--------------------------- Title: What Is the CCPA? Definitions, Key Rights, and Compliance Requirements URL: https://www.cookiebot.com/en/what-is-ccpa/ --------------------------- # What Is the CCPA? Definitions, Key Rights, and Compliance Requirements ## At a Glance - The CCPA gives California consumers the right to know, delete, and correct their personal information, and to opt out of its sale or sharing. - It applies to for-profit businesses that meet a revenue, data-volume, or data-sale threshold, wherever the business is based. - The CCPA follows an opt-out model: unlike the GDPR, it does not require prior consent for most processing, but businesses must honor opt-out requests and signals such as Global Privacy Control. - Businesses must provide a notice at collection, a privacy policy, and at least two ways to submit requests. - From January 1, 2027, new rules cover automated decision-making technology (ADMT). SB 923 widens the right to delete and requires online-only businesses to offer a web form or portal, and SB 690 limits one type of private CIPA website-tracking lawsuit. - Fines currently run up to USD 2,663 per violation and USD 7,988 per intentional violation, plus USD 107 to USD 799 per consumer per incident in data breach claims. The California Consumer Privacy Act (CCPA) is a state privacy law that grants California residents rights over their personal data, including the right to know what data is collected, the right to delete it, and the right to opt out of its sale. On January 1, 2020, California became the first state to enact a data privacy law to empower its residents with ownership over their personal information and change the way businesses handle this personal information. We look at the California privacy law, what it means for your business and website, and steps you can take toward achieving and maintaining compliance. ## What Is the CCPA and Why Does It Matter? The California Consumer Privacy Act (CCPA) is the first comprehensive modern data privacy law in the United States, and came into effect January 1, 2020. The CCPA has been influential on privacy laws subsequently passed in other states. Passed in response to growing public concern about how businesses collect and use personal information, the CCPA gave California residents new rights over their data and placed significant new obligations on the businesses that handle it. The full text of the CCPA is available at the [California Legislative Information website](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5). CPPA regulations and enforcement actions are published at [cppa.ca.gov](https://cppa.ca.gov/). ## What Is the CPRA? The [California Privacy Rights Act (CPRA)](https://www.cookiebot.com/en/cpra/) amended and expanded the CCPA, enhancing consumer privacy rights for the state’s residents — including the right to correct inaccurate data — tightening requirements for businesses that collect and share personal information, and creating the California Privacy Protection Agency (CPPA) as an independent enforcement body. The CPRA took effect on January 1, 2023. A court stay delayed enforcement of the Agency’s regulations in 2023, and an appeals court restored the Agency’s authority on February 9, 2024. ## Who Does the CCPA Protect? The CCPA, as amended by the CPRA, protects the state’s nearly 40 million residents, known as consumers under the law. A consumer is a natural person who is either: - In the state for other than a temporary or transitory purpose or - Domiciled in the state, but temporarily outside of the state, such as on vacation or business trip It is not enough to simply be located in the state when having one’s data collected — individuals must meet the definition of California resident under the law. Those who are simply passing through, visiting on vacation, or in the state to complete a particular transaction or perform a particular contract are considered to be in the state *for temporary or transitory purposes* and are not protected by the CCPA/CPRA. This definition is likely to evolve over time, particularly based on case law resulting from lawsuits relating to alleged violations. The CCPA/CPRA protects the personal information of California residents even when they are temporarily outside the state. ## Is Your Business Covered by the CCPA? The CCPA/CPRA applies to for-profit businesses that operate in California and collect the personal information of its residents, if they meet at least one of the following thresholds: - Buy, sell, or share the personal information of 100,000 or more consumers or households - Have gross annual revenue exceeding USD 26,625,000 (adjusted every other year for inflation, next adjustment due in 2027) - Derive 50 percent or more of their annual revenue from selling or sharing consumers’ personal information The CCPA/CPRA has extraterritorial application, meaning that a business located in another US state, or even outside the US, must comply with the law if it meets one of these conditions. Additionally, if your business shares common branding with a company that meets one of the above mentioned thresholds, your business will be subject to [CCPA compliance](/en/ccpa-compliance/). Common branding means that a business shares a name, service mark, or trademark with another business. Interestingly, a number of more recently passed state-level privacy laws in the US do not include the revenue-only threshold. ## What Is Personal Information Under the CCPA? The CCPA/CPRA law defines [personal information](https://www.cookiebot.com/en/ccpa-personal-information-ccpa-compliance-with-cookiebot-cmp/) (known as personal data under some laws) as *“information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”* Personal information under the CCPA/CPRA includes: - *Direct identifiers*, such as real name, alias, postal address, email address - *Unique identifiers*, such as cookies, IP addresses, beacons, pixel tags - *Biometric data*, such as face, retina, fingerprints, and voice recordings - *Precise geolocation data* used to accurately identify a person within a radius of 1850 feet (563 meters) - *Internet activity*, such as browsing history, search history, data on interaction with a web page or app - *Sensitive personal information*, such as Social Security number, racial or ethnic origin, citizenship or immigration status, genetic data, financial information Personal information also includes data that by inference can lead to the identification of an individual or a household. Aggregate and anonymous data is exempt from the CCPA/CPRA, unless it is in any way re-identifiable. ## Do you know what your site is tracking? Scan your site for free and see what cookies and trackers are active. Get your customized report in minutes and start closing compliance gaps. [Start Scan](https://www.cookiebot.com/en/cookie-checker/) ## What Does the CCPA Say About Cookies? [Cookies](https://www.cookiebot.com/en/ccpa-cookies/) and other[ website tracking](https://www.cookiebot.com/en/website-tracking/) technologies are classified as unique identifiers that form part of the CCPA's definition of personal information. Cookies are one of the most commonly used technologies for websites to collect personal information on end users. First-party cookies, set by the website itself, often collect anonymous data for core website functions. They are deleted once a user closes the browser. Third-party cookies, like those set by tech companies, ad networks, and social media platforms, often collect a lot of personal — and sometimes sensitive — information on consumers. Data collected on your website through cookies can ultimately be considered personal information under the CCPA/CPRA. This information might not in itself constitute personal information, e.g. anonymized analytics data, but it can become personally identifying by inference or in combination with other data, for the purpose of identifying and connecting devices, creating profiles, or serving personalized ads. ## CCPA Consumer Rights: What Your Visitors Can Ask You to Do The CCPA/CPRA sets up a legal framework whereby California residents can claim ownership of their data. It also requires organizations that do business in California to provide visitors with easy ways of exercising their [CCPA rights](https://www.cookiebot.com/en/ccpa-rights-for-consumers-ccpa-compliance-with-cookiebot-cmp/). The CCPA/CPRA empowers consumers with the following rights. Organizations that meet any of the CCPA/CPRA compliance thresholds are liable for personal information collected on California residents via their website's cookies, if the information is sold or shared. With the CPRA, consumers are now also able to opt out of collection and use of their data for targeted advertising or profiling purposes. **Right****Description****Applies To**Right to opt outConsumers can opt out of the sale or sharing of their personal information to third parties at any time.Applies to the sale or sharing of personal information with third parties.Right to limitConsumers can restrict how businesses use and disclose their sensitive personal information.Applies to sensitive personal information, such as Social Security numbers, precise geolocation, and racial or ethnic origin.Right to know and accessConsumers can request details of the personal information a business has collected about them, including the sources, purposes, and third parties it has been shared with.Applies to personal information collected about a consumer in the past 12 months and, if the business keeps it longer, earlier periods back to January 1, 2022.Right to request deletionConsumers can request that a business delete the personal information it has collected from them, subject to certain exceptions.Applies to personal information collected from the consumer and, from January 1, 2027, personal information collected about the consumer from other sources, such as data brokers, subject to certain exceptions.Right to correctionConsumers can request that inaccurate or incomplete personal information held by a business be corrected.Applies to inaccurate or incomplete personal information held by a business.Right to know about sale or sharingConsumers can request to know what personal information is being sold or shared, and to whom.Applies to personal information that is sold or shared with third parties for commercial purposes.Right to opt out of automated decision-making technology (ADMT)From January 1, 2027, consumers can opt out of the use of ADMT to make significant decisions about them, subject to exceptions.Applies to significant decisions such as those about employment, lending, housing, education, or healthcare.Right to non-discriminationConsumers cannot be penalized for exercising their CCPA/CPRA rights, such as being denied service or charged different prices.Applies to all consumers who choose to exercise any of their rights under the CCPA/CPRA. ## What Does the CCPA Require of Your Business and Website? If your business meets any of the three CCPA/CPRA thresholds, you are required to comply with the obligations under the law. ### How Do I Make My Website CCPA-Compliant? CCPA compliance for your website centers on giving California residents visibility and control over their personal information. In practice, that means a few core obligations. Your website must display a "Do Not Sell Or Share My Personal Information" link, and if you handle sensitive personal information, a "Limit The Use Of My Sensitive Personal Information" link. Both must be easy for consumers to find and use. You must also provide a notice at or before the point of data collection, informing visitors of what you collect and why. Beyond that, you need a privacy policy that reflects your actual data practices, at least two methods for consumers to submit rights requests, and processes in place to respond to those requests within the required time frames, which is 15 business days for opt-out requests, and 45 days for requests to access, correct, or delete personal information. ### CCPA Rules and Requirements for Consent The CCPA/CPRA operates under an opt-out consent model, meaning that in most cases, you don’t need to obtain prior consent from visitors before collecting their personal data through cookies or other tracking technologies. However, there is an exception for the personal information of consumers under age 16. If your website has visitors or customers who are minors under the age of 16, you are required to obtain their opt-in (consent) before you can sell or disclose their personal information to third parties. If the minor is under the age of 13, a parent or legal guardian must consent for them. The California privacy law grants consumers the right to opt out of the sale or sharing of their personal information, and to limit the use or disclosure of sensitive personal information. ### Opt-Out Links and Signals: What Your Website Must Offer If your business sells or shares consumers’ personal information, your website must feature a link titled “Do Not Sell Or Share My Personal Information,” which consumers can use to make an opt-out request. (“Or Share” was added when the CPRA came into effect.) If such a request is received, you are prohibited from selling or sharing the consumer’s personal information, and must cease those activities if they are already in progress. Similarly introduced with the CPRA, if your business uses or discloses consumers’ sensitive personal information, your website must feature a link titled “Limit The Use Of My Sensitive Personal Information,” which consumers can use to limit its use or disclosure. You may use a single link for both purposes if consumers can exercise their right to both — to opt out of sale/sharing/targeted advertising/profiling and limit the use/disclosure of sensitive information — effectively from one link. The law defines sale as *“selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for monetary or other valuable consideration.”* Your business must respect universal opt-out mechanisms, such as [Global Privacy Control (GPC)](https://usercentrics.com/knowledge-hub/what-is-global-privacy-control/) signals, that consumers may use to set their consent preferences once, typically via their browser settings or a browser plugin, which are then communicated automatically across various websites and online services. Since January 1, 2026, your website must also display whether it has processed a consumer’s opt-out preference signal, for example with an “Opt-Out Request Honored” message. From January 1, 2027, browsers serving California consumers must also offer a built-in setting to send these signals (AB 566), so expect to see more of them. ### CCPA Notice at Collection Requirements for Websites Your website must inform visitors at or before the point of data collection about the categories of personal information that it collects, including any sensitive personal information, for what purposes, and whether you sell or share consumers’ personal information. If you sell or share personal information, you must include a “Do Not Sell Or Share My Personal Information” link in the notice at collection. The notice at collection must also link to your business’s privacy policy. ## CCPA? CIPA? COPPA? What regulations apply? Use our free tool to determine what privacy requirements you should be looking at. Get information relevant to your business about regulatory enforcement and litigation. [Find My Regulations](https://www.cookiebot.com/us/regulations-finder/?step=1) ### What Are the CCPA Privacy Policy Requirements? Your business must publish a privacy policy that includes: - Description of consumers' rights and how to exercise them - Annually updated list of the categories of personal information that your business collects, sells, and/or discloses, including through the use of cookies - Categories of sources from which your business collects personal information - Business or commercial purpose for collecting, selling, or sharing personal information - Categories of third parties to whom your business discloses personal information - Categories of personal information that your business has disclosed to service providers and contractors in the preceding 12 months, or a statement that your business has made no such disclosures Your privacy policy may contain a section detailing your website’s use of cookies and other trackers, or you can create a separate [cookie policy](https://www.cookiebot.com/en/cookie-policy/) with this information. Businesses usually link to their privacy policy where consumers can easily find it on their website, often in the footer at the bottom of the page, or from a consent banner. ## All privacy laws require providing visitors with up to date information Use the Cookiebot™ Privacy Policy Generator for free to create a custom CCPA privacy policy that reflects your data practices and regulatory requirements. [Generate Free Policy](https://www.cookiebot.com/en/privacy-policy-generator/) ### Handling Consumer Rights Requests: Methods, Deadlines, and Verification Consumer rights requests under the California privacy law must be verifiable before your business has to provide the information. Your business must make available two or more methods for consumers to submit requests and must disclose the required information, correct inaccurate personal information, or delete consumers' personal information within 45 days of receiving the verifiable request. An extension of 45 days may be taken when reasonably necessary and you must inform the consumer of the extension within the first 45-day period. From January 1, 2027, a business that operates exclusively online and has a direct relationship with consumers must offer an email address and an online method, such as a web form or portal, for these requests. If you keep personal information for longer than 12 months, consumers can also request information collected before that period, back to January 1, 2022. You may not require Californian consumers to create a new account to make a request, but they can be required to use an existing account to verify their identity. The CCPA/CPRA prohibits discrimination against consumers based on their choice to exercise their rights. This means that if a consumer chooses to opt out of the selling of their data to third parties, or if they request their data deleted, you cannot charge different prices for services, provide different levels or quality of services, or deny service. However, the CCPA does authorize businesses to offer financial incentives, e.g. different prices and quality of service, for the collection, sale, or deletion of personal information, if the differences are reasonably related to the value provided to the business by the consumer’s data. ### What Are the CCPA Requirements for Data Minimization? Under the CCPA/CPRA, businesses must collect, use, store, and share consumers’ personal information only to the extent necessary to fulfill the original purpose for which the information was collected, or for another compatible purpose. You may not process consumers’ personal information in ways that conflict with these original purposes. This principle of data minimization also applies when collecting data through cookies and other tracking technologies. You may only use[ tracking cookies](https://www.cookiebot.com/en/tracking-cookies/) to collect data that is necessary for the specified purposes and must inform consumers about the use of such technologies in your cookie policy. ## What Could CCPA Non-Compliance Cost Your Business? The enforcement of the CCPA/CPRA lies with both the California Attorney General and CalPrivacy. To date, California is the only U.S. state with two enforcement bodies. In all other states with privacy laws, enforcement falls solely under the attorney general's office. Importantly, while the CPPA has enforcement authority, it cannot limit the Attorney General's authority and must stay any actions or investigations if the Attorney General requests it. Businesses cannot be penalized by both the CPPA and the Attorney General for the same violation. The penalties for noncompliance with the CCPA/CPRA can be substantial: - Up to USD 2,663 for each violation - Up to USD 7,988 for each intentional violation and each violation involving consumers the business knows are under 16 Fines are adjusted every two years for inflation. If a business commits multiple CCPA/CPRA violations, the fines can accumulate quickly, leading to significant financial repercussions. CCPA/CPRA fines are up to USD 2,663 per violation and USD 7,988 per intentional violation, and statutory damages range from USD 107 to USD 799 per consumer per incident (or actual damages, if greater) in cases of data breaches. Both sets of figures are adjusted for inflation every other year. Unlike most state privacy laws, the CCPA includes a limited private right of action for certain data breaches. Consumers must give businesses 30 days to cure any violations stemming from a data breach before they can take legal action. When the CCPA first went into effect, the 30-day cure period also applied to actions brought by the Attorney General/CPPA. This has now sunset. ## What CCPA Changes Take Effect on January 1, 2027? Four changes to the CCPA take effect on January 1, 2027, and each affects how a business handles requests, signals, or automated tools. - **ADMT rules:** If you use automated decision-making technology (ADMT) to make significant decisions about consumers, such as decisions about employment, lending, housing, education, or healthcare, you must give notice before using it and offer an opt-out, subject to exceptions. - **Broader right to delete (SB 923):** Consumers can ask you to delete personal information you collected “from or about” them, which includes data you received from third parties, such as data brokers. For that data, you can meet the request by keeping a record of it and the minimum data needed to keep the information deleted. - **Online request method (SB 923):** If your business operates exclusively online and deals directly with consumers, you must offer an online method, such as a web form or portal, in addition to an email address. - **Browser opt-out signals (AB 566):** Browsers that serve California consumers must include a setting that lets consumers send an opt-out preference signal, such as Global Privacy Control, to every website they visit. This duty falls on browser makers, not website owners. Your existing duty to honor these signals does not change, but you may receive them more often. Governor Newsom signed SB 923 on September 27, 2026, and it amends the CCPA itself. The CIPA change from SB 690, which also starts on January 1, 2027, is covered in the next section. ## CIPA Lawsuits and the CCPA: What Website Owners Should Know The [California Invasion of Privacy Act (CIPA)](https://www.cookiebot.com/us/cipa-california-invasion-of-privacy-act/) is a separate, older California statute that is not part of the CCPA/CPRA framework, but it is increasingly relevant to the same website operators. Originally a wiretapping law, CIPA has been used in a wave of lawsuits arguing that common website tracking technologies, such as session replay tools, live chat widgets, and analytics pixels, amount to unlawful wiretapping or the unauthorized use of a “pen register” or “trap and trace” device. CIPA carries statutory damages of USD 5,000 per violation and, unlike the CCPA/CPRA, whose private right of action is limited to certain data breaches, allows private lawsuits over website tracking. This has made it attractive to plaintiffs’ firms sending [demand letters](https://www.cookiebot.com/us/understand-and-respond-to-cipa-demand-letter/). Governor Newsom signed SB 690 on September 30, 2026. Starting January 1, 2027, only the Attorney General can bring claims under CIPA’s pen register and trap-and-trace provision (Penal Code § 638.51) over conduct on a website, online application, or mobile application, and the change reaches pending claims in actions filed on or after January 1, 2025. The underlying conduct is not made lawful, and CIPA’s wiretapping and eavesdropping provisions (Sections 631 and 632) still allow private lawsuits. ## CCPA Compliance Checklist for Websites Here is a non-exhaustive CCPA compliance checklist for your website that covers the central points of the CCPA requirements. 1. Provide “[Do Not Sell Or Share My Personal Information](https://usercentrics.com/guides/website-disclaimers/do-not-sell-my-personal-information/)” and, if you use or disclose sensitive personal information, a "[Limit The Use Of My Sensitive Personal Information](https://usercentrics.com/guides/website-disclaimers/limit-the-use-of-my-sensitive-personal-information/)" link on your website in accessible locations so consumers can use to opt out of third-party data sales/sharing and use/disclosure of sensitive personal information. 2. Provide a [notice](https://www.cookiebot.com/en/cookie-notice/) at or before the point of collection informing consumers of the categories of personal information (including sensitive personal information) your business collects, for what purposes, and whether it shares or sells the personal information. 3. Stop selling and sharing a consumer’s personal information within 15 business days of an opt-out request, and notify third parties who received it between the request and your compliance that the consumer has opted out. 4. Obtain opt-in consent from minors age 13 to 16 and from parents or legal guardians of minors under the age of 13 before selling or sharing their personal information. 5. Provide consumers with covering the past 12 months and, if you keep personal information longer, earlier periods back to January 1, 2022 — including sources, commercial purposes, and categories of third parties with whom it has been shared — if a consumer requests disclosure or deletion. This is for a reasonable number of requests by a consumer annually, and excessive requests can be denied. 6. Confirm receipt of requests to know, delete, and correct within 10 business days, and respond within 45 calendar days. 7. Establish at least two methods for consumers to exercise their rights, such as a toll-free phone number, email address, or web form. Online-only businesses must also offer a web form or portal from January 1, 2027. 8. Only offer financial incentives (e.g. different prices, rates, and quality) for goods and services if the differences are reasonably related to the value that the consumer’s data brings to the business. 9. Refrain from discriminating against consumers who choose to exercise their rights under the law, particularly opting out of data collection and processing. Your CCPA privacy policy must also meet the requirements listed under “What Are the CCPA Privacy Policy Requirements?” above. ## How Does Cookiebot™ by Usercentrics Support CCPA Compliance Requirements? [Cookiebot CMP](https://www.cookiebot.com/) supports ongoing CCPA compliance by automatically scanning your website, finding all cookies and similar tracking technologies in use, and can automatically block them if visitors opt out. This supports compliance with both the CCPA and the European Union’s [General Data Protection Regulation (GDPR)](https://www.cookiebot.com/en/gdpr/). Cookies, especially those from third parties embedded through plugins, can harvest personal information such as names, physical addresses, IP addresses, and location data, but also sensitive personal data such as religious convictions, political opinions, and/or sexual orientation. The CCPA requires that businesses enable California residents to opt out of having their personal information sold to third parties, as well as disclosing what data has already been collected and deleting it, if consumers request it. [Cookiebot™ CMP](https://www.cookiebot.com/) supports compliance with the CCPA with a specific configuration that detects whether a user is from California, and then displays the required “Do Not Sell Or Share My Personal Information” link on the website’s[ cookie banner](https://www.cookiebot.com/en/cookie-banner/). You can also address the CCPA/CPRA requirement to inform visitors about personal information processing at or before the point of data collection by using a cookie banner or[ cookie notice](https://www.cookiebot.com/en/cookie-notice/) to display your notice at collection. ## How Does the CCPA Compare to the CPRA? The [California Privacy Rights Act (CPRA)](https://www.cookiebot.com/en/cpra/) is best understood as an upgrade to the CCPA rather than a separate law. It amended and expanded the CCPA, and the two now operate together as a single, strengthened framework. The key changes the CPRA introduced: - **New consumer rights:** Consumers can correct inaccurate personal information. The CPRA also directed the Agency to write rules on automated decision-making, which give consumers an ADMT opt-out from January 1, 2027. - **Sensitive personal information:** The CPRA created a distinct category for sensitive data — including Social Security numbers, precise geolocation, and racial or ethnic origin — giving consumers the right to limit its use and disclosure. - **Data minimization:** Businesses must limit their collection and use of personal information to what is reasonably necessary for the stated purpose. - **New enforcement body:** The [California Privacy Protection Agency (CPPA)](https://www.cookiebot.com/en/escalating-cppa-enforcement/), publicly known as CalPrivacy, was established to enforce California's privacy laws alongside the Attorney General. - **Adjusted thresholds:** The annual threshold for the number of consumers whose data a business buys, sells, or shares was raised from 50,000 to 100,000. The CPRA took effect on January 1, 2023. A court stay delayed enforcement of the Agency’s regulations in 2023, and an appeals court restored the Agency’s authority on February 9, 2024. ## California Privacy Law and the GDPR When comparing the CCPA/CPRA to the GDPR, it becomes clear that though there are similar intentions and provisions, the two data privacy laws are very different. ### CCPA vs. GDPR: Who is Protected? Where the GDPR protects anyone in the European Union/European Economic Area (EU/EEA), the CCPA only protects California residents. It is not enough to be located in the state at the time of collection or processing. Under the CCPA/CPRA, protected consumers are California residents: people in the state for other than a temporary or transitory purpose, or domiciled in California and temporarily outside it. ### CCPA vs. GDPR: What Are the Consent Requirements? The GDPR requires a valid legal basis before personal data is processed. Consent is the basis most often relied on for cookies, and prior consent is required before non-essential cookies are set, including[ cookie consent](https://www.cookiebot.com/en/cookie-consent/). Under the CCPA, a business does not need prior consent to handle personal information, nor does a website need to obtain user consent to sell consumers’ data to third parties, with the exception of minors’ data. ### CCPA vs. GDPR: What Are the Compliance Thresholds? The CCPA/CPRA contains specific thresholds that a for-profit business must meet for the law to apply, based on annual revenue, volume of personal information handled, or percentage of revenue from sale of personal data. The GDPR contains no such threshold and applies to any entity that processes the personal data of individuals located in the EU/EEA. This includes nonprofits and government agencies, which are exempt from CCPA/CPRA compliance. ### CCPA vs. GDPR: What Are the Legal Bases? The GDPR permits the collection of personal data only if one of six legal bases applies, namely consent, to perform a contract, legal obligation, to protect vital interests, in the public interest, or legitimate interest. The CCPA/CPRA does not require any specific legal basis for collecting personal information. ### CCPA vs. GDPR: What Are the Potential Fines? GDPR fines are substantial and are among the highest penalties for data protection violations globally. They can reach up to 2 percent of annual turnover or EUR 10 million, whichever is higher, for certain violations; and up to 4 percent of annual turnover or EUR 20 million, whichever is higher, for more serious violations. In contrast, CCPA/CPRA fines are up to USD 2,500 per unintentional violation and USD 7,500 (adjusted periodically for the Consumer Price Index) per intentional violation, and statutory damages for data breach. However, each individual’s personal information counts as a separate violation, and CCPA civil penalties can quickly add up. Additionally, statutory damages ranging from USD 100 to USD 750 (adjusted periodically for the Consumer Price Index, or actual damages suffered, may be applicable in cases of data breaches. ### CCPA vs. GDPR: What Are the Key Differences? The CCPA and the GDPR share a common goal to protect individuals' personal information, but they differ significantly in scope, structure, and approach. The GDPR applies to any organization processing the personal data of individuals in the EU/EEA, regardless of where the organization is based or its size. The CCPA applies only to for-profit businesses that meet specific revenue or data volume thresholds and operate in California. The most significant practical difference is consent. The GDPR requires a valid legal basis, and consent is required for many activities, including use of non-essential cookies. The CCPA operates on an opt-out model — businesses can collect and use personal information unless a consumer actively requests otherwise. Penalties also differ in scale. GDPR fines can reach tens of millions of euros or a percentage of global annual turnover. CCPA/CPRA fines are assessed per violation, but can accumulate significantly depending on the number of consumers affected. ## Be prepared for evolving privacy requirements for California visitors Cookiebot™ by Usercentrics enables you to provide geotargeted privacy information and consent experiences to visitors across the U.S. and globally. Easy to set up, with automatic updates as laws change. Try it free for 14 days. [Start free trial](https://admin.cookiebot.com/signup?lang=en&cur=EUR) ## Frequently asked questions ### Why was the CCPA introduced? The CCPA was introduced to empower California residents with ownership over their personal information and to change how businesses handle this data, establishing privacy as an inalienable right. ### When did the CCPA go into effect? The CCPA went into effect on January 1, 2020. The CPRA, which amends and expands the CCPA, took effect on January 1, 2023. A court stay delayed enforcement of the Agency’s regulations in 2023, and an appeals court restored the Agency’s authority on February 9, 2024. The ADMT rules and the SB 923 changes to the right to delete and online request methods begin on January 1, 2027. ### What is the CCPA threshold? The CCPA/CPRA applies to for-profit businesses that meet any one of the following thresholds: Have annual gross revenue over USD 26,625,000 (adjusted every two years for inflation, next adjustment due in 2027) Buy, sell, or share the personal information of 100,000 or more consumers or households annually Derive 50 percent or more of their revenue from selling or sharing consumers’ personal information ### What are consumers’ CCPA data privacy rights? Consumers have the right to opt out of data sale or sharing, limit the use of sensitive personal information, access their personal information, correct inaccuracies, request deletion of their data, know what information is sold or shared, and not be discriminated against for exercising their rights. From January 1, 2027, they can also opt out of automated decision-making technology (ADMT) used for significant decisions, and the right to delete also covers personal information a business collected about them from other sources, such as data brokers. ### How can businesses comply with the CCPA's opt-out requirements? Businesses must feature a link titled “Do Not Sell Or Share My Personal Information” on their websites and in their notice at collection, enabling consumers to easily opt out of data sales or sharing. They must also honor opt-out preference signals, such as Global Privacy Control, and stop selling and sharing within 15 business days of an opt-out request. ### What is CCPA compliance? CCPA compliance involves consistently meeting the requirements set forth in the CCPA, including providing consumers with rights to access, correct, and delete their personal information, as well as implementing necessary privacy policies and practices, such as notification at the point of data collection. ### What are the penalties for non-compliance with the CCPA? Fines and civil penalties for non-compliance with the CCPA/CPRA can reach up to USD 2,663 per violation and USD 7,988 per intentional violation or violation involving consumers the business knows are under 16. Additionally, consumers can seek statutory damages of USD 107 to USD 799 per consumer per incident, or actual damages, whichever is greater, as well as injunctive relief, after certain data breaches. Fines are adjusted every two years for inflation, with the next adjustment due in 2027. ### What is CCPA website compliance? CCPA website compliance refers to the measures that businesses must implement on their websites to comply with the CCPA/CPRA. This includes providing clear notices at the point of data collection, featuring opt-out links for consumers to manage their personal information, and maintaining a privacy policy that outlines CCPA consumer rights and data usage. Compliance also involves disclosing tracking technologies, like cookies, appropriately. ### Does CIPA affect CCPA compliance? CIPA is a separate California law, not part of the CCPA/CPRA, but it is increasingly relevant to the same businesses because plaintiffs have used it to sue over website tracking technologies. Meeting CCPA/CPRA requirements does not protect a business from CIPA claims, since the two laws impose different obligations and different penalties. SB 690, effective January 1, 2027, limits private lawsuits over website tracking under CIPA’s pen register provision, but wiretapping claims remain available. *Usercentrics does not provide legal advice, and information is provided for educational purposes only. We always recommend engaging qualified legal counsel or privacy specialists regarding data privacy and protection issues and operations.* ## Summary The CCPA gives California residents the right to opt out of data sales, limit sensitive data use, and request deletion of their information. This guide explains who the law applies to, what counts as personal information, and the practical steps site owners need to take, including notices, opt-out links, and the changes taking effect in 2027. --- ## Footer ### Products - [Cookiebot™ Consent Solution](https://www.cookiebot.com/en/cookie-consent-solution/) - [Audience Survey](https://www.cookiebot.com/en/audience-survey-add-on/) - [Usercentrics for Wix](https://www.cookiebot.com/en/cookiebot-for-wix-by-usercentrics-app/) - [Usercentrics Cookiebot plugin for WordPress](https://www.cookiebot.com/en/new-wp-cookie-plugin/) - [Cookiebot CMP for Shopify](https://www.cookiebot.com/en/cookiebot-cmp-for-shopify/) - [Cookie checker](https://www.cookiebot.com/en/cookie-checker/) - [Usercentrics products](https://usercentrics.com/) - [Pricing](https://www.cookiebot.com/en/pricing/) ### Regulations - [DMA (EU)](https://www.cookiebot.com/en/digital-markets-act-dma/) - [GDPR (EU)](https://www.cookiebot.com/en/gdpr/) - [CCPA (California)](https://www.cookiebot.com/en/what-is-ccpa/) - [VCDPA (Virginia)](https://www.cookiebot.com/en/virginia-vcdpa/) - [LGPD (Brazil)](https://www.cookiebot.com/en/lgpd/) - [TCF v2.4 (IAB)](https://www.cookiebot.com/en/tcf/) - [Google Consent Mode (EU)](https://www.cookiebot.com/en/cookiebot-cmp-google-consent-mode/) - [Microsoft UET Consent Mode](https://www.cookiebot.com/en/microsoft-consent-mode-cmp/) - [View all regulations](https://www.cookiebot.com/en/regulations-and-frameworks/) ### Partners - [Become an affiliate](https://www.cookiebot.com/en/affiliates/) - [Affiliate Login](https://app.impact.com/login.user) - [Become a partner](https://www.cookiebot.com/en/resellers/) - [Find a partner](https://www.cookiebot.com/en/cookiebot-reseller/) ### Resources - [Blog](https://www.cookiebot.com/en/blog/) - [Customer stories](https://www.cookiebot.com/en/customer-stories/) - [Customer directory](https://www.cookiebot.com/en/cookiebot-customer-directory/) - [Digital Markets Act Hub](https://www.cookiebot.com/en/digital-markets-act-dma-resources/) - [Google Consent Mode Hub](https://www.cookiebot.com/en/google-consent-mode-resources/) - [Google Consent Mode V2 certification](https://courses.usercentrics.com/course/google-consent-mode-v2) - [Google Consent Audit Fixes](https://www.cookiebot.com/en/google-consent-audit-fixes/) - [Cookie Banner Cost Calculator](https://www.cookiebot.com/en/cookie-banner-pricing-calculator/) ### Company - [About us](https://www.cookiebot.com/en/about/) - [Careers](https://usercentrics.com/career/) - [Support](https://support.cookiebot.com/hc/en-us/) - [Developer documentation](https://www.cookiebot.com/en/developer/) ©2026 Cookiebot. All rights reserved. Cookiebot is a trademark of Usercentrics A/S. Usercentrics A/S is registered in Denmark. Company reg. no.: 34624607. Do Not Sell or Share My Personal InformationData Subject RequestsManage Your Preferences [Privacy Policy](https://www.cookiebot.com/en/privacy-policy/) · [Terms of Service](/en/terms-of-service/) · [Cookie Declaration](https://www.cookiebot.com/en/cookie-declaration/) · [Data Processing Agreement](https://www.cookiebot.com/en/data-processing-agreement/) · [Legal Notice](https://www.cookiebot.com/en/legal-notice/) · [Accessibility Statement](https://www.cookiebot.com/en/accessibility-statement-wcag-compliance/)