Regulations library · US states
CCPA/CPRA
California Consumer Privacy Act, as amended by the California Privacy Rights Act
In force California privacy consumer rights
The most detailed US state privacy law and the only one with a dedicated privacy regulator. It covers employee and business-to-business data, requires opt-outs from selling and sharing, and has its own regulations on automated decision-making.
At a glance
- Who it applies to
- For-profit businesses doing business in California that meet one threshold: annual gross revenue above $26,625,000 (inflation-adjusted), buying, selling or sharing personal information of 100,000 or more consumers or households, or earning half or more of revenue from selling or sharing personal information.
- Who enforces it
- California Privacy Protection Agency and Attorney General
- When
- In effect since 1 January 2020. CPRA amendments took effect 1 January 2023. CPPA regulations on automated decision-making, risk assessments and cybersecurity audits took effect 1 January 2026 with phased compliance dates.
A practical guide to this law, with scenarios and flashcards, is being written. The summary above is the reference entry.
Recent developments
Nothing reported yet. Regulatory Watch lists new rules, enforcement and court decisions as they arrive.
Sources
- All of the comprehensive privacy laws that take effect in 2026 MultiState · Law firm or analyst
- US state privacy laws comparison (24 enacted laws, effective dates) Recording Law · Law firm or analyst
Dates and status checked against these sources on 27 September 2026. This page explains the law for practitioners; it is not legal advice.