north america
California
California's CCPA, as amended by the CPRA, is the leading US state privacy regime and should be read as one subnational layer within a broader US privacy landscape.
Editorial caveat
Structured values summarize official materials for research and planning. They are reviewed by humans before publication and should not be treated as legal advice.
high confidence, Leading US state regime with expanded rights and enforcement field coverage. Public interpretation should still frame it as one subnational layer within a wider US privacy model.
Parent context: This jurisdiction sits within United States, and should be interpreted as part of that broader regime structure.
Breach
- Breach deadline (hours)
- Immediate / without undue delay
- Breach notification required
- Yes
Marketing
- Cookie consent rule
- No blanket cookie consent rule, but sharing and sale opt-out signals matter.
Transfers
- Cross-border transfer restricted
- No
- Data localization required
- No
Governance
- DPO required
- No
- Impact assessment required
- Yes
- Records of processing required
- No
Identity
- Effective date
- 2023-01-01
- Effective status
- in-force
- Last amended
- 2023-03-29
- Law status
- active
Scope
- Extraterritorial application
- Yes
- Private sector coverage
- Yes
- Public sector coverage
- No
- Territorial scope
- Applies to covered businesses doing business in California and meeting statutory thresholds.
Legal Basis
- Legal bases
- Requires legal basis
- No
Enforcement
- Maximum fine
- Agency enforcement up to $2,500 per violation or $7,500 for intentional or children's-data violations.
- Private right of action
- Yes
- Enforcement authority summary
- CPPA and California Attorney General
Definitions
- Personal data definition
- Information that identifies, relates to, describes, or could reasonably be linked with a consumer or household.
- Sensitive data recognized
- Yes
Rights
- Right of access
- Yes
- Right to appeal
- No
- Right to deletion
- Yes
- Right to object
- Yes
- Right to portability
- Yes
- Opt-out rights summary
- Sale, sharing, certain profiling-related uses
- Right to correct
- Yes
- Right to delete
- Yes
Official sources
- California legislative informationPrimary official law • en • html
- California Privacy Protection Agency regulationsSecondary official material • en • html