California Consumer Privacy Act (CCPA/CPRA) Reference Guide

The CCPA generally applies to a for-profit entity that does business in California, determines the purposes and means of processing consumers’ personal information, and meets at least one threshold. As of January 1, 2025, the adjusted annual-gross-revenue threshold is more than $26,625,000. The other thresholds are buying, selling, or sharing the personal information of 100,000 or more consumers or households annually, or deriving 50 percent or more of annual revenue from selling or sharing consumers’ personal information. Cal. Civ. Code § 1798.140(d) CPPA adjusted thresholds

The law can also reach certain controlled entities with common branding, qualifying joint ventures or partnerships, and persons that voluntarily certify that they will be bound by the CCPA. Service providers, contractors, and third parties have separate duties when they receive personal information from a business. Cal. Civ. Code § 1798.140(d), (j), (ag), (ai)

A California consumer is a natural person who is a California resident, including employees, job applicants, independent contractors, and business contacts. Personal information can include online identifiers, IP addresses, browsing history, interactions with websites or advertisements, geolocation, commercial information, and inferences when linked or reasonably linkable to a consumer or household. Cal. Civ. Code § 1798.140(i), (v)

The CCPA generally does not apply to nonprofit organizations or government agencies, but the statute also contains entity-level and data-level exemptions. Examples involve information subject to specified medical, financial, credit-reporting, motor-vehicle, education, and research laws. An exempt data category does not necessarily exempt every activity of the organization holding it. Cal. Civ. Code § 1798.145

Applicability depends on the entity, the consumer relationship, the data involved, the processing purpose, and the contracts between parties. Qualified privacy counsel should decide whether an exemption applies.

The CPRA expanded the CCPA rather than replacing it. Covered businesses need more than a privacy policy: they need request workflows, purpose and retention controls, contract terms, security measures, and technical systems that carry a consumer’s choice into every relevant use and disclosure. CPPA FAQ

California treats many forms of online activity data as personal information when they identify, relate to, describe, or are reasonably linkable to a consumer or household. The statutory examples include online identifiers, IP addresses, browsing history, search history, and interactions with a website, application, or advertisement. Cal. Civ. Code § 1798.140(v)

A “sale” includes making personal information available to a third party for monetary or other valuable consideration, subject to statutory exceptions. “Sharing” specifically includes making personal information available to a third party for cross-context behavioral advertising, even when no money is exchanged. Cal. Civ. Code § 1798.140(ad), (ah)

That makes actual website behavior important. Advertising pixels, real-time bidding, remarketing tags, session replay, analytics, attribution, chat, embedded media, and hard-coded scripts can disclose identifiers and page activity before a form is submitted. A network request is not automatically a sale or sharing; the classification depends on the data, recipient, purpose, consideration, contract, and applicable exception.

The CCPA does not categorically prohibit Google, Meta, analytics, or other third-party tools. It requires covered businesses to classify and disclose their processing accurately, use appropriate contracts, and make the required consumer choices work in practice.

A visitor can click an opt-out link while a tag continues to transmit data. A consent platform can record “Reject” while a hard-coded pixel bypasses it. An account-level choice can be applied to one device but not another. A GPC signal can reach the browser but never reach the advertising rule that should respond.

California’s enforcement record makes that gap concrete. The Healthline settlement alleged that a consent banner did not disable tracking cookies as represented. The Disney settlement alleged that opt-outs failed across connected devices, services, and embedded third-party ad technology. California Attorney General: Healthline settlement California Attorney General: Disney settlement

A business that sells or shares personal information must process a qualifying opt-out preference signal as a valid request to opt out of sale or sharing. Global Privacy Control is the best-known implementation. The signal applies to the browser or device and associated consumer profiles; when the consumer is known, it also applies to the consumer, including the account and relevant offline sale or sharing. CCPA Regulations § 7025

The business may not require the consumer to provide additional information just to process the browser or device signal. If the consumer does not supply optional identifying information, the business must still apply the opt-out to the browser or device and associated profiles. A conflicting business-specific setting does not cancel the signal unless the consumer later provides valid consent. CCPA Regulations § 7025(c)

Under the regulations effective January 1, 2026, a business must display whether it processed the opt-out preference signal and provide a means for a consumer to confirm that an opt-out request was processed. A visible message such as “Opt-Out Request Honored” is one regulatory example. CCPA Regulations §§ 7025(c)(6), 7026(g)

The California Privacy Protection Agency may bring administrative enforcement actions, and the California Attorney General continues to bring civil enforcement actions. The adjusted maximum administrative penalties are $2,663 per violation and $7,988 per intentional violation or qualifying violation involving personal information of a consumer known to be under 16. The statute does not provide a general mandatory cure period for these enforcement actions. Cal. Civ. Code § 1798.155 CPPA adjusted thresholds

The CCPA creates a limited private right of action for specified security breaches involving nonencrypted and nonredacted personal information, including certain compromised account credentials, when the breach results from a failure to maintain reasonable security. Adjusted statutory damages are $107 to $799 per consumer per incident or actual damages, whichever is greater. The private-action provision includes a 30-day written-notice process for statutory damages when a cure is possible; it is not a general cure period for every CCPA violation. Cal. Civ. Code § 1798.150

The legal and technical layers should inform each other, but they are not the same job. A website scan cannot decide statutory applicability. A privacy policy cannot prove that an opt-out actually reaches the tracking stack.

Use separate browser sessions to compare the site’s initial behavior, its response to a direct opt-out, and its response to Global Privacy Control where relevant to your review. Record the page URL, test time, browser settings and exact choice made so the result can be reproduced.

Inspect cookies and network requests before and after each choice. Record which requests continue, their destinations and the controls involved. Browser evidence can help diagnose an implementation; it cannot establish statutory applicability, the legal purpose of every transfer or organization-wide compliance.

Legal interpretation, applicability, exemptions, privacy notices, vendor contracts, consumer-rights procedures, sensitive-information obligations, risk assessments, and organizational governance should be handled by qualified privacy counsel.

This page is written from primary California sources. Material legal statements link to the California Civil Code, the regulations effective January 1, 2026, or official publications from the California Privacy Protection Agency and California Attorney General. Secondary sources are not treated as authority for the law.

Prepared by Etalon Editorial Team. Last reviewed September 27, 2026. Material corrections may be sent to contact@etalondata.com.

Etalon is not a law firm and does not provide legal advice. A passing scan or certificate does not guarantee that an organization satisfies every legal obligation.

Technical testing records the technical tracking layer: privacy state, browser privacy signals, cookies, scripts, tags, network requests, and observable post-choice behavior. Your legal and privacy team remains responsible for legal interpretation, applicability and exemptions, notices and disclosures, contracts, consumer-rights operations, sensitive-information obligations, risk assessments, cybersecurity audits, automated-decisionmaking governance, and organization-wide compliance.