inform job applicants of their privacy rights as a CCPA violation.
Updates
Corrected the enforcement section to explain that the California Privacy Protection Agency and the Attorney General enforce the CCPA concurrently, and clarified that the 30-day notice and cure requirement for data breach suits applies only to claims for statutory damages, not to claims for actual damages.
Corrected the enforcement-settlement rankings (General Motors' $12.75 million settlement is now the largest CCPA settlement), updated the Age-Appropriate Design Code status for the Ninth Circuit's March 2026 ruling in NetChoice v. Bonta, and added the license-plate-reader data category SB 446 added to California's breach notification law effective January 1, 2026.
Independently fact-checked against the cited primary sources; governing law re-checked for recent changes
Governing law re-checked for recent changes
May 2026 refresh: Added CPPA ADMT/cybersecurity audit/risk assessment final regulations (adopted July 24, 2025, effective January 1, 2026, ADMT compliance phased to 2027-2028). Added verified enforcement actions: Honda ($632,500 CPPA), Todd Snyder ($345,178 CPPA), Tractor Supply ($1,350,000 CPPA), DoorDash ($375,000 AG), Tilting Point Media ($500,000 AG), Healthline ($1,550,000 AG), General Motors ($12,750,000 AG), Disney ($2,750,000 AG, Feb 2026). Added AB 1008 (AI/personal information formats) and SB 1223 (neural data), both effective January 1, 2025. Added TAKE IT DOWN Act federal overlay (signed May 19, 2025, FTC enforcement of platform obligations began May 19, 2026). Confirmed APRA did not pass and has not been reintroduced. Added employee/job-applicant CCPA FAQ. Updated penalty figures to 2025 inflation-adjusted amounts. Expanded compliance guidance section.
Reviewed and approved by an editor
The Law Behind This Article
This article rests on the statutory provisions below, held in our own legal record and retrieved from the official source. Tap a section to read the operative text.
California Civil Code
§ 1798.100In forcecited in 11 of our articles
General Duties of Businesses that Collect Personal Information (a) A business that controls the collection of a consumer’s personal information shall, at or before the point of collection, inform consumers of the following: (1) The categories of personal information to be collected and the purposes for which the categories of personal information are collected or used and whether that information is sold or shared. A business shall not collect additional categories of personal information or use personal information collected for additional purposes that are incompatible with the disclosed purpose for which the personal information was collected without providing the consumer with notice consistent with this section. (2) If the business collects sensitive personal information, the categories of sensitive personal information to be collected and the purposes for which the categories of sensitive personal information are collected or used, and whether that information is sold or shared.
Official text (excerpt) · last checked 2026-08-31 · Read the full text in our law library · Verify at leginfo.legislature.ca.gov
Cited in 36 court opinionsMost recently applied by a court: 2026
Leading cases:
- Untitled California Attorney General Opinion (California Attorney General Reports 2022)“…ROUND The California Consumer Privacy Act of 2018 (Civil Code, §§ 1798.100 et seq.) is the first law of its kind i…”
- Troester v. Starbucks Corporation (California Supreme Court 2018, 235 Cal. Rptr. 3d 820)“…he consumer law context. (See Consumer Privacy Act of 2018, Civ. Code, § 1798.100 et seq. (added by Stats. 2018, ch. 55,…”
- Hajny v. Volkswagen Group of America CA1/1 (California Court of Appeal 2024)“…ions of the California Consumer Privacy Act of 2018 (CCPA), Civil Code section 1798.100 et seq. Shortly after Wynne filed…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: California Sues 23andMe's Successor Over Genetic Data Breach (2026), Employee Data Privacy: Employer Obligations by State (2026), Privacy Policy Requirements: What You Must Include (2026)
§ 1798.140In forcecited in 3 of our articles
Definitions For purposes of this title: (a) “Advertising and marketing” means a communication by a business or a person acting on the business’ behalf in any medium intended to induce a consumer to obtain goods, services, or employment. (b) “Aggregate consumer information” means information that relates to a group or category of consumers, from which individual consumer identities have been removed, that is not linked or reasonably linkable to any consumer or household, including via a device. “Aggregate consumer information” does not mean one or more individual consumer records that have been deidentified. (c) “Biometric information” means an individual’s physiological, biological, or behavioral characteristics, including information pertaining to an individual’s deoxyribonucleic acid (DNA), that is used or is intended to be used singly or in combination with each other or with other identifying data, to establish individual identity.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at leginfo.legislature.ca.gov
Cited in 12 court opinionsMost recently applied by a court: 2026
Leading cases:
- Untitled California Attorney General Opinion (California Attorney General Reports 2022)“…e business uses and shares that information. 26 21 Civ. Code, § 1798.140, subd. (c)(1)(A)-(C). 22 Civ. Code…”
- Netchoice, LLC v. Bonta (Court of Appeals for the Ninth Circuit 2026)“…cisionmaking, or choice, as further defined by regulation.” Cal. Civ. Code § 1798.140(l); id. § 1798.99.30(a). 40…”
- Keown v. International Association of Sheet Metal Air Rail Transportation Workers (District Court, District of Columbia 2024)“…or financial benefit of its shareholders or other owners.” Cal. Civ. Code § 1798.140(d)(1). As for the UCL, both state and f…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Biometric Privacy Laws by State (2026): BIPA, CUBI & Consent, California Biometric Privacy Laws: Collection, Consent & Penalties (2026)
§ 1798.82In forcecited in 3 of our articles
(a) (1) An individual or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, or whose encrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person and the encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person, and the person or business that owns or licenses the encrypted information has a reasonable belief that the encryption key or security credential could render that personal information readable or usable. (2) (A) Subject to subparagraph (B), the disclosure required by this subdivision shall be made within 30 calendar days of discovery or notification of the data breach.
Official text (excerpt) · last checked 2026-08-28 · Read the full text in our law library · Verify at leginfo.legislature.ca.gov
Cited in 39 court opinionsMost recently applied by a court: 2026
In the courts (editorial summary, independently checked):The breach notice duty is enforced through unfair competition suits. In People v. Experian Data Corp. (2024), a case of first impression, the Court of Appeal held the San Diego City Attorney may invoke the discovery rule to delay accrual of a claim whose predicate violation was Experian failing to give notice under Section 1798.82(a).
Leading cases:
- People v. Experian Data Corp. (California Court of Appeal 2024)✓The San Diego City Attorney sued Experian under the unfair competition law for failing to promptly notify consumers of a data breach as Section 1798.82 requires; the court held the discovery rule can delay accrual of that non-fraud enforcement action and reversed.
- Bank of America Corp. v. Superior Court (California Court of Appeal 2011, 198 Cal. App. 4th 862)“…ssue notice of default) (6th cause of action); violation of Civil Code section 1798.82 (requiring disclosure to consumer of da…”
- Eisenhower Medical Center v. Superior Court (California Court of Appeal 2014, 226 Cal. App. 4th 430)“…of action for violation of the Customer Records Act (CRA) (Civ.Code, § 1798.82), which requires notification to consum…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: California Data Breach Notification Laws: Reporting Rules & Timelines (2026)
§ 1798.83In force
(a) Except as otherwise provided in subdivision (d), if a business has an established business relationship with a customer and has within the immediately preceding calendar year disclosed personal information that corresponds to any of the categories of personal information set forth in paragraph (6) of subdivision (e) to third parties, and if the business knows or reasonably should know that the third parties used the personal information for the third parties’ direct marketing purposes, that business shall, after the receipt of a written or electronic mail request, or, if the business chooses to receive requests by toll-free telephone or facsimile numbers, a telephone or facsimile request from the customer, provide all of the following information to the customer free of charge: (1) In writing or by electronic mail, a list of the categories set forth in paragraph (6) of subdivision (e) that correspond to the personal information disclosed by the business to third parties for the third parties’ direct marketing purposes during the immediately preceding calendar year.
Official text (excerpt) · last checked 2026-07-28 · Read the full text in our law library · Verify at leginfo.legislature.ca.gov
Cited in 11 court opinionsMost recently applied by a court: 2024
Leading cases:
- Boorstein v. CBS Interactive, Inc. (California Court of Appeal 2013, 222 Cal. App. 4th 456)“…defendant’s demurrer to causes of action for violations of Civil Code section 1798.83 et seq. (the shine the light law or STL…”
- Limon v. Circle K Stores (California Court of Appeal 2022)“…and holding “informational injury” is not cognizable under Civil Code, section 1798.83 et seq.];15 Price v. Starbucks Corp. (2…”
- Muha v. Experian Information Solutions (California Court of Appeal 2024)“…bsite as required by the Shine the Light law (the STL law), Civil Code section 1798.83 et seq. (Boorstein, 222…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Search our full record of US law — 2.1 million sections, every state + federal →
Sources and References
- CCPA Full Text(leginfo.legislature.ca.gov).gov
- CCPA Overview - Attorney General(oag.ca.gov).gov
- CCPA Statute Effective January 1, 2026(cppa.ca.gov).gov
- CCPA FAQs(cppa.ca.gov).gov
- 2025 CCPA Penalty Adjustments(cppa.ca.gov).gov
- CCPA Updates: ADMT, Cybersecurity, Risk Assessments(cppa.ca.gov).gov
- Privacy Enforcement Actions(oag.ca.gov).gov
- Data Breach Notification Law (Civ. Code 1798.82)(leginfo.legislature.ca.gov).gov
- Data Breach Reporting Requirements(oag.ca.gov).gov
- DELETE Act and DROP Platform(cppa.ca.gov).gov
- SB 1223: Neural Data Protection(leginfo.legislature.ca.gov).gov
- CalOPPA(leginfo.legislature.ca.gov).gov
- Shine the Light Law(leginfo.legislature.ca.gov).gov
- SOPIPA (SB 1177)(leginfo.legislature.ca.gov).gov
- Age-Appropriate Design Code Act(leginfo.legislature.ca.gov).gov
- Tractor Supply Enforcement Action(cppa.ca.gov).gov
- Todd Snyder Enforcement Action(cppa.ca.gov).gov
- Data Broker Enforcement Actions(cppa.ca.gov).gov
- Section 1798.140 Definitions(leginfo.legislature.ca.gov).gov
- AADC Appeal(oag.ca.gov).gov
- CPPA Finalizes ADMT, Cybersecurity Audit, and Risk Assessment Regulations(cppa.ca.gov).gov
- Honda Motor Co. CCPA Settlement ($632,500)(cppa.ca.gov).gov
- Sephora CCPA Settlement ($1,200,000)(oag.ca.gov).gov
- DoorDash CCPA Settlement ($375,000)(oag.ca.gov).gov
- Tilting Point Media CCPA Settlement ($500,000)(oag.ca.gov).gov
- Healthline Media CCPA Settlement ($1,550,000)(oag.ca.gov).gov
- General Motors CCPA Settlement ($12,750,000)(oag.ca.gov).gov
- Disney CCPA Settlement ($2,750,000)(oag.ca.gov).gov
- Data Breach Notification Law (Cal. Civ. Code § 1798.82)(leginfo.legislature.ca.gov).gov
- CPPA Data Broker Enforcement Strike Force Launch(cppa.ca.gov).gov
- AB 1008: CCPA Coverage of Personal Information in AI Systems(leginfo.legislature.ca.gov).gov
- TAKE IT DOWN Act FTC Enforcement Begins May 19, 2026(ftc.gov).gov
- Cal. Civ. Code 1798.199.90 - Attorney General civil actions for injunctive relief and civil penalties under the CCPA(leginfo.legislature.ca.gov)
- Cal. Civ. Code 1798.155 - California Privacy Protection Agency administrative fines for CCPA violations(leginfo.legislature.ca.gov)
- Cal. Civ. Code 1798.150 - Private right of action for data breaches, statutory damages, and the 30-day notice and cure provision(leginfo.legislature.ca.gov)