CCPA

Possibly, depending on the elements. Civil Code section 1798.82 lists a name combined with a financial account number and any required access code or password. Names with Social Security numbers clearly qualify. For SEC-registered firms, Regulation S-P's broader definition of sensitive customer information may require notice even when California's list does not.

It may not be, but the firm and its counsel make that call on the facts. California defines a breach as unauthorized acquisition of personal information. An enterprise tool the firm contracted for, with terms barring training and limiting retention, presents different facts from a personal consumer account. Document the contract terms, account type and retention settings in the incident file.

Under Civil Code section 1798.82 as amended by SB 446, effective January 1, 2026, notice to affected California residents is due within 30 calendar days of discovering the breach. Delay is permitted for law enforcement needs or to determine scope and restore system integrity. When more than 500 residents are notified, the Attorney General gets a sample notice within 15 days.

It can. Civil Code section 1798.81 requires a business to shred, erase or otherwise make unreadable customer records containing personal information when they are no longer kept, and section 1798.80 defines business to include groups not organized for profit. Whether a donor counts as a customer is a question for counsel, so many nonprofits dispose of all personal information the same way.

The CCPA is not the only one. The California Constitution names privacy as an inalienable right in article I, section 1. Labor Code section 1198.5 lets current and former employees inspect and copy personnel records relating to their performance or a grievance, with the employer required to comply within 30 calendar days of a written request.

No. Section 7024(d) of the CCPA regulations bars disclosing Social Security numbers, driver's license or other government ID numbers, financial account numbers, health insurance or medical ID numbers, account passwords, security questions and answers, and unique biometric data. The business must instead tell the consumer it holds that type of information, described with sufficient particularity.

The California Privacy Protection Agency's regulations took effect January 1, 2026, but businesses that use automated decisionmaking technology to make significant decisions have until January 1, 2027 to comply with the ADMT requirements. Those requirements include a pre-use notice, a right to opt out subject to exceptions, and a right to access information about the ADMT.

The regulations define automated decisionmaking technology as any technology that processes personal information and uses computation to replace or substantially replace human decisionmaking, including profiling that does so. Tools such as spreadsheets, databases, firewalls and spam filters are excluded only when they do not replace human decisionmaking.

Only if the review meets the regulations' human involvement test. The reviewer must know how to interpret and use the tool's output, must review and analyze it along with other relevant information, and must have authority to make or change the decision. A sign-off without those elements does not count as human involvement.

If the opt-out arrives before ADMT processing begins, the business may not start. If it arrives after, the business must stop as soon as feasibly possible and no later than 15 business days after receipt, and must tell service providers and others it shared the information with to comply within the same time. It must then wait 12 months before asking again.

When an exception in 11 CCR 7221 applies. The main one is a human appeal: the consumer can appeal to a reviewer who can interpret the output and has authority to overturn the decision. Narrower exceptions cover ADMT used solely for admission, acceptance or hiring, or solely to allocate work or set pay, where the tool works as intended and does not unlawfully discriminate.

Under 11 CCR 7220, the notice must state the specific purpose for using ADMT in non-generic terms, the right to opt out and how to do it (or how to appeal, if relying on the human appeal exception), the right to access ADMT information, and a non-retaliation statement. Additional detail on how the ADMT works may be provided through a simple link.

No. Under Cal. Civ. Code § 1798.150(b), a consumer seeking statutory damages must first give the business 30 days' written notice, and the business may cure the violation if a cure is possible. The statute also says that implementing and maintaining reasonable security after a breach does not constitute a cure for that breach, so the evidence has to exist before an incident.

They can. The GLBA exemption in Civil Code section 1798.145(e) expressly does not apply to section 1798.150, the CCPA's private right of action for breaches of nonencrypted and nonredacted personal information caused by a failure to maintain reasonable security. Statutory damages are $107 to $799 per consumer per incident, as adjusted January 1, 2025, or actual damages if greater.

Yes, in limited cases. Cal. Civ. Code § 1798.150 lets a consumer sue when nonencrypted and nonredacted personal information is stolen or disclosed because the business failed to maintain reasonable security. Statutory damages are currently $107 to $799 per consumer per incident, or actual damages if greater. The CCPA's GLBA exemption does not apply to this section, so financial firms are not carved out.

No. The CCPA's partial exemption for job applicant, employee and contractor data in Civil Code section 1798.145(m) became inoperative on January 1, 2023, along with the business-to-business exemption in subdivision (n). California employees and applicants of a covered business now have CCPA rights in their personal information, including notice, access, deletion and correction.

Under section 7012 of the CCPA regulations, the notice lists the categories of personal information collected, the purposes for each, whether each category is sold or shared, how long each category will be retained or the criteria used, and a link to the privacy policy. It must be given at or before collection, such as during onboarding.

Yes, when the employer is a covered business. Employees, applicants and contractors can make CCPA requests to know, delete and correct, subject to the statute's exceptions. Civil Code section 1798.130(a)(2) gives the business 45 days to respond to a verifiable request, extendable once by another 45 days if it notifies the requester within the first 45.

No. Civil Code section 1798.145(e) exempts personal information collected, processed, sold or disclosed subject to the Gramm-Leach-Bliley Act. It exempts data, not companies. A financial firm that meets the CCPA's business definition still owes CCPA obligations for employee, applicant, website visitor, prospect and business contact data that is not handled under GLBA.

Usually not. Civil Code section 1798.145(e) exempts personal information collected, processed, sold or disclosed subject to the Gramm-Leach-Bliley Act. Applicant and employee data is generally not handled under GLBA, so a financial firm that meets the CCPA's business definition should evaluate hiring and HR tools under the ADMT rules with counsel.

Yes, when the employer is a covered business. Applicants are consumers under the CCPA, so they receive a notice at or before collection, usually on the careers page or in the applicant tracking system. In September 2025 the CPPA fined Tractor Supply $1,350,000 in a decision that included failing to notify California job applicants of their privacy rights.

At least once every 12 months. Civil Code section 1798.130(a)(5) requires a covered business to update the information in its privacy policy at least annually, and section 7011 of the CCPA regulations requires the policy to show the date it was last updated. The policy should also change whenever data practices change in a way it describes.

A business must confirm receipt within 10 business days and respond within 45 calendar days. It may extend once by up to 45 more calendar days, for a maximum of 90, if it notifies the consumer and explains why within the first 45 days. The deadlines come from Civil Code § 1798.130 and section 7021 of the CCPA regulations.

No. Civil Code § 1798.130(a)(2)(A) requires a business to disclose and deliver the required information free of charge within 45 days of receiving a verifiable consumer request. The time spent searching systems and compiling the response is a cost the business carries.

A business does not have to answer requests to know from the same consumer more than twice in a 12-month period. Civil Code § 1798.130(b) sets that limit for requests under sections 1798.110 and 1798.115. A simple request log with dates makes the limit easy to apply.

It can. Using automated decisionmaking technology to make a significant decision about employment is one of the processing activities listed in section 7150 of the CCPA regulations, as is inferring characteristics of job applicants or employees through systematic observation. For a business subject to the CCPA, the regulations require the assessment before new processing of this kind begins.

Processing that begins on or after January 1, 2026 needs a completed risk assessment before it starts. Processing that was already under way before 2026 and continues needs an assessment by December 31, 2027. Each assessment must be reviewed at least every three years and updated within 45 days of a material change, under section 7155 of the CCPA regulations.

A missing or late risk assessment is a violation of the CCPA regulations, which the California Privacy Protection Agency and the Attorney General enforce. As adjusted in January 2025, administrative fines reach $2,663 per violation and $7,988 per intentional violation. The executive who signs the annual attestation also signs it under penalty of perjury.

A summary and an attestation, not the full reports. The first submission is due April 1, 2028 and covers 2026 and 2027. It includes contact information, the period covered, the number of assessments and the categories of personal information involved, with an attestation signed under penalty of perjury by a responsible executive. Full reports must be produced within 30 days if requested.

No. They are separate requirements in the same 2025 CCPA regulations. A risk assessment covers specific high-risk processing activities, with the first attestation due April 1, 2028. A cybersecurity audit reviews the business's security program, with first certifications due April 1, 2028, 2029 or 2030 depending on annual revenue.

No law requires the CIS Controls by name. California's Civil Code section 1798.81.5 requires reasonable security without defining it, and the California Attorney General's 2016 data breach report said that not adopting the CIS Controls as the start of a security program would indicate a failure to provide reasonable security. Many firms use IG1 as a documented baseline for that reason.

It can. A data broker is a business that knowingly collects and sells personal information about consumers it has no direct relationship with, and a CCPA consumer is any California resident. The CCPA's business-to-business exemption became inoperative on January 1, 2023, so a vendor selling contact details of California professionals can meet the definition. Check the vendor against CalPrivacy's data broker registry.

Starting January 1, 2027, yes. Civil Code section 1798.136, added by AB 566, bars a business from developing or maintaining a browser that lacks a consumer-configurable setting to send an opt-out preference signal. The setting must be easy to find, and the browser maker must explain how it works. Consumers still choose whether to turn it on.

Usually not. The CCPA's definition of a covered business centers on entities organized or operated for the profit or financial benefit of their owners, so most charities fall outside it, though separate tests can reach some entities tied to a covered business. California's reasonable security statute, Civil Code section 1798.81.5, still applies to nonprofits, because the related definition of business includes organizations not run for profit.

At least once every 45 days. Under Civil Code section 1798.99.86, a registered data broker must access DROP at least every 45 days, process requests within 45 days, and keep deleting a requester's personal information at least every 45 days after that. Failing to delete carries a $200 fine per deletion request for each day of the failure.

Under the CCPA regulations, a business must apply a valid signal to the browser or device and any associated profile, and to the consumer if the business knows who they are. In February 2026 the Attorney General's $2.75 million Disney settlement cited limiting GPC opt-outs to a single device even when the consumer was logged in.

DROP, the Delete Request and Opt-out Platform, lets a California resident send one deletion request to every registered data broker. It was created by the Delete Act and is run by the California Privacy Protection Agency. Consumers could submit requests starting in January 2026, and registered data brokers have had to process them since August 1, 2026.

Global Privacy Control, or GPC, is a browser setting that sends websites a signal asking them not to sell or share the visitor's personal information. California's Attorney General said in January 2021 that GPC satisfies the CCPA's opt-out requirements, and regulators have since penalized businesses that ignored it. California will require browsers to offer an opt-out signal starting January 1, 2027.

The CCPA applies to for-profit businesses that do business in California and meet at least one statutory test. The most common is annual gross revenue above $26,625,000, the CPPA's threshold as adjusted on January 1, 2025. Separate tests cover businesses that buy, sell or share large volumes of personal information or earn most of their revenue from selling or sharing it.

Entities that do not meet the CCPA's definition of a business, such as most nonprofits and for-profit firms below every threshold in Civil Code section 1798.140(d), are outside it. Sections 1798.145 and 1798.146 also exempt certain data rather than companies, including personal information handled under GLBA, consumer reports governed by the Fair Credit Reporting Act, and protected health information covered by HIPAA.