Cal. Civ. Code s. 1798.100 onwards · Consumer privacy law · California, United States
What is the CCPA?
The California Consumer Privacy Act is California's privacy law, operative since 1 January 2020 and amended by the California Privacy Rights Act from 1 January 2023. It applies to for-profit businesses doing business in California that cross a revenue, volume or data-sale threshold, wherever they are based, and is enforced by the California Privacy Protection Agency and the Attorney General.
Sources: California Consumer Privacy Act, Cal. Civ. Code s. 1798.100 to 1798.199.100, text effective 1 January 2026, California Privacy Protection Agency; Frequently asked questions, California Privacy Protection Agency; California Privacy Protection Agency announces 2025 increases for CCPA fines and penalties; California finalizes regulations to strengthen consumers' privacy (cybersecurity audits, risk assessments, ADMT); California Consumer Privacy Act (CCPA), Office of the Attorney General
Key facts
| Who enforces it | The California Privacy Protection Agency (CPPA, now styling itself CalPrivacy), created by Proposition 24 with authority to make rules, investigate, audit and impose administrative fines (s. 1798.155), and the California Attorney General, who brings civil penalty actions (s. 1798.199.90) |
|---|---|
| Dates | Enacted 2018. Operative 1 January 2020 (s. 1798.198(a)). Amended by the California Privacy Rights Act (Proposition 24, approved November 2020), with the amendments operative 1 January 2023 |
| Who it covers | A for-profit entity that does business in California, determines the purposes and means of processing consumers' personal information, and meets any one of three thresholds in s. 1798.140(d)(1): (A) annual gross revenue above USD 25 million, adjusted for inflation to USD 26,625,000 from 1 January 2025; (B) buys, sells or shares the personal information of 100,000 or more consumers or households a year; (C) derives 50 percent or more of annual revenue from selling or sharing consumers' personal information. Entities under common control and branding with such a business are covered too |
| Service providers and contractors | An Indian vendor that processes personal information for a covered business is usually a "service provider" (s. 1798.140(ag)) or "contractor" (s. 1798.140(j)). The written contract must prohibit selling or sharing the data, using it outside the specified business purpose, using it outside the direct relationship, and combining it with data from other sources. The regulations add further required terms |
| Consumer rights | To know what is collected and how it is used and shared; to delete; to correct; to opt out of sale or sharing, including through an opt-out preference signal; to limit use and disclosure of sensitive personal information; and not to be discriminated against for exercising these rights |
| Penalties | Administrative fines (s. 1798.155) and civil penalties (s. 1798.199.90) of up to USD 2,500 per violation and USD 7,500 per intentional violation or violation involving a consumer the business knows is under 16, adjusted for inflation to USD 2,663 and USD 7,988 from 1 January 2025. Consumers may sue after a data breach caused by a failure to keep reasonable security, for USD 100 to 750 per consumer per incident (adjusted to USD 107 to 799), after a 30-day written cure notice (s. 1798.150) |
| New regulations from 2026 | Regulations on cybersecurity audits, risk assessments, automated decisionmaking technology (ADMT) and insurers, approved by the Office of Administrative Law and announced on 23 September 2025, took effect on 1 January 2026. ADMT requirements apply from 1 January 2027. Risk assessment attestations are due by 1 April 2028. Cybersecurity audit certifications are due by 1 April 2028 for businesses with revenue above USD 100 million, 1 April 2029 for USD 50 to 100 million, and 1 April 2030 below USD 50 million |
| Certificate or audit | No certificate. The 2026 regulations require an annual independent cybersecurity audit for businesses whose processing presents significant risk (s. 1798.185(a)(14)), certified to the Agency on the schedule above. |
| Cost in India | Not published yet. Infofacility will post an Indian price range, with what it covers, once it has three comparable quotes. |
| Pairs with | The GDPR (the CCPA borrows the structure but not the lawful-basis model), the DPDP Act 2023, ISO 27701 for the management system, and SOC 2's privacy category, which US customers often ask Indian processors for alongside CCPA contract terms |
Who needs it
- Two kinds of Indian company meet the CCPA. The first sells directly to Californians at a scale that crosses a threshold: a consumer app, an e-commerce or edtech platform, an ad-supported service that buys, sells or shares data on 100,000 or more Californian consumers or households, or a business whose annual gross revenue exceeds USD 26,625,000. Thresholds are measured on the business, not on its California revenue, so a large Indian company with a modest Californian user base can be caught. Such a company is a "business" under s. 1798.140(d) and owes the full set of duties: notices, rights handling, opt-out signals, sensitive-data limits and, from 2026, risk assessments and possibly audits.
- The second, and far larger, group processes personal information for a US customer that is a covered business: IT services, BPO and contact centres, analytics, SaaS. These companies are service providers or contractors under s. 1798.140(ag) and (j). The law reaches them through the contract: the customer must impose the statutory terms, and a service provider that uses the data outside those terms becomes liable in its own right (s. 1798.155 applies to a "business, service provider, contractor, or other person"). In practice the CCPA arrives in an Indian company as a contract addendum and a due-diligence questionnaire.
- The CCPA is a state law, not a US federal one, and nothing in India requires compliance with it. It matters because California is the largest US state market and because US customers write its terms into vendor contracts regardless of where the vendor sits. Indian companies with a GDPR or DPDP programme already have most of the machinery; the CCPA-specific work is the opt-out of sale or sharing, the sensitive personal information limit, the service-provider contract terms and, now, the 2026 regulations.
How it works
Step 1
Check the thresholds
Gross revenue above USD 26,625,000 (2025 figure, adjusted every odd year), 100,000 or more Californian consumers or households whose data you buy, sell or share, or 50 percent or more of revenue from selling or sharing it. If none applies, you are not a "business", but you may still be a service provider.
Step 2
Decide your role for each data flow
Business (you decide purposes and means) or service provider or contractor (you process for a business under contract). An Indian SaaS company is often both: a business for its own marketing data, a service provider for customer data.
Step 3
Fix the contracts
As a service provider, make sure every customer contract carries the s. 1798.140(ag) prohibitions and the terms the regulations require, and flow them down to your own sub-processors. As a business, do the same with your vendors.
Step 4
Publish notices and build the rights process
A privacy policy and a notice at collection that name the categories collected, purposes, retention and whether data is sold or shared. Two or more ways to submit requests, identity verification, and responses within 45 days.
Step 5
Handle opt-outs and sensitive data
A "Do Not Sell or Share My Personal Information" link, honouring opt-out preference signals from browsers, and a "Limit the Use of My Sensitive Personal Information" link where you use sensitive data beyond the permitted purposes.
Step 6
Secure the data
Reasonable security procedures and practices (s. 1798.150); a breach caused by their absence opens the private right of action. The usual evidence US customers ask for is a SOC 2 report or an ISO 27001 certificate.
Step 7
Prepare for the 2026 regulations
Risk assessments for high-risk processing, with attestations due by 1 April 2028; ADMT notices and opt-outs from 1 January 2027; and, for businesses whose processing presents significant risk, an annual cybersecurity audit certified to the Agency from 1 April 2028 onward depending on revenue.
Questions
Does the CCPA apply to an Indian company with no US office?
It can. The law applies to any for-profit business that does business in California and meets a threshold, with no requirement of a US establishment. More often an Indian company is a service provider to a covered US business and is bound by the contract terms the law requires rather than by the statute directly.
Is the CPRA a separate law?
No. The California Privacy Rights Act, Proposition 24 of November 2020, amended the CCPA and created the California Privacy Protection Agency; most of its changes have applied since 1 January 2023. People say CCPA, CPRA or CCPA/CPRA to mean the same amended statute.
How is the CCPA different from the GDPR?
The GDPR needs a lawful basis before you process; the CCPA lets you process but gives consumers the right to know, delete, correct and opt out of sale or sharing. The GDPR applies to any organisation handling EU residents' data; the CCPA applies only to businesses above its thresholds and to their service providers. Fines are per violation rather than a share of turnover.
What changed on 1 January 2026?
The Agency's regulations on cybersecurity audits, risk assessments and automated decisionmaking technology took effect. Businesses whose processing presents significant risk must run risk assessments now and attest to them by 1 April 2028, must comply with the ADMT rules from 1 January 2027, and must certify an annual cybersecurity audit from 1 April 2028, 2029 or 2030 depending on revenue.
Change log
4 Nov 2026 First version.
This page explains the law in plain English. It is not legal advice.
Weekly · Watching 6 regulators